+Disable or Remove Feature or Program

Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

  • Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash).
  • Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

  • Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required.
  • Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

  • Use Case: Prevent users from installing unauthorized software via group policies or other management tools.
  • Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

  • Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices.
  • Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

  • Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes.
  • Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is related to Mitigations
blocks Re-opened Applications
blocks SSH
blocks Cloud Application Integration
blocks VNC
blocks Exploitation of Remote Services
blocks Visual Basic
blocks Wordlist Scanning
blocks Windows Remote Management
blocks Inter-Process Communication
blocks Run Virtual Instance
blocks Name Resolution Poisoning and SMB Relay
blocks Network Service Discovery
blocks Electron Applications
blocks ClickOnce
blocks Steal or Forge Authentication Certificates
blocks Email Forwarding Rule
blocks Adversary-in-the-Middle
blocks Exfiltration Over Other Network Medium
blocks Account Manipulation
blocks Disable or Modify Tools
blocks Exfiltration over USB
blocks Mark-of-the-Web Bypass
blocks Server Software Component
blocks JamPlus
blocks PowerShell
blocks Odbcconf
blocks Replication Through Removable Media
blocks Office Application Startup
blocks Screensaver
blocks Command and Scripting Interpreter
blocks Distributed Component Object Model
blocks Remote Desktop Protocol
blocks Windows Credential Manager
blocks Communication Through Removable Media
blocks RDP Hijacking
blocks Mavinject
blocks Remote Service Session Hijacking
blocks SSH Authorized Keys
blocks ARP Cache Poisoning
blocks Remote Desktop Software
blocks Verclsid
blocks Mshta
blocks SSH Hijacking
blocks External Remote Services
blocks Msiexec
blocks VBA Stomping
blocks JavaScript
blocks Container Administration Command
blocks InstallUtil
blocks MSBuild
blocks Exfiltration Over Bluetooth
blocks MMC
blocks Cloud Instance Metadata API
blocks Emond
blocks Remote Services
blocks Direct Cloud VM Connections
blocks Office Template Macros
blocks Web Shell
blocks Traffic Signaling
blocks System Binary Proxy Execution
blocks Exfiltration Over Physical Medium
blocks Regsvcs/Regasm
blocks Template Injection
blocks Dynamic Data Exchange
blocks Downgrade Attack
blocks Additional Email Delegate Permissions
blocks Trusted Developer Utilities Proxy Execution
blocks Escape to Host
blocks Remote Access Tools
blocks Additional Cloud Credentials
blocks CMSTP
blocks Steal Application Specific Passwords
  • MITREATTACK -

    EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

    DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.