T0129.006 "Deny involvement"

Tactic stage: TA11

Summary: Without "smoking gun" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in "Demand insurmountable proof", specifically the asymmetric disadvantage for truth-tellers in a "firehose of misinformation" environment.

Relationships

Has counters:

Detection methods include:

Datasets

Examples include:

Seen in incidents: