Uninstall

Intent

This pattern removes more elaborate relationships originating from one or more objects, then removes the origin object(s).

Motivation

There are occurrences of removing and dismantling objects with more elaborate relationships to their surrounding. These relationships may be direct or indirect.

Uninstall is not explicitly featured as frequently as Install, but it is a necessary inverse pattern.

Possible use cases

• Removing at least one link followed by an origin object.
• Deleting a configuration object and its relationships.
• Removing executable logic from an system, possibly impairing or downgrading it.
• Unlinking an authentication item, then removing it.
• Deleting a copy of some object with more elaborate relationships.
• Removing inert objects from more elaborate structures.

Code example

asset Host {
 | revokeKey >
    A> self / keys
    A> identities / ~keys.owners

 | disengageMalware >
    R> applications[Malware] / ~parent[Scheduler]
    R> applications[Malware] / self
}

asset Key {}
asset Account {}
asset Application {[...]}
asset Malware extends Application {[...]}
asset Scheduler extends Application {[...]}

associations {
  Host [host] * <-- Storage --> * [keys] Directory
  Host [host] 1 <-- Accounts --> * [identities] Identity
  Identity [owners] * <-- Identify --> * [keys] Key
  Host [host] 1 <-- Execution --> * [applications] Application
  Application [parent] 1 <-- Process --> * [child] Application
}

Possible synonyms

•delete •destroy •erase •reformat •remove •wipe

Occurrences

ATT&CK

•Account access removal •Disk wipe •Inhibit system recovery •Modify cloud compute infrastructure •Modify system image