We welcome your feedback about MITRE Engage™ v0.9 Beta: Email us at engage@mitre.org


Impair an adversary's ability to conduct their operation as intended.

Disruption is used to stop or discourage an adversary from conducting part or all of their mission. This disruption may increase the time, skills, or resources needed for the adversary to accomplish a specific task. For example, a defender may degrade network speeds as the adversary attempts to exfiltrate large blocks of data. As a second example, the defender may manipulate the output of commonly used discovery commands to show targets that do not exist or to hide real targets. In either case, the adversary may waste resources acting on partial or falsified data.

Disruptions may also include planting misinformation designed to influence the adversary's decision-makers to make the wrong decisions or to waste resources.

ID: EAP0005
Type:  Engagement
Goals:  Affect


Activity NameDescriptionID
Decoy Artifacts and Systems Introduce impersonations to expand the scope of a deceptive story. EAC0005
Isolation Configure devices, systems, networks, etc. to contain activity and data, thus preventing the expansion an engagement beyond desired limits. EAC0020
Network Manipulation Make changes to network properties and functions to achieve a desired effect. EAC0016
Software Manipulation Make changes to a system's software properties and functions to achieve a desired effect. EAC0014