M1042: Disable or Remove Feature or Program

M1042: Disable or Remove Feature or Program describes Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., leg...

Executive priority

M1042: Disable or Remove Feature or Program is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate M1042: Disable or Remove Feature or Program by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether M1042: Disable or Remove Feature or Program appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

- Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

- Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

- Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

- Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

- Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques71 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1547.007	Re-opened ApplicationsSub-technique	This feature can be disabled entirely with the following terminal command: `defaults write -g ApplePersistence -bool no`.
Enterprise	T1021.004	SSHSub-technique	Disable the SSH daemon on systems that do not require it, especially ESXi servers. For macOS, ensure Remote Login is disabled under Sharing Preferences.CitationApple Unified Log Analysis Remote Login and Screen Sharing
Enterprise	T1671	Cloud Application Integration	Do not allow users to add new application integrations into a SaaS environment. In Entra ID environments, consider enforcing the “Do not allow user consent” option.CitationMicrosoft Entra Configure OAuth Consent
Enterprise	T1021.005	VNCSub-technique	Uninstall any VNC server software where not required.
Enterprise	T1059.005	Visual BasicSub-technique	Turn off or restrict access to unneeded VB components.
Enterprise	T1595.003	Wordlist ScanningSub-technique	Remove or disable access to any systems, resources, and infrastructure that are not explicitly required to be available externally.
Enterprise	T1021.006	Windows Remote ManagementSub-technique	Disable the WinRM service.
Enterprise	T1559	Inter-Process Communication	Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. CitationMicrosoft DDE Advisory Nov 2017CitationBleepingComputer DDE Disabled in Word Dec 2017CitationGitHub Disable DDEAUTO Oct 2017 Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.CitationMicrosoft ADV170021 Dec 2017
Enterprise	T1564.006	Run Virtual InstanceSub-technique	Disable native virtualization technologies such as Hyper-V if not necessary within a given environment. Consider also disabling Windows Sandbox if it is not needed to test or debug applications.
Enterprise	T1557.001	Name Resolution Poisoning and SMB RelaySub-technique	Disable LLMNR, mDNS, and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. CitationADSecurity Windows Secure Baseline
Enterprise	T1046	Network Service Discovery	Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.
Enterprise	T1218.015	Electron ApplicationsSub-technique	Remove or deny access to unnecessary and potentially vulnerable software and features to prevent abuse by adversaries. Many native binaries may not be necessary within a given environment: for example, consider disabling the Node.js integration in all renderers that display remote content to protect users by limiting adversaries’ power to plant malicious JavaScript within Electron applications.CitationElectron Security 2
Enterprise	T1127.002	ClickOnceSub-technique	Disable ClickOnce installations from the internet using the following registry key: `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\TrustManager\PromptingLevel — Internet:Disabled`CitationNetSPI ClickOnceCitationMicrosoft Learn ClickOnce Config ClickOnce may not be necessary within an environment and should be disabled if not being used.
Enterprise	T1114.003	Email Forwarding RuleSub-technique	Consider disabling external email forwarding.CitationMicrosoft BEC Campaign
Enterprise	T1557	Adversary-in-the-Middle	Disable legacy network protocols that may be used to intercept network traffic if applicable, especially those that are not needed within an environment.
Enterprise	T1011	Exfiltration Over Other Network Medium	Disable WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel in local computer security settings or by group policy if it is not needed within an environment.
Enterprise	T1098	Account Manipulation	Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.
Enterprise	T1685	Disable or Modify Tools	Consider removing previous versions of tools that are unnecessary to the environment when possible.
Enterprise	T1052.001	Exfiltration over USBSub-technique	Disable Autorun if it is unnecessary. CitationMicrosoft Disable Autorun Disallow or restrict removable media at an organizational policy level if they are not required for business operations. CitationTechNet Removable Media Control
Enterprise	T1553.005	Mark-of-the-Web BypassSub-technique	Consider disabling auto-mounting of disk image files (i.e., .iso, .img, .vhd, and .vhdx). This can be achieved by modifying the Registry values related to the Windows Explorer file associations in order to disable the automatic Explorer "Mount and Burn" dialog for these file extensions. Note: this will not deactivate the mount functionality itself.CitationGitHub MOTW
Enterprise	T1505	Server Software Component	Consider disabling software components from servers when possible to prevent abuse by adversaries.CitationITSyndicate Disabling PHP functions
Enterprise	T1127.003	JamPlusSub-technique	JamPlus may not be necessary within a given environment and should be removed if not used.
Enterprise	T1059.001	PowerShellSub-technique	It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions. Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.
Enterprise	T1218.008	OdbcconfSub-technique	Odbcconf.exe may not be necessary within a given environment.
Enterprise	T1091	Replication Through Removable Media	Disable Autorun if it is unnecessary. CitationMicrosoft Disable Autorun Disallow or restrict removable media at an organizational policy level if it is not required for business operations. CitationTechNet Removable Media Control
Enterprise	T1137	Office Application Startup	Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Disable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. CitationMRWLabs Office Persistence Add-ins
Enterprise	T1546.002	ScreensaverSub-technique	Use Group Policy to disable screensavers if they are unnecessary.CitationTechNet Screensaver GP
Enterprise	T1059	Command and Scripting Interpreter	Disable or remove any unnecessary or unused shells or interpreters.
Enterprise	T1021.003	Distributed Component Object ModelSub-technique	Consider disabling DCOM through Dcomcnfg.exe.CitationMicrosoft Disable DCOM
Enterprise	T1021.001	Remote Desktop ProtocolSub-technique	Disable the RDP service if it is unnecessary.
Enterprise	T1555.004	Windows Credential ManagerSub-technique	Consider enabling the “Network access: Do not allow storage of passwords and credentials for network authentication” setting that will prevent network credentials from being stored by the Credential Manager.CitationMicrosoft Network access Credential Manager
Enterprise	T1092	Communication Through Removable Media	Disable Autoruns if it is unnecessary.CitationMicrosoft Disable Autorun
Enterprise	T1563.002	RDP HijackingSub-technique	Disable the RDP service if it is unnecessary.
Enterprise	T1218.013	MavinjectSub-technique	Consider removing mavinject.exe if Microsoft App-V is not used within a given environment.
Enterprise	T1563	Remote Service Session Hijacking	Disable the remote service (ex: SSH, RDP, etc.) if it is unnecessary.
Enterprise	T1098.004	SSH Authorized KeysSub-technique	Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using `/etc/ssh/sshd_config`. Setting the `PermitRootLogin` directive to `no` will prevent the root user from logging in via SSH.CitationBroadcom ESXi SSH
Enterprise	T1557.002	ARP Cache PoisoningSub-technique	Consider disabling updating the ARP cache on gratuitous ARP replies.
Enterprise	T1219.002	Remote Desktop SoftwareSub-technique	Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.
Enterprise	T1218.012	VerclsidSub-technique	Consider removing verclsid.exe if it is not necessary within a given environment.
Enterprise	T1218.005	MshtaSub-technique	Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life.
Enterprise	T1563.001	SSH HijackingSub-technique	Ensure that agent forwarding is disabled on systems that do not explicitly require this feature to prevent misuse. CitationSymantec SSH and ssh-agent
Enterprise	T1133	External Remote Services	Disable or block remotely available services that may be unnecessary.
Enterprise	T1218.007	MsiexecSub-technique	Consider disabling the `AlwaysInstallElevated` policy to prevent elevated execution of Windows Installer packages.CitationMicrosoft AlwaysInstallElevated 2018
Enterprise	T1564.007	VBA StompingSub-technique	Turn off or restrict access to unneeded VB components.CitationMicrosoft Disable VBA Jan 2020
Enterprise	T1059.007	JavaScriptSub-technique	Turn off or restrict access to unneeded scripting components.
Enterprise	T1609	Container Administration Command	Remove unnecessary tools and software from containers.
Enterprise	T1218.004	InstallUtilSub-technique	InstallUtil may not be necessary within a given environment.
Enterprise	T1127.001	MSBuildSub-technique	MSBuild.exe may not be necessary within an environment and should be removed if not being used.
Enterprise	T1218.014	MMCSub-technique	MMC may not be necessary within a given environment since it is primarily used by system administrators, not regular users or clients.
Enterprise	T1552.005	Cloud Instance Metadata APISub-technique	Disable unnecessary metadata services and restrict or disable insecure versions of metadata services that are in use to prevent adversary access.CitationAmazon AWS IMDS V2
Enterprise	T1546.014	EmondSub-technique	Consider disabling emond by removing the Launch Daemon plist file.
Enterprise	T1021	Remote Services	If remote services, such as the ability to make direct connections to cloud virtual machines, are not required, disable these connection types where feasible. On ESXi servers, consider enabling lockdown mode, which disables direct access to an ESXi host and requires that the host be managed remotely using vCenter.CitationGoogle Cloud Threat Intelligence ESXi Hardening 2023CitationBroadcom ESXi Lockdown Mode
Enterprise	T1021.008	Direct Cloud VM ConnectionsSub-technique	If direct virtual machine connections are not required for administrative use, disable these connection types where feasible.
Enterprise	T1137.001	Office Template MacrosSub-technique	Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Disable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. CitationMRWLabs Office Persistence Add-ins
Enterprise	T1505.003	Web ShellSub-technique	Consider disabling functions from web technologies such as PHP’s `evaI()` that may be abused for web shells.CitationITSyndicate Disabling PHP functions
Enterprise	T1205	Traffic Signaling	Disable Wake-on-LAN if it is not needed within an environment.
Enterprise	T1218	System Binary Proxy Execution	Many native binaries may not be necessary within a given environment.
Enterprise	T1052	Exfiltration Over Physical Medium	Disable Autorun if it is unnecessary. CitationMicrosoft Disable Autorun Disallow or restrict removable media at an organizational policy level if they are not required for business operations. CitationTechNet Removable Media Control
Enterprise	T1218.009	Regsvcs/RegasmSub-technique	Regsvcs and Regasm may not be necessary within a given environment.
Enterprise	T1221	Template Injection	Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents CitationMicrosoft Disable Macros, though this setting may not mitigate the Forced Authentication use for this technique.
Enterprise	T1559.002	Dynamic Data ExchangeSub-technique	Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. CitationMicrosoft DDE Advisory Nov 2017CitationBleepingComputer DDE Disabled in Word Dec 2017CitationGitHub Disable DDEAUTO Oct 2017 Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.CitationMicrosoft ADV170021 Dec 2017
Enterprise	T1689	Downgrade Attack	Consider removing previous versions of tools that are unnecessary to the environment when possible.
Enterprise	T1098.002	Additional Email Delegate PermissionsSub-technique	If email delegation is not required, disable it. In Google Workspace this can be accomplished through the Google Admin console.CitationGmail Delegation
Enterprise	T1127	Trusted Developer Utilities Proxy Execution	Specific developer utilities may not be necessary within a given environment and should be removed if not used.
Enterprise	T1611	Escape to Host	Remove unnecessary tools and software from containers.
Enterprise	T1219	Remote Access Tools	Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.
Enterprise	T1098.001	Additional Cloud CredentialsSub-technique	Remove unnecessary and potentially abusable authentication mechanisms where possible. For example, in Entra ID environments, disable the app password feature unless explicitly required.
Enterprise	T1218.003	CMSTPSub-technique	CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).
Enterprise	T1649	Steal or Forge Authentication Certificates	Consider disabling old/dangerous authentication protocols (e.g. NTLM), as well as unnecessary certificate features, such as potentially vulnerable AD CS web and other enrollment server roles.CitationSpecterOps Certified Pre Owned
Enterprise	T1210	Exploitation of Remote Services	Minimize available services to only those that are necessary.
Enterprise	T1011.001	Exfiltration Over BluetoothSub-technique	Disable Bluetooth in local computer security settings or by group policy if it is not needed within an environment.

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.2
Created: Jun 11, 2019, 16:45 UTC (UTC+00:00)
Modified: May 12, 2026, 15:12 UTC (UTC+00:00)
Raw hash: 2716083433cfdb09...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.2	May 12, 2026, 15:12 UTC (UTC+00:00)	Current bundle	`2716083433cf…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	May 12, 2026, 15:12 UTC (UTC+00:00)	Older bundle	`2716083433cf…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
mitre-attackM1042
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use