The CIS Critical Security Controls® (CIS Controls®) are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks. These mappings provide resources for assessing effective technical defenses against actual real-world threats as described in the MITRE ATT&CK® knowledge base and provide a foundation for integrating ATT&CK-based threat intelligence into the process. The connection of ATT&CK with the CIS Controls empowers threat-informed analysis and decision-making for cybersecurity control program design and implementation.
CIS Controls Versions: 8.1.2 ATT&CK Versions: 19.1 ATT&CK Domain: Enterprise
Mapping Methodology | Mapping Scope | CIS Controls (External link)
| ID | Capability Group Name | Number of Mappings | Number of Capabilities |
|---|---|---|---|
| CIS-2 | Inventory and Control of Software Assets | 55 | 4 |
| CIS-3 | Data Protection | 46 | 9 |
| CIS-4 | Secure Configuration of Enterprise Assets and Software | 217 | 9 |
| CIS-5 | Account Management | 24 | 3 |
| CIS-6 | Access Control Management | 162 | 5 |
| CIS-7 | Continuous Vulnerability Management | 79 | 3 |
| CIS-9 | Email and Web Browser Protections | 91 | 7 |
| CIS-10 | Malware Defenses | 28 | 5 |
| CIS-11 | Data Recovery | 38 | 3 |
| CIS-12 | Network Infrastructure Management | 72 | 7 |
| CIS-13 | Network Monitoring and Defense | 212 | 6 |
| CIS-15 | Service Provider Management | 3 | 1 |
| CIS-16 | Application Software Security | 96 | 7 |
| CIS-18 | Penetration Testing | 20 | 1 |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1547.006 | Kernel Modules and Extensions |
Comments
Adversaries load malicious kernel modules or extensions for persistence or privilege escalation. Host-based security solutions can monitor module loading, detect known rootkits or unauthorized kernel modifications, and block or alert on suspicious kernel-extension activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1059.006 | Python |
Comments
Adversaries use Python interpreters and scripts to execute malicious commands and payloads. EDR/HIPS can monitor anomalous Python execution, unusual parent-child relationships, network activity, and other suspicious behaviors, and can block or quarantine malicious payloads.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1059.001 | PowerShell |
Comments
Adversaries use PowerShell to execute commands, scripts, and payloads. EDR/HIPS can monitor PowerShell process behavior, command lines, script activity, child processes, and suspicious follow-on actions, and can block or quarantine malicious activity
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1187 | Forced Authentication |
Comments
Adversaries coerce systems into authenticating to attacker-controlled SMB or WebDAV resources in order to capture credential material. This control requires traffic filtering between network segments, which can block or tightly restrict SMB and WebDAV communications to untrusted or unauthorized destinations, directly preventing the outbound authentication path required by the technique.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1563.002 | RDP Hijacking |
Comments
Dedicated administrative workstations and segmented management networks reduce who can reach hosts carrying privileged RDP sessions and separate administrative activity from ordinary user networks. This does not prevent hijacking after the admin host itself is compromised, but it directly reduces network exposure of those sessions.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Adversaries hijack existing SSH, RDP, or other remote-management sessions. Keeping administrative sessions on dedicated, segmented resources reduces exposure of those sessions to compromised user endpoints and limits unnecessary network paths to privileged remote services.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Dedicated administrative resources are explicitly segmented from the primary enterprise network and denied Internet access. That separation reduces opportunities for adversaries on user or Internet-connected networks to position themselves between administrative systems and managed infrastructure, directly shrinking the attack surface for interception of privileged sessions.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1599.001 | Network Address Translation Traversal |
Comments
This sub-technique concerns traversing or bypassing network boundaries implemented through NAT and perimeter devices. Secure architecture using explicit trust zones, controlled routing, segmentation, and restricted inbound/outbound paths directly constrains the network reachability needed for NAT traversal.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1599 | Network Boundary Bridging |
Comments
This technique directly concerns adversaries compromising network devices to bypass segmentation and route prohibited traffic across trust boundaries. Because this control requires network segmentation and least privilege, designing and maintaining strong trust boundaries directly constrains the traffic paths the adversary is attempting to bridge. ATT&CK describes the technique specifically in terms of bypassing segmentation and boundary-device policy
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1557 | Adversary-in-the-Middle |
Comments
ATT&CK recommends network segmentation, traffic filtering, restricted access to network infrastructure, encryption, and network intrusion prevention for AiTM activity. Segmentation under this control reduces the network scope in which an adversary can position itself between communicating systems and restricts access to infrastructure capable of reshaping traffic
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1556.004 | Network Device Authentication |
Comments
This sub-technique specifically targets authentication on network devices. ATT&CK recommends MFA, privileged-account restriction, TACACS+/RADIUS, and vendor hardening; a secure network architecture that isolates the management plane and applies least-privilege administrative access directly constrains the access needed to modify network-device authentication.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1542.005 | TFTP Boot |
Comments
Adversaries can manipulate network-device boot configuration to load an unauthorized image from a malicious TFTP server. ATT&CK recommends limiting access to administrative interfaces, restricting insecure protocols, AAA/command authorization, and network-level filtering which are mechanisms that can be implemented as part of a secure management-plane architecture under this control.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1200 | Hardware Additions |
Comments
Adversaries may introduce unauthorized devices onto the network. ATT&CK recommends network access controls such as 802.1X, device certificates, and restricting DHCP to registered devices; these are architectural admission-control mechanisms that directly prevent unauthorized hardware from communicating with trusted systems.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1059.008 | Network Device CLI |
Comments
Adversaries use network-device CLIs to execute commands and modify device behavior. ATT&CK recommends AAA, least privilege, and command authorization such as TACACS+ to restrict which administrative commands users may execute. Because this control explicitly requires least privilege within the network architecture, this is a strong mapping when that architecture includes management-plane and command-access controls.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Adversaries use SMB and administrative shares for remote access and lateral movement. A secure network architecture that enforces segmentation and least-privilege network access can restrict SMB connectivity to approved source/destination relationships, directly reducing the network reachability required for unauthorized lateral movement.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1530 | Data from Cloud Storage |
Comments
Adversaries collect data directly from improperly secured or compromised cloud storage. When backup or recovery data is stored in cloud object storage, this safeguard requires that recovery data be protected with controls such as encryption and separation, directly reducing unauthorized access to those backup objects
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1003.003 | NTDS |
Comments
Adversaries may obtain NTDS.dit from Domain Controller backups rather than directly from a live Domain Controller and extract credential material from the database. This safeguard requires recovery data to receive equivalent protections, including encryption or separation, which directly restricts unauthorized access to Domain Controller backup copies containing NTDS data
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1490 | Inhibit System Recovery |
Comments
Adversaries inhibit recovery by deleting or disabling backups, snapshots, recovery catalogs, and related recovery mechanisms. This safeguard requires automated, recurring backups of in-scope enterprise assets, ensuring that recoverable copies are created on a regular basis and thereby reducing the effectiveness of attempts to eliminate available recovery data.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1027 | Obfuscated Files or Information |
Comments
Anti-malware software can detect and quarantine malicious files or commands that use encoding, packing, encryption, or other obfuscation techniques to evade detection.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1027 | Obfuscated Files or Information |
Comments
Behavior-based anti-malware can identify malicious activity after obfuscated content is decoded, unpacked, interpreted, or executed, allowing detection or blocking based on runtime behavior rather than relying solely on static signatures.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1602 | Data from Configuration Repository |
Comments
When known vulnerabilities affect network-device software, system images, or management components that expose configuration repositories, applying patches or supported software upgrades removes those weaknesses and reduces vulnerability dependent access to configuration data.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
When known vulnerabilities affect SNMP-enabled network-device software or system images, applying patches or supported software upgrades removes those weaknesses and reduces opportunities to collect MIB data through vulnerable implementations.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
When known vulnerabilities affect network-device software or system images used to expose or retrieve device configurations, applying patches or supported software upgrades removes those weaknesses and reduces exploit-based opportunities to obtain configuration data.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1003.006 | DCSync |
Comments
Role-based access control (RBAC) can restrict Active Directory replication permissions, including Replicating Directory Changes rights, to authorized administrative roles. Enforcing these permissions limits which identities can perform the directory replication operations required for DCSync.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Role-based access control (RBAC) can restrict local administrator membership and administrative-share access to authorized roles. These enforced permissions limit the accounts that can use SMB and Windows administrative shares for remote administration and lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1021.006 | Windows Remote Management |
Comments
Role-based access control (RBAC) can restrict WinRM accounts and permissions to authorized administrative roles. Enforced WinRM permissions limit which identities can use the service for remote execution and lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1218.007 | Msiexec |
Comments
Role-based access control (RBAC) can restrict execution of Msiexec.exe to privileged accounts or groups with an authorized operational need. Enforcing this entitlement reduces opportunities for adversaries to abuse Windows Installer for proxy execution.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1525 | Implant Internal Image |
Comments
Role-based access control (RBAC) can limit permissions to create, modify, or publish platform and container images to authorized roles. Enforcing these permissions reduces an adversary's ability to implant malicious images within enterprise repositories.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1538 | Cloud Service Dashboard |
Comments
Role-based access control (RBAC) can enforce least-privilege dashboard visibility so users can access only the cloud resources required for their assigned roles. This limits the information and resources exposed through a cloud service dashboard when an account is compromised.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1548.002 | Bypass User Account Control |
Comments
Role-based access control (RBAC) can restrict local administrator membership to authorized roles. Removing unnecessary administrative rights reduces the accounts from which adversaries can leverage UAC bypass techniques to obtain elevated privileges.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1548.003 | Sudo and Sudo Caching |
Comments
Role-based access control (RBAC) can enforce which users or groups are authorized for sudo privileges and which elevated commands they may run. Restricting these entitlements limits the identities and operations available for privilege elevation through sudo.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1556.004 | Network Device Authentication |
Comments
Role-based access control (RBAC) can restrict network-device administrator privileges to narrowly scoped authorized roles. Enforcing least-privilege administrative access reduces the identities capable of modifying network-device authentication mechanisms.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1211 | Exploitation for Stealth |
Comments
Security anti-exploitation tools and applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to help mitigate some exploitation behavior to evade detection.
References
|
| CIS-10.3 | Disable Autorun and Autoplay for Removable Media | mitigates | T1092 | Communication Through Removable Media |
Comments
Disable Autoruns if it is unnecessary to help prevent adversaries from performing command and control between compromised hosts on potentially disconnected networks by using removable media to transfer commands from system to system.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.008 | Network Provider DLL |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.007 | Hybrid Identity |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials (e.g., hybrid identity environment admin, synchronization service, cloud tenant) to patch, modify, or otherwise backdoor cloud authentication processes
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.006 | Multi-Factor Authentication |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to disable or modify MFA mechanisms and enable persistent access to compromised accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.005 | Reversible Encryption |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials (e.g., domain/identity policy administrator, local security policy administrator) to abuse Active Directory encryption properties and gain access to credentials on Windows systems.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.004 | Network Device Authentication |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to bypass of native authentication mechanisms for tenant/device management accounts on network devices.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.003 | Pluggable Authentication Modules |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.002 | Password Filter DLL |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to register malicious password filter dynamic link libraries (DLLs) into the authentication process.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.001 | Domain Controller Authentication |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556 | Modify Authentication Process |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to modify authentication processes or mechanisms.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1110.004 | Credential Stuffing |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using credentials obtained from breach dumps to gain access to admin accounts through credential overlap.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1110.003 | Password Spraying |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using commonly used passwords to attempt to acquire valid admin credentials.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1110.002 | Password Cracking |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using password cracking to recover admin credentials.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1110.001 | Password Guessing |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using password guessing to access admin accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1110 | Brute Force |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from brute forcing admin credentials.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1072 | Software Deployment Tools |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to provide system and access isolation for critical network systems.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.009 | Conditional Access Policies |
Comments
Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to disable or modify conditional access policies.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1059.011 | Lua |
Comments
Adversaries use Lua interpreters to execute Lua code. An application-control policy denying unauthorized Lua interpreters prevents those binaries from running, directly restricting Lua execution.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1059.006 | Python |
Comments
Adversaries use Python interpreters to execute malicious commands and payloads. An enforced allowlist denying Python prevents the interpreter from executing, directly removing the prerequisite for Python-based execution.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1176 | Software Extensions |
Comments
Adversaries install or use malicious browser or IDE extensions to obtain execution or persistence. The implementation to explicitly allowlists authorized extensions and blocks all others, unauthorized extensions cannot be installed or loaded, directly constraining the technique.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1564.003 | Hidden Window |
Comments
Adversaries may hide application windows while malicious programs execute. Where an unauthorized program is responsible for the hidden-window behavior, application allowlisting prevents that program from running and therefore prevents that implementation of the technique.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1548.004 | Elevated Execution with Prompt |
Comments
Adversaries may persuade users to approve elevated execution of malicious applications. If application control prevents the unapproved application from executing regardless of user approval, the malicious program cannot reach the elevation stage through this path.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1546.002 | Screensaver |
Comments
Adversaries can establish execution or persistence using malicious .scr screensaver files. Application-control rules can prevent unauthorized .scr files from executing, directly blocking the malicious executable used by the technique
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.014 | MMC |
Comments
Adversaries can abuse Microsoft Management Console to execute malicious content through a trusted system binary. Application allowlisting can block MMC on systems where its use is not authorized, directly preventing the executable from being used for proxy execution.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.013 | Mavinject |
Comments
Adversaries abuse mavinject.exe to inject malicious code into another process through a trusted Microsoft executable. Application allowlisting can deny execution of mavinject.exe where it is not authorized, directly preventing use of that binary for the technique.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.012 | Verclsid |
Comments
Adversaries abuse verclsid.exe to execute malicious COM objects through a trusted Windows binary. Application allowlisting can block verclsid.exe where it is unnecessary, directly preventing its use as the proxy executable.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.009 | Regsvcs/Regasm |
Comments
Adversaries use Regsvcs.exe or Regasm.exe to proxy execution of malicious .NET code. Application allowlisting can prevent these binaries from executing on systems where they are not authorized, directly preventing this execution path.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.008 | Odbcconf |
Comments
Adversaries abuse odbcconf.exe to execute malicious code through a trusted Windows utility. Application allowlisting can deny execution of odbcconf.exe where it is not required, directly preventing use of that proxy-execution mechanism.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.005 | Mshta |
Comments
Adversaries abuse mshta.exe to execute HTML application or script content through a trusted Windows binary. Application allowlisting can explicitly deny mshta.exe, preventing the executable from being used for proxy execution.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.004 | InstallUtil |
Comments
Adversaries use InstallUtil.exe to execute malicious .NET code while proxying execution through a trusted binary. Application allowlisting can block InstallUtil where it is not authorized, directly preventing use of the utility for this behavior.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.003 | CMSTP |
Comments
Adversaries abuse cmstp.exe to proxy execution of malicious code through a trusted Windows utility. Application allowlisting can prevent cmstp.exe from executing on systems where it is not required, directly removing the proxy-execution mechanism.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218.001 | Compiled HTML File |
Comments
Adversaries abuse hh.exe to execute malicious compiled HTML content through a trusted Windows binary. Application allowlisting can block hh.exe where it is not authorized, preventing use of that binary for proxy execution.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1127.001 | MSBuild |
Comments
Adversaries abuse msbuild.exe to execute malicious code through a trusted Microsoft developer utility. Application allowlisting can deny execution of MSBuild on systems where it is not authorized, directly eliminating the binary used for proxy execution.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1059.010 | AutoHotKey & AutoIT |
Comments
Adversaries use AutoHotKey and AutoIT interpreters to execute automated commands and malicious scripts. Application allowlisting can block AutoHotkey.exe, AutoIt3.exe, and related unauthorized executables, directly preventing those interpreters from executing.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1127.001 | MSBuild |
Comments
Adversaries abuse MSBuild to execute malicious code through a trusted developer utility. When MSBuild is unnecessary, explicitly classified as unauthorized, and removed under this safeguard, the executable required for this proxy-execution technique is eliminated.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1059.011 | Lua |
Comments
Adversaries can use a Lua interpreter to execute malicious Lua commands or scripts. When Lua is unauthorized on the asset and is removed through this safeguard, the interpreter required to execute Lua code is no longer available, directly restricting the technique.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1059.006 | Python |
Comments
Adversaries use installed Python interpreters to execute commands, scripts, and payloads. When Python is classified as unauthorized and removed under this safeguard, the local interpreter required for Python-based execution is eliminated, directly restricting this execution path.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1021.005 | VNC |
Comments
Adversaries use VNC server software to establish remote interactive access to systems. When VNC server software is classified as unauthorized, this safeguard requires it to be removed, eliminating the VNC server endpoint required to establish the remote session.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1071.001 | Web Protocols |
Comments
Adversaries use HTTP or HTTPS to communicate with command-and-control infrastructure. Default-deny Internet egress on dedicated administrative resources prevents direct connections to external HTTP/S C2 infrastructure, directly disrupting the communication channel.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1105 | Ingress Tool Transfer |
Comments
Adversaries transfer tools and payloads onto compromised systems from external infrastructure. Dedicated administrative resources have no direct Internet access and permit file transfer only through controlled internal mechanisms, directly preventing arbitrary external payload retrieval.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1021.006 | Windows Remote Management |
Comments
Adversaries use WinRM to execute commands remotely and move laterally. Administrative network controls permit WinRM only over approved management paths, directly denying unauthorized WinRM connectivity.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Adversaries use RDP for lateral movement into privileged systems. Administrative enclave ACLs restrict RDP to explicitly authorized source and destination relationships, directly preventing arbitrary RDP access into or through the enclave.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Adversaries use alternate network protocols to transfer data outside the environment. Protocol-aware egress filtering and destination restrictions in the administrative enclave directly block unauthorized alternate-protocol exfiltration channels.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1571 | Non-Standard Port |
Comments
Adversaries use unexpected ports for command-and-control to evade standard network restrictions. The administrative enclave permits only explicitly approved ports and denies all others, directly preventing outbound communication over unauthorized ports.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1095 | Non-Application Layer Protocol |
Comments
Adversaries use non-application-layer protocols for command-and-control or data transfer. The administrative enclave enforces default-deny egress with explicit protocol allowlisting, directly blocking unauthorized low-level communications.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1133 | External Remote Services |
Comments
Adversaries use externally accessible remote services to reach internal or privileged resources. Dedicated administrative systems are not externally reachable and accept access only through controlled administrative paths, directly preventing external remote-service access to the enclave.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1567 | Exfiltration Over Web Service |
Comments
Adversaries transfer stolen data to external Web services. Dedicated administrative resources have no Internet egress, directly preventing connections to the external Web destinations required by the technique.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1102 | Web Service |
Comments
Adversaries use external Web services as command-and-control infrastructure. Dedicated administrative systems have no direct Internet access, directly preventing them from establishing command-and-control sessions with external Web services.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
Adversaries manipulate local name-resolution traffic and relay authentication to reachable services. Separating administrative systems from general-user broadcast domains and restricting SMB paths directly reduces poisoning opportunities and viable privileged relay targets.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1040 | Network Sniffing |
Comments
Adversaries capture traffic visible from a compromised privileged system to collect credentials or operational information. Isolating administrative resources from the primary network reduces the traffic and broadcast domains visible to those systems, directly limiting passive collection opportunities.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1046 | Network Service Discovery |
Comments
Adversaries probe network systems to identify accessible services and hosts. Administrative enclave segmentation restricts network visibility and reachability across the enclave boundary, directly reducing the systems and services available for discovery.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1210 | Exploitation of Remote Services |
Comments
Adversaries exploit vulnerable remote services on reachable systems to move laterally. Segmentation of administrative resources restricts the remote services reachable into and out of the privileged enclave, directly reducing lateral exploitation opportunities.
References
|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1189 | Drive-by Compromise |
Comments
Adversaries compromise systems when users access malicious or compromised Internet content. Dedicated administrative resources are prohibited from general Internet access, directly removing ordinary Web browsing as an initial-access path to privileged systems.
References
|
| CIS-12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | mitigates | T1021.006 | Windows Remote Management |
Comments
Adversaries may use WinRM for remote command execution and lateral movement. WinRM is not externally reachable and can only be accessed through authenticated enterprise VPN connectivity, directly restricting unauthorized remote WinRM sessions.
References
|
| CIS-12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Adversaries use RDP for remote access or lateral movement into enterprise systems. RDP is inaccessible directly from external networks and reachable remotely only after authenticated VPN access through approved paths, directly preventing unauthenticated external RDP connectivity.
References
|
| CIS-12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | mitigates | T1659 | Content Injection |
Comments
Adversaries can inject malicious content into network traffic through a compromised or hostile upstream communication path. VPN integrity protection prevents unauthorized modification of enterprise-bound tunneled traffic, directly blocking injected content from becoming part of the protected session.
References
|
| CIS-12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Adversaries positioned along the remote user's network path attempt to intercept or modify enterprise communications. An authenticated VPN tunnel provides confidentiality and integrity protection, directly preventing useful interception or alteration of tunneled traffic.
References
|
| CIS-12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | mitigates | T1040 | Network Sniffing |
Comments
Adversaries capture traffic traversing untrusted remote networks to obtain sensitive enterprise information. The enterprise VPN encrypts traffic between the endpoint and enterprise gateway, directly preventing passive observers from recovering protected traffic.
References
|
| CIS-12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | mitigates | T1133 | External Remote Services |
Comments
Adversaries can use externally accessible remote-access services to enter enterprise networks. Requiring remote devices to authenticate through an enterprise-managed VPN and centralized AAA confines remote access to a controlled gateway, directly eliminating unmanaged direct access paths.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1542.005 | TFTP Boot |
Comments
Adversaries can abuse unauthenticated network-boot mechanisms to load malicious or unauthorized system images. Disabling insecure TFTP/PXE boot or restricting it to authenticated management infrastructure directly prevents unauthorized network boot operations.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Adversaries can query SNMP to collect network-device and topology information. Enforced SNMPv3 authentication, encryption, and management-source restrictions directly prevent unauthorized systems from successfully issuing or reading management queries.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1557.004 | Evil Twin |
Comments
Adversaries can deploy a rogue access point impersonating the legitimate enterprise WLAN to capture credentials or intercept communications. Managed 802.1X supplicants validate the trusted RADIUS/EAP server certificate and approved wireless profile, directly preventing endpoints from authenticating to the rogue infrastructure.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Adversaries can intercept or manipulate communications between wireless clients and enterprise infrastructure. Enterprise authentication and encrypted wireless communications provide confidentiality and integrity protections that directly constrain interception and modification.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1040 | Network Sniffing |
Comments
Adversaries can capture wireless network traffic to recover credentials or sensitive information. WPA2 Enterprise or stronger encryption protects wireless frames from passive observers, directly preventing useful plaintext recovery from captured traffic.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1669 | Wi-Fi Networks |
Comments
Adversaries can gain initial access by associating with the target organization's wireless network. Secure network management protocols like 802.1X and enterprise wireless authentication require authorized credentials or device identity before admission, directly preventing unauthorized wireless access.
References
|
| CIS-12.6 | Use of Secure Network Management and Communication Protocols | mitigates | T1200 | Hardware Additions |
Comments
Adversaries can attach rogue computers, appliances, or networking hardware to obtain enterprise network connectivity. Secure network management protocols like 802.1X requires successful user or device authentication before network admission, directly denying unauthorized hardware access.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1601.002 | Downgrade System Image |
Comments
Adversaries may install an older network-device image to restore vulnerable functionality or bypass newer protections. AAA authorization restricts downgrade and image-installation commands to approved roles, directly preventing unauthorized rollback operations.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1601.001 | Patch System Image |
Comments
Adversaries may install malicious or unauthorized network-device images to modify device operation. AAA command authorization restricts image upload and installation functions to approved administrative roles, directly preventing unauthorized system-image replacement.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Adversaries may retrieve network-device configurations to collect topology, credentials, routes, and security policy. AAA command authorization denies configuration-display and export operations to identities without explicit permission, directly restricting configuration collection.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1686.002 | Network Device Firewall |
Comments
Adversaries may change firewall rules, ACLs, or security zones to weaken network restrictions. Centralized AAA authorization limits those configuration commands to approved roles, directly preventing unauthorized identities from modifying firewall policy.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1059.008 | Network Device CLI |
Comments
Adversaries may use network-device CLIs to execute privileged administrative commands. Centralized AAA with command-level authorization restricts which commands each identity may execute, directly preventing unauthorized CLI operations.
References
|
| CIS-12.3 | Securely Manage Network Infrastructure | mitigates | T1686.002 | Network Device Firewall |
Comments
Adversaries can alter ACLs, firewall rules, or network security zones to create unauthorized access paths. Enforced IaC/GitOps configuration management validates approved firewall state and rejects or automatically reverses unauthorized policy changes, directly disrupting the modification.
References
|
| CIS-12.3 | Securely Manage Network Infrastructure | mitigates | T1059.008 | Network Device CLI |
Comments
Adversaries can use network-device command-line interfaces to make malicious configuration changes. Enforced version-controlled Infrastructure-as-Code with direct configuration disabled or automatically reconciled prevents unauthorized CLI changes from becoming persistent device state.
References
|
| CIS-12.3 | Securely Manage Network Infrastructure | mitigates | T1659 | Content Injection |
Comments
Adversaries can inject malicious content into network communications while positioned along the traffic path. Integrity-protected SSH or HTTPS management sessions reject unauthorized modifications, directly preventing injected content from becoming part of the protected administrative session.
References
|
| CIS-12.3 | Securely Manage Network Infrastructure | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Adversaries can position themselves between communicating systems to intercept or alter network traffic. Authenticated and encrypted management sessions provide confidentiality, peer authentication, and integrity protection, directly preventing useful interception or modification of administrative communications.
References
|
| CIS-12.3 | Securely Manage Network Infrastructure | mitigates | T1040 | Network Sniffing |
Comments
Adversaries can passively capture management traffic to obtain credentials, commands, or configuration information. SSH, HTTPS, and equivalent encrypted management protocols make captured administrative traffic unreadable, directly reducing the value of network sniffing.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1669 | Wi-Fi Networks |
Comments
Adversaries obtain initial access by connecting to an organization's wireless network. Separating wireless access networks from sensitive enterprise segments with enforced routing and firewall controls directly limits what an attacker can reach after establishing wireless connectivity.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1199 | Trusted Relationship |
Comments
Adversaries abuse connectivity granted to trusted third parties or external organizations to reach enterprise resources. Segmented third-party access restricts those connections to explicitly authorized services and network zones, directly preventing movement beyond the intended trust boundary.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1072 | Software Deployment Tools |
Comments
Adversaries abuse centralized deployment or management systems to execute software or move laterally. Placing those systems in a restricted management segment and allowing access only from approved administrative hosts directly limits unauthorized interaction with the deployment infrastructure.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
Adversaries use unencrypted alternate protocols to transfer stolen data. Inter-zone and egress filtering blocks unauthorized protocols and destinations, directly disrupting the exfiltration channel.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Adversaries use asymmetrically encrypted non-C2 protocols to move data outside the environment. Network controls restrict permitted protocols and destinations, directly blocking unauthorized encrypted exfiltration channels.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
Adversaries exfiltrate data through encrypted non-C2 protocols that use symmetric encryption. Enforced protocol and destination allowlists deny unauthorized encrypted outbound channels, directly preventing the required network transfer.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Adversaries exfiltrate data using protocols other than their primary command-and-control channel. Protocol-aware egress and inter-zone controls restrict communications to approved protocols and destinations, directly blocking unauthorized alternate-protocol exfiltration paths.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1571 | Non-Standard Port |
Comments
Adversaries communicate over unusual ports to evade expected network controls. Explicit port allowlists and default-deny inter-zone filtering block unapproved ports, directly preventing those communications from traversing protected network boundaries.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1095 | Non-Application Layer Protocol |
Comments
Adversaries use lower-layer protocols for command-and-control or data transfer. Deny-by-default inter-segment filtering permits only explicitly authorized protocols, directly blocking unauthorized non-application-layer communications across security boundaries.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1021.006 | Windows Remote Management |
Comments
Adversaries use WinRM to execute commands remotely and move laterally. Segmentation restricts WinRM connectivity to designated administrative zones and systems, directly preventing unauthorized remote WinRM sessions.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1021.003 | Distributed Component Object Model |
Comments
Adversaries use DCOM to remotely execute actions on accessible Windows systems. Network segmentation blocks DCOM traffic outside explicitly authorized relationships, directly restricting the network connectivity required for remote DCOM execution.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Adversaries use RDP for remote access and lateral movement between systems. Segmentation and inter-zone ACLs permit RDP only across approved administrative paths, directly preventing unauthorized RDP connectivity between network zones.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Adversaries retrieve network-device configurations to obtain topology, credentials, routing information, or security policy. Isolating management interfaces and permitting access only from approved administrative systems directly prevents unauthorized systems from reaching the configuration interface.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Adversaries query SNMP to obtain device, interface, routing, and network information. Restricting SNMP to an isolated management plane with ACLs permitting only authorized management systems directly prevents unauthorized hosts from issuing MIB queries.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1133 | External Remote Services |
Comments
Adversaries use externally accessible VPNs, gateways, and remote-access services to enter enterprise networks. The architecture forces external access through designated controlled gateways while denying direct connectivity to internal resources, directly restricting unauthorized remote entry paths.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
Adversaries poison local name-resolution traffic and relay authentication attempts to reachable services. Layer-2/Layer-3 segmentation and SMB access restrictions constrain the poisoning domain and relay destinations, directly reducing viable poisoning and relay paths.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1040 | Network Sniffing |
Comments
Adversaries capture traffic visible from their network position to obtain credentials, sessions, or operational information. Segmentation reduces the broadcast domains, traffic flows, and network segments visible from a compromised system, directly limiting the traffic available for passive collection.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1046 | Network Service Discovery |
Comments
Adversaries probe remote systems to identify accessible hosts, ports, and services. Enforced segmentation limits probe reachability across security boundaries, directly reducing the systems and services that can be discovered.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1210 | Exploitation of Remote Services |
Comments
Adversaries must reach a vulnerable remote service before exploiting it for lateral movement or execution. Network segmentation and least-privilege ACLs restrict which systems can communicate with those services, directly reducing exploitable network paths.
References
|
| CIS-12.1 | Ensure Network Infrastructure is Up-to-Date | mitigates | T1601.002 | Downgrade System Image |
Comments
Adversaries downgrade network-device software to reintroduce vulnerable or weaker code. Enforced anti-rollback and approved-version controls prevent installation of older unauthorized images, directly blocking the downgrade behavior.
References
|
| CIS-12.1 | Ensure Network Infrastructure is Up-to-Date | mitigates | T1686.002 | Network Device Firewall |
Comments
Adversaries may exploit vulnerable network firewalls to gain the privileged access required to alter ACLs, zones, or firewall policy. Maintaining supported and patched firewall software removes known vulnerability-based access paths, directly reducing the adversary's ability to reach the configuration state required to modify the firewall.
References
|
| CIS-12.1 | Ensure Network Infrastructure is Up-to-Date | mitigates | T1210 | Exploitation of Remote Services |
Comments
Adversaries exploit vulnerabilities in remotely reachable services to execute code or move laterally. Updating network-device software removes known vulnerabilities from those services, directly preventing exploitation paths that depend on obsolete or vulnerable software.
References
|
| CIS-12.1 | Ensure Network Infrastructure is Up-to-Date | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Adversaries exploit vulnerabilities in Internet-facing services or network-device management interfaces to gain initial access. Keeping network infrastructure on supported, current software removes known exploitable vulnerabilities, directly reducing the adversary's ability to successfully exploit those exposed services.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1561.002 | Disk Structure Wipe |
Comments
Disk structure wiping damages partitions, filesystems, or boot structures required to access a system. Recovery data stored on an isolated repository remains unaffected by those disk-level changes and can be used to rebuild the system.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1561.001 | Disk Content Wipe |
Comments
Disk content wiping destroys data on the affected storage device. An isolated recovery repository is not dependent on that disk and preserves the data needed to restore the wiped system.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1561 | Disk Wipe |
Comments
Adversaries erase disk data or structures to make systems unusable. Offline, cloud-separated, or off-site recovery copies remain outside the disk-wipe operation, directly preserving data required for restoration.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1491.002 | External Defacement |
Comments
External defacement modifies public-facing web or application content. Where an isolated recovery instance contains the affected content and configuration, known-good copies can be restored and the attacker-controlled state removed.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1491.001 | Internal Defacement |
Comments
Internal defacement changes internal application or web content visible to users. Where an isolated recovery instance preserves known-good versions of that content, the altered files or configuration can be replaced with trusted copies.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1491 | Defacement |
Comments
Adversaries alter operational or visible data to damage integrity. An isolated recovery copy preserves the trusted pre-defacement state, directly enabling restoration.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1490 | Inhibit System Recovery |
Comments
Recovery inhibition relies on eliminating backups, snapshots, or other recovery resources available to the victim. An isolated recovery instance remains outside the compromised recovery path, preventing the attacker from removing every usable recovery copy through the same access.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1486 | Data Encrypted for Impact |
Comments
Encryption for impact depends on the attacker being able to reach and modify usable data. An isolated recovery copy that is inaccessible through the compromised production path remains unencrypted and available for restoration.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1485.001 | Lifecycle-Triggered Deletion |
Comments
Lifecycle-triggered deletion relies on cloud policies automatically removing stored objects. Where the isolated recovery copy resides in a separate account, vault, or lifecycle boundary, those deletion rules do not affect the recovery copy.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1485 | Data Destruction |
Comments
Data destruction removes or overwrites production data to make it unrecoverable. An isolated recovery copy sits outside the same destructive access path, preserving data that can be restored after production copies are destroyed.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1565.001 | Stored Data Manipulation |
Comments
Stored data manipulation relies on altered data remaining authoritative or being used by downstream systems. Where the isolated recovery environment retains versioned or known-good data from before the manipulation, the modified production copy can be replaced with a trusted version.
References
|
| CIS-11.4 | Establish and Maintain an Isolated Instance of Recovery Data | mitigates | T1565 | Data Manipulation |
Comments
Adversaries manipulate data to affect operations or hide activity. An isolated recovery copy remains outside the compromised production write path, preserving a trusted version that can replace manipulated data.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1561.002 | Disk Structure Wipe |
Comments
Adversaries destroy file-system or partition structures to make data inaccessible. Recovery copies protected independently from the affected storage remain usable, directly enabling restoration despite destruction of the disk structure.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1561.001 | Disk Content Wipe |
Comments
Adversaries overwrite disk contents to eliminate stored information. Protected recovery copies remain unavailable to the local wiping operation, directly preserving recoverable versions of the destroyed data.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1561 | Disk Wipe |
Comments
Adversaries wipe disks to destroy data or render systems unusable. Recovery data protected on separate storage remains outside the affected disk's destructive operation, directly preserving the data required to rebuild the system.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1491.002 | External Defacement |
Comments
Adversaries modify externally visible content. Protected recovery copies preserve the legitimate content and enable replacement of the defaced version, directly reducing the duration and effectiveness of the attack
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1491.001 | Internal Defacement |
Comments
Adversaries alter internally used content or systems. Protected backup copies maintain a trusted version outside the attacker's ordinary modification path, directly enabling restoration of internally defaced data
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1491 | Defacement |
Comments
Adversaries alter content to disrupt operations or damage integrity. Protected recovery copies preserve trusted versions that remain available for restoration, directly limiting the persistence of the defacement.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1486 | Data Encrypted for Impact |
Comments
Encryption for impact depends on write access to the data the attacker wants to render unusable. Where recovery repositories are immutable, write-protected, or administered through separate credentials, ransomware cannot encrypt or overwrite the protected recovery copy.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1485.001 | Lifecycle-Triggered Deletion |
Comments
Adversaries manipulate cloud lifecycle policies or similar automation to cause stored data to be deleted. Immutable/versioned recovery storage and restricted lifecycle-policy modification preserve prior backup objects, directly preventing automated deletion from eliminating the recovery copy.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1485 | Data Destruction |
Comments
Data destruction depends on the attacker being able to delete or overwrite stored data. Where recovery data is held on immutable storage, deletion-protected repositories, or tightly restricted backup systems, those controls can prevent destruction of the protected copy.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1565.001 | Stored Data Manipulation |
Comments
Stored data manipulation changes data at rest so the altered state is trusted or used operationally. Where recovery repositories enforce immutability, integrity validation, or write restrictions, unauthorized changes to the recovery copy can be blocked or detected.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1565 | Data Manipulation |
Comments
Adversaries alter enterprise data to affect operations or hide activity. Integrity controls, access restrictions, and protected recovery copies preserve trusted versions that cannot be modified through ordinary production access, directly reducing the lasting effect of manipulation.
References
|
| CIS-11.3 | Protect Recovery Data | mitigates | T1490 | Inhibit System Recovery |
Comments
Recovery inhibition commonly relies on deleting, modifying, or disabling backup and recovery resources. Where recovery data is protected with immutability, write restrictions, separate credentials, or access isolation, those controls can prevent the compromised access path from removing or altering the recovery copy.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1565.001 | Stored Data Manipulation |
Comments
Adversaries alter data stored in files, databases, or other repositories. Automated backups preserve historical versions of the stored data, directly enabling recovery of the unmodified state.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1565 | Data Manipulation |
Comments
Adversaries alter data to affect decisions, processes, or system outcomes. Automated backups preserve earlier trusted versions of that data, directly enabling defenders to replace manipulated information with a known-good state.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1491.002 | External Defacement |
Comments
External defacement changes public-facing website or application content. Where the affected content and configuration are included in automated backups, known-good versions can be restored and the defaced state can be removed.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1491.001 | Internal Defacement |
Comments
Internal defacement modifies organizational web, application, or other internal content. Where that content is included in automated backups, known-good versions can replace the altered resources and shorten the duration of the defacement.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1491 | Defacement |
Comments
Automated backups preserve trusted versions of the modified data or content, directly enabling restoration of the pre-defacement state.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1485.001 | Lifecycle-Triggered Deletion |
Comments
Lifecycle-triggered deletion relies on cloud retention or lifecycle rules deleting stored objects. Where automated backups retain the same data outside the affected lifecycle policy or account, those copies survive the deletion and can be restored.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1561.002 | Disk Structure Wipe |
Comments
Disk structure wiping corrupts partitions, filesystems, or other structures needed to access stored data. Automated backups preserve recoverable copies independent of the damaged disk structure, directly supporting restoration.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1561.001 | Disk Content Wipe |
Comments
Disk content wiping destroys the data stored on an affected device. Automated backups preserve prior copies of the overwritten data, directly enabling restoration.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1561 | Disk Wipe |
Comments
Adversaries erase disk data or structures to render systems unusable. Automated backups preserve data outside the destroyed disk state, directly enabling restoration after the wipe.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1486 | Data Encrypted for Impact |
Comments
Ransomware and similar impact activity encrypt accessible production data to deny legitimate use. Automated backups preserve recoverable copies from before encryption, directly reducing the attacker's ability to make the encrypted data permanently unavailable.
References
|
| CIS-11.2 | Perform Automated Backups | mitigates | T1485 | Data Destruction |
Comments
Adversaries destroy data to impair operations or deny access to information. Automated backups preserve earlier copies of the affected data, directly enabling restoration and reducing the operational effectiveness of the destruction.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1565.001 | Stored Data Manipulation |
Comments
Adversaries modify stored data to affect outcomes or conceal activity. At-rest encryption may hinder offline manipulation where the adversary lacks the decryption key, but it does not prevent modification through an authorized application, database write access, or transparently decrypted storage
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1565 | Data Manipulation |
Comments
Adversaries insert, delete, or manipulate data to influence outcomes or conceal activity. Encrypting sensitive data at rest can prevent an adversary who lacks the decryption capability from understanding the protected content sufficiently to perform targeted or meaningful modifications, reducing the effectiveness of the manipulation.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1553.003 | SIP and Trust Provider Hijacking |
Comments
Trust Provider Hijacking can replace or introduce malicious DLLs used by Windows trust-validation mechanisms. Where these libraries are governed, allowlisting approved trust-provider DLLs can directly prevent unauthorized components from loading.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1505.004 | IIS Components |
Comments
Malicious IIS components commonly use ISAPI extensions, filters, or modules implemented as DLLs loaded by IIS worker processes. Where library allowlisting governs IIS library loads, blocking unauthorized DLLs directly prevents those malicious components from loading.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1547.008 | LSASS Driver |
Comments
LSASS Driver persistence relies on malicious DLLs or LSA plug-ins being loaded into the LSASS process. Library allowlisting can prevent unauthorized libraries from loading into LSASS, directly disrupting this persistence mechanism.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1547.002 | Authentication Package |
Comments
Authentication Package persistence relies on a malicious authentication DLL being loaded by the Windows authentication subsystem. Where these DLLs are subject to allowlisting, unauthorized authentication packages can be blocked at load time.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1546.006 | LC_LOAD_DYLIB Addition |
Comments
LC_LOAD_DYLIB abuse causes a modified Mach-O binary to load an attacker-controlled dylib. Where macOS libraries are covered by the allowlist, blocking the unauthorized dylib directly limits this technique.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1129 | Shared Modules |
Comments
Adversaries load DLLs, shared objects, and other modules into processes to execute malicious code. Library allowlisting directly restricts this behavior by permitting only approved modules to load.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1535 | Unused/Unsupported Cloud Regions |
Comments
Apply cloud configuration baselines that deactivate unused regions to reduce unmanaged cloud attack surface and help prevent adversaries from creating cloud instances in unused geographic service regions in order to evade detection.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Apply cloud service configuration templates that restrict or disable external data sharing and limit sharing to authorized users or domains to help prevent adversaries from exfiltrating data by transferring the data.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1666 | Modify Cloud Resource Hierarchy |
Comments
Use standard cloud hardening templates to block unauthorized subscription transfers in Azure and prevent use of the AWS LeaveOrganization API through Service Control Policies to help prevent adversaries from modifying hierarchical structures in infrastructure-as-a-service (IaaS) environments.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1689 | Downgrade Attack |
Comments
Apply hardened web server templates that implement policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1677 | Poisoned Pipeline Execution |
Comments
Use standard hardening templates for continuous integration / continuous development (CI/CD) infrastructure that block unreviewed code execution, isolate untrusted builds, restrict secret access, and prohibit unsafe pipeline triggers to help prevent adversaries from manipulating CI/CD processes.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1685 | Disable or Modify Tools |
Comments
Apply controlled baseline configurations and change management for security-related forwarding mechanisms and firewall rules to help prevent disabling, degrading, or tampering with security tools or applications.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1590.002 | DNS |
Comments
Use standard hardening templates for DNS servers to implement zone transfer policies that permit zone transfers only to validated servers to help prevent adversaries from gathering DNS information.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1213 | Data from Information Repositories |
Comments
Apply standard, industry-recommended hardening templates that enforce information repository data retention, archival, and deletion settings to limit accessible data.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1213.006 | Databases |
Comments
Apply standard, industry-recommended databases hardening templates that enforce information repository data retention, archival, and deletion settings to limit accessible data.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1213.004 | Customer Relationship Management Software |
Comments
Apply standard, industry-recommended customer relationship management software hardening templates that enforce data retention, archival, and deletion settings to limit accessible data.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Use standard hardening templates for application infrastructure components to allowlist MIB objects and implement SNMP views, restricting access to configuration information.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1543 | Create or Modify System Process |
Comments
Use standard hardening templates for application infrastructure components to allowlist MIB objects and implement SNMP views, restricting access to configuration information.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1602 | Data from Configuration Repository | |
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Use standard hardening templates to allowlist MIB objects, implement SNMP views, and disable Smart Install when it is not used, reducing exposure of network-device configuration data.
References
|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1543.005 | Container Service |
Comments
Using standard, industry-recommended hardening templates for cloud containers to enforce the use of container services in rootless mode can help mitigate the effects of adversaries creating or modifying system-level processes.
References
|
| CIS-16.5 | Use Up-to-Date and Trusted Third-Party Software Components | mitigates | T1195.001 | Compromise Software Dependencies and Development Tools |
Comments
Selecting and maintaining trusted software components helps prevent integration of malicious or compromised libraries, packages, and software.
References
|
| CIS-16.5 | Use Up-to-Date and Trusted Third-Party Software Components | mitigates | T1195 | Supply Chain Compromise |
Comments
Selecting and maintaining trusted software components helps prevent integration of malicious or compromised libraries, packages, and software.
References
|
| CIS-16.5 | Use Up-to-Date and Trusted Third-Party Software Components | mitigates | T1195.002 | Compromise Software Supply Chain |
Comments
Selecting and maintaining trusted software components helps prevent integration of malicious or compromised libraries, packages, and software.
References
|
| CIS-16.3 | Perform Root Cause Analysis on Security Vulnerabilities | mitigates | T1212 | Exploitation for Credential Access |
Comments
Application developers can use root-cause analysis to identify and remediate recurring authentication-validation weaknesses, such as missing replay protections, weak session controls, or flawed request validation. This reduces opportunities for adversaries to replay authentication messages, impersonate authorized parties, and conduct exploitation for credential access.
References
|
| CIS-16.3 | Perform Root Cause Analysis on Security Vulnerabilities | mitigates | T1195.001 | Compromise Software Dependencies and Development Tools |
Comments
Application developers should exercise caution when selecting and integrating third-party libraries, using root-cause analysis of identified vulnerabilities to strengthen dependency-selection and management practices. This helps prevent supply-chain compromise through vulnerable or malicious software dependencies and development tools.
References
|
| CIS-16.3 | Perform Root Cause Analysis on Security Vulnerabilities | mitigates | T1195 | Supply Chain Compromise |
Comments
Application developers should exercise caution when selecting and integrating third-party libraries, using root-cause analysis of identified vulnerabilities to strengthen dependency-selection and management practices. This helps prevent supply chain compromise through vulnerable or malicious software dependencies and development tools.
References
|
| CIS-16.3 | Perform Root Cause Analysis on Security Vulnerabilities | mitigates | T1078 | Valid Accounts |
Comments
Application developers can use root cause analysis to address code or build process practices that expose credentials to ensure that applications do not store sensitive data or credentials insecurely.
References
|
| CIS-15.7 | Securely Decommission Service Providers | mitigates | T1072 | Software Deployment Tools |
Comments
Securely decommissioning service providers with service accounts or other access to software deployment, endpoint management, or configuration management platforms prevents residual provider access from being abused through these centralized software suites.
References
|
| CIS-15.7 | Securely Decommission Service Providers | mitigates | T1199 | Trusted Relationship |
Comments
Remove accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary.
References
|
| CIS-15.7 | Securely Decommission Service Providers | mitigates | T1078 | Valid Accounts |
Comments
Disabling provider user and service accounts and revoking associated credentials, tokens, and access permissions prevents residual provider identities from being abused by adversaries to access enterprise resources.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1659 | Content Injection |
Comments
Application-layer filtering can block uncommon, unauthorized, or malicious content and transferred file types at web proxies, application gateways, or similar inspection points before the content reaches protected systems.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Web filtering and application-layer gateways can block malicious web content and destinations used to deliver browser-based credential theft or session-stealing content.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1189 | Drive-by Compromise |
Comments
Web proxies and application-layer gateways can prevent access to known malicious or unnecessary websites and block malicious web content used to compromise users through drive-by activity.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1568 | Dynamic Resolution |
Comments
DNS filtering and sinkholing can prevent systems from resolving domains associated with dynamically changing adversary command-and-control infrastructure.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1568.002 | Domain Generation Algorithms |
Comments
DNS filtering and sinkholing can block domains generated by known domain-generation algorithms when those domains or generation patterns can be identified.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1567 | Exfiltration Over Web Service |
Comments
Web proxies and application-layer gateways can restrict which external web services are permitted, reducing unauthorized use of web services for data exfiltration.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1567.001 | Exfiltration to Code Repository |
Comments
Application-layer filtering can block or restrict access to unauthorized external code repositories, limiting their use as destinations for data exfiltration.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1567.002 | Exfiltration to Cloud Storage |
Comments
Application-layer filtering can block or restrict access to unauthorized cloud-storage services, limiting their use as destinations for data exfiltration.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1567.003 | Exfiltration to Text Storage Sites |
Comments
Application-layer filtering can block or restrict access to unauthorized text-storage and paste services, limiting their use as destinations for data exfiltration.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1133 | External Remote Services |
Comments
Application-layer firewalls and proxies can restrict access to unauthorized remote-access services, anonymization services, and other external services used to access enterprise resources.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1566 | Phishing |
Comments
Application-layer filtering can block malicious websites, links, attachments, and other web or email content used in phishing activity before that content reaches users.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1566.001 | Spearphishing Attachment |
Comments
Mail and application-layer gateways can inspect and block dangerous attachment types, malicious archives, and other suspicious content delivered through spearphishing attachments.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1566.002 | Spearphishing Link |
Comments
Web proxies and application-layer gateways can block access to malicious or unnecessary websites reached through spearphishing links.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1566.003 | Spearphishing via Service |
Comments
Application-layer filtering can restrict access to personal webmail, social media, and other external services that may be abused to deliver spearphishing messages.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1539 | Steal Web Session Cookie |
Comments
Web filtering and application-layer gateways can block malicious content or destinations used to deliver browser-based session-cookie theft activity.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1218 | System Binary Proxy Execution |
Comments
Application-layer filtering can restrict malicious sites, downloads, attachments, and scripts that may deliver payloads later executed through trusted system binaries.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1218.001 | Compiled HTML File |
Comments
Application-layer filtering can block CHM and other uncommon or risky file types in transit, reducing delivery of content that may be executed through Compiled HTML Help.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1204 | User Execution |
Comments
Application-layer filtering can prevent malicious web or email content from reaching users, reducing opportunities for users to execute or interact with adversary-delivered content.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1204.001 | Malicious Link |
Comments
Web proxies and application-layer gateways can block requests to malicious links and prevent associated content from being downloaded.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1204.004 | Malicious Copy and Paste |
Comments
Application-layer filtering can block malicious web content or destinations used to provide commands, scripts, or other content that users are instructed to copy and execute.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1102 | Web Service |
Comments
Web proxies and application-layer gateways can restrict access to unauthorized external web services, limiting their use for adversary command and control.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1102.001 | Dead Drop Resolver |
Comments
Application-layer filtering can block access to unauthorized web services used as dead-drop resolvers for adversary command-and-control infrastructure.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1102.002 | Bidirectional Communication |
Comments
Application-layer filtering can block unauthorized web services used for bidirectional command-and-control communications.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1102.003 | One-Way Communication |
Comments
Application-layer filtering can block unauthorized web services used for one-way command-and-control communications.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1071 | Application Layer Protocol |
Comments
Application-aware gateways can inspect and restrict unauthorized application-layer protocols, services, and destinations used for adversary command and control.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1071.001 | Web Protocols |
Comments
Web proxies and application-layer firewalls can inspect and restrict HTTP and HTTPS traffic to unauthorized or malicious destinations.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1071.002 | File Transfer Protocols |
Comments
Application-layer filtering can restrict FTP, SFTP, and related file-transfer protocol traffic to approved services and destinations.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1071.003 | Mail Protocols |
Comments
Application-layer filtering can restrict SMTP, IMAP, POP3, and related mail-protocol traffic to approved infrastructure and expected communication paths.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1071.004 | DNS |
Comments
DNS proxies and filtering services can block malicious domains and restrict systems to approved name-resolution services.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1071.005 | Publish/Subscribe Protocols |
Comments
Application-aware filtering can restrict publish/subscribe protocols to approved brokers, destinations, and expected service ports.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Application proxies and gateways can require use of approved protocol services and restrict unauthorized application-layer protocols or destinations used for data exfiltration.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
Application-layer gateways can restrict symmetrically encrypted non-command-and-control protocol traffic to approved services and destinations where the traffic remains identifiable to the control.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Application-layer gateways can restrict asymmetrically encrypted non-command-and-control protocol traffic to approved services and destinations where the traffic remains identifiable to the control.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
Application-layer filtering can directly restrict unencrypted non-command-and-control protocols to approved services and destinations.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Web application firewalls and application-layer gateways can inspect inbound application requests and block known malicious request patterns or exploit payloads targeting public-facing applications.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1187 | Forced Authentication |
Comments
Application and protocol filtering can block outbound WebDAV and related requests that may be abused to force systems to authenticate to attacker-controlled resources.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1105 | Ingress Tool Transfer |
Comments
Web proxies and application-layer gateways can block unauthorized downloads, file-transfer services, and malicious content used to transfer adversary tools into the environment.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1572 | Protocol Tunneling |
Comments
Application-aware filtering can identify and restrict unauthorized tunneling through otherwise permitted application protocols and services.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1090 | Proxy |
Comments
Application-layer gateways can block known anonymization services, unauthorized proxy services, and other proxy destinations used to conceal adversary communications.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1090.003 | Multi-hop Proxy |
Comments
Application-layer gateways can restrict known anonymization and proxy services that may be chained together to form multi-hop proxy infrastructure.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1219 | Remote Access Tools |
Comments
Application firewalls and proxies can restrict access to websites, services, and destinations associated with unauthorized remote-access tools.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1219.002 | Remote Desktop Software |
Comments
Application-layer firewalls and proxies can restrict access to unauthorized remote-desktop services and destinations.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1552 | Unsecured Credentials |
Comments
Web application firewalls and application-layer controls can block server-side request forgery paths that would otherwise expose credential-bearing cloud metadata services.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1552.005 | Cloud Instance Metadata API |
Comments
A properly configured web application firewall can block external server-side request forgery attempts that target the cloud instance metadata API and expose temporary credentials.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1499.003 | Application Exhaustion Flood |
Comments
Application-layer firewalls and web application firewalls can inspect, rate-limit, or block abusive application requests that attempt to exhaust application resources.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1499.004 | Application or System Exploitation |
Comments
Application-layer firewalls and web application firewalls can inspect and block known malicious request patterns or exploit payloads intended to cause application or system resource exhaustion.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1021.004 | SSH |
Comments
Conditional access policies for remote enterprise assets can deny authentication attempts to the SSH service if external SSH access is reachable through a remote-access control plane that can evaluates device posture
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1110 | Brute Force |
Comments
Conditional access policies for remote enterprise assets can deny authentication attempts from devices that do not satisfy enterprise security requirements, reducing the ability to use brute-force activity from non-compliant remote endpoints.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1110.001 | Password Guessing |
Comments
Conditional access policies can deny remote authentication attempts from devices that do not satisfy enterprise security requirements, reducing the ability to use guessed passwords from non-compliant remote endpoints.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1110.003 | Password Spraying |
Comments
Conditional access policies can deny remote authentication attempts from devices that do not satisfy enterprise security requirements, reducing the ability to use password spraying from non-compliant remote endpoints.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1110.004 | Credential Stuffing |
Comments
Conditional access policies can deny remote authentication attempts from devices that do not satisfy enterprise security requirements, reducing the ability to use compromised credential pairs from non-compliant remote endpoints.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1621 | Multi-Factor Authentication Request Generation |
Comments
Conditional access policies can prevent authentication attempts from non-compliant remote devices from proceeding, thereby preventing associated multi-factor authentication requests from being generated.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1078 | Valid Accounts |
Comments
Access control policies for remote enterprise assets can evaluate device compliance before permitting access to enterprise resources. Requiring current anti-malware protection, secure configuration compliance, and current operating system and application versions can prevent valid credentials from being used from remote devices that do not meet enterprise security requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1078.004 | Cloud Accounts |
Comments
Conditional access policies can evaluate device compliance before permitting cloud-account access, preventing valid cloud credentials from being used from remote devices that do not satisfy enterprise security requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1078.002 | Domain Accounts |
Comments
Conditional access policies can evaluate device compliance before permitting domain-account access, preventing valid cloud credentials from being used from remote devices that do not satisfy enterprise security requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1078.003 | Local Accounts |
Comments
Conditional access policies can evaluate device compliance before permitting local-account access, preventing valid cloud credentials from being used from remote devices that do not satisfy enterprise security requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1133 | External Remote Services |
Comments
Centrally managed authorization systems can restrict access to enterprise remote services based on the security posture of the connecting asset, including anti-malware status, secure-configuration compliance, and operating system or application update status.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1021 | Remote Services |
Comments
Centrally managed remote-access controls can restrict access to enterprise remote services so remote assets are permitted access only when they satisfy enterprise device-security and configuration requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Remote Desktop access can be restricted through centrally managed authorization controls so that remote assets are permitted access only when they satisfy enterprise device-security and configuration requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Conditional access policies can evaluate the context and compliance state of a remote device when alternate authentication material is used, reducing the ability to use authentication material from devices that do not satisfy enterprise security requirements.
References
|
| CIS-13.5 | Manage Access Control for Remote Access | mitigates | T1550.001 | Application Access Token |
Comments
Conditional access policies can evaluate device compliance and expected access context when application access tokens are used, reducing the ability to use valid tokens from non-compliant remote endpoints or outside approved access conditions.
References
|
| CIS-13.9 | Deploy Port-Level Access Control | mitigates | T1200 | Hardware Additions |
Comments
Port-level access control using 802.1X, device certificates, or similar network access control mechanisms can prevent unauthorized hardware from authenticating to and communicating on trusted enterprise networks.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1059 | Command and Scripting Interpreter |
Comments
Host-based intrusion prevention capabilities can enforce behavioral controls such as Attack Surface Reduction rules to prevent Visual Basic and JavaScript from executing potentially malicious downloaded content.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1059.005 | Visual Basic |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules to prevent Visual Basic scripts from executing potentially malicious downloaded content.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1059.007 | JavaScript |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules to prevent JavaScript scripts from executing potentially malicious downloaded content.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1543 | Create or Modify System Process |
Comments
Host-based intrusion prevention capabilities can block applications from writing signed vulnerable drivers and can enforce vulnerable-driver blocklists to reduce abuse of system processes and services.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1543.003 | Windows Service |
Comments
Host-based intrusion prevention capabilities can block applications from writing signed vulnerable service drivers and can enforce vulnerable-driver blocklists to reduce abuse of Windows services.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1486 | Data Encrypted for Impact |
Comments
Host-based intrusion prevention capabilities can use cloud-delivered protection and behavioral rules to block execution of files that exhibit ransomware-like behavior.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1006 | Direct Volume Access |
Comments
Endpoint security solutions can block behaviors associated with direct volume or backup-related access, including suspicious command execution or API calls targeting backup services.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1546.003 | Windows Management Instrumentation Event Subscription |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that prevent malware from abusing Windows Management Instrumentation to establish persistence.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1564.014 | Extended Attributes |
Comments
Host-based security controls can inspect extended attributes alongside file contents during artifact review, packaging, or deployment to identify hidden payloads, obfuscated data, or suspicious attribute keys.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1574 | Hijack Execution Flow |
Comments
Endpoint security solutions can block behaviors associated with process injection or memory tampering based on common sequences of indicators such as suspicious API usage.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1574.013 | KernelCallbackTable |
Comments
Endpoint security solutions can block behaviors associated with KernelCallbackTable abuse and related memory-tampering activity based on common sequences of indicators and suspicious API usage.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1559 | Inter-Process Communication |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules to prevent Dynamic Data Exchange attacks and block Office applications from spawning suspicious child processes.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1559.002 | Dynamic Data Exchange |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules to prevent Dynamic Data Exchange attacks and block Office applications from spawning suspicious child processes.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1036 | Masquerading |
Comments
Host intrusion prevention systems can identify and prevent execution of potentially malicious files, including files whose signatures do not match their apparent file type.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1036.008 | Masquerade File Type |
Comments
Host intrusion prevention systems can identify and prevent execution of files whose signatures do not match their apparent file type.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1106 | Native API |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office VBA macros from calling Win32 APIs.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1027 | Obfuscated Files or Information |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that prevent execution of potentially obfuscated scripts or payloads.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1027.009 | Embedded Payloads |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that prevent execution of potentially obfuscated scripts containing embedded payloads.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1027.010 | Command Obfuscation |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that block execution of potentially obfuscated scripts or commands.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1027.012 | LNK Icon Smuggling |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that prevent execution of potentially obfuscated scripts or payloads delivered through LNK-based techniques.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1027.013 | Encrypted/Encoded File |
Comments
Host-based intrusion prevention capabilities can block execution of potentially obfuscated scripts and analyze file-encoding properties for anomalies that deviate from expected encoding practices.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1027.014 | Polymorphic Code |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that prevent execution of potentially obfuscated or polymorphic payloads.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137 | Office Application Startup |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137.001 | Office Template Macros |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137.002 | Office Test |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137.003 | Outlook Forms |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137.004 | Outlook Home Page |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137.005 | Outlook Rules |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1137.006 | Add-ins |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that prevent Office applications from creating child processes or writing potentially malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1003 | OS Credential Dumping |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that secure LSASS and prevent credential-stealing activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1003.001 | LSASS Memory |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that secure LSASS and prevent attempts to steal credentials from LSASS memory.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055 | Process Injection |
Comments
Endpoint security solutions can block process-injection behavior based on common sequences of activity, including suspicious API use and code injection from applications such as Microsoft Office.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.001 | Dynamic-link Library Injection |
Comments
Endpoint security solutions can block dynamic-link library injection based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.002 | Portable Executable Injection |
Comments
Endpoint security solutions can block portable executable injection based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.003 | Thread Execution Hijacking |
Comments
Endpoint security solutions can block thread execution hijacking based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.004 | Asynchronous Procedure Call |
Comments
Endpoint security solutions can block process injection using asynchronous procedure calls based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.005 | Thread Local Storage |
Comments
Endpoint security solutions can block process injection using thread local storage based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.008 | Ptrace System Calls |
Comments
Endpoint security solutions can block process injection using ptrace system calls based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.009 | Proc Memory |
Comments
Endpoint security solutions can block process injection through proc memory based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.011 | Extra Window Memory Injection |
Comments
Endpoint security solutions can block extra window memory injection based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.012 | Process Hollowing |
Comments
Endpoint security solutions can block process hollowing based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.013 | Process Doppelgänging |
Comments
Endpoint security solutions can block process doppelgänging based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.014 | VDSO Hijacking |
Comments
Endpoint security solutions can block VDSO hijacking based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1055.015 | ListPlanting |
Comments
Endpoint security solutions can block ListPlanting based on common behavioral sequences and suspicious memory-manipulation activity.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1091 | Replication Through Removable Media |
Comments
Host-based intrusion prevention capabilities can block unsigned or untrusted executable files from running from removable media such as USB drives.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1216.001 | PubPrn |
Comments
Host-based intrusion prevention capabilities can enforce application-control policies that block older or vulnerable versions of PubPrn from executing.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1569 | System Services |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that block processes created by PsExec from running.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1569.002 | Service Execution |
Comments
Host-based intrusion prevention capabilities can enforce behavioral rules that block processes created by PsExec from running.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1204 | User Execution |
Comments
Host-based intrusion prevention capabilities can prevent potentially malicious executable files from running based on prevalence, age, trust, or behavioral criteria and can block Office applications from writing malicious executable content to disk.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1204.002 | Malicious File |
Comments
Host-based intrusion prevention capabilities can prevent potentially malicious executable files from running when they are downloaded or launched by Office applications, scripting interpreters, email clients, or fail prevalence, age, or trust criteria.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1047 | Windows Management Instrumentation |
Comments
Host-based intrusion prevention capabilities can enforce Attack Surface Reduction rules that block processes created by Windows Management Instrumentation commands from running.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Network intrusion prevention solutions can identify traffic patterns associated with adversary-in-the-middle activity and block the activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
Network intrusion prevention solutions can identify traffic patterns associated with name-resolution poisoning and SMB relay activity and block the activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1557.002 | ARP Cache Poisoning |
Comments
Network intrusion prevention solutions can identify traffic patterns associated with ARP cache poisoning and block the activity where the relevant network traffic is monitored.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1557.003 | DHCP Spoofing |
Comments
Network intrusion prevention solutions can identify traffic patterns associated with DHCP spoofing and block the activity where the relevant network traffic is monitored.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1557.004 | Evil Twin |
Comments
Wireless intrusion prevention capabilities can identify rogue access points and traffic patterns associated with evil-twin activity and block or contain the unauthorized wireless connection.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1071 | Application Layer Protocol |
Comments
Network intrusion prevention solutions can use signatures for known malicious application-layer traffic to block adversary command-and-control communications at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1071.001 | Web Protocols |
Comments
Network intrusion prevention solutions can use signatures for malicious HTTP or HTTPS traffic associated with specific adversary tools to block command-and-control activity at the network boundary.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1071.002 | File Transfer Protocols |
Comments
Network intrusion prevention solutions can use signatures for malicious file-transfer protocol traffic associated with specific adversary tools to block activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1071.003 | Mail Protocols |
Comments
Network intrusion prevention solutions can use signatures for malicious mail-protocol traffic associated with specific adversary tools to block activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1071.004 | DNS |
Comments
Network intrusion prevention solutions can use signatures for malicious DNS traffic associated with specific adversary tools to block command-and-control activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1071.005 | Publish/Subscribe Protocols |
Comments
Network intrusion prevention solutions can use signatures for malicious publish/subscribe protocol traffic associated with specific adversary tools to block activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1132 | Data Encoding |
Comments
Network intrusion prevention solutions can use protocol and malware-specific signatures to identify encoded command-and-control traffic and block matching activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1132.001 | Standard Encoding |
Comments
Network intrusion prevention solutions can use signatures for known protocol indicators and standard encoding patterns used by adversary tools to block matching network activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1132.002 | Non-Standard Encoding |
Comments
Network intrusion prevention solutions can use signatures for known protocol indicators and non-standard encoding patterns used by adversary tools to block matching network activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1602 | Data from Configuration Repository |
Comments
Configure network intrusion prevention solutions to identify and block unauthorized management queries and commands used to access network-device configuration repositories.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Configure network intrusion prevention solutions to identify and block SNMP queries and commands originating from unauthorized sources.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Configure network intrusion prevention solutions to identify and block unauthorized SNMP activity and unexpected Smart Install usage directed at network devices.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1001 | Data Obfuscation |
Comments
Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block obfuscated command-and-control activity that remains identifiable at the network level.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1001.001 | Junk Data |
Comments
Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block command-and-control communications that use junk data for obfuscation.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1001.002 | Steganography |
Comments
Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block network activity that uses identifiable steganographic methods.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1001.003 | Protocol or Service Impersonation |
Comments
Network intrusion prevention solutions can use signatures for known adversary traffic patterns to block command-and-control activity that impersonates legitimate protocols or services.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1030 | Data Transfer Size Limits |
Comments
Network intrusion prevention solutions can use signatures associated with known adversary infrastructure and malware to block command-and-control traffic that varies transfer size to evade controls.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1568 | Dynamic Resolution |
Comments
Network intrusion prevention solutions can use signatures and known indicators associated with dynamically resolved adversary infrastructure to block matching command-and-control traffic.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1568.002 | Domain Generation Algorithms |
Comments
Network intrusion prevention solutions can block traffic to domains or patterns associated with known domain-generation algorithms when those indicators can be identified in advance or during network activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1573 | Encrypted Channel |
Comments
Network intrusion prevention solutions can use observable network signatures associated with known adversary malware to block encrypted command-and-control traffic at monitored boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1573.001 | Symmetric Cryptography |
Comments
Network intrusion prevention solutions can use observable network signatures associated with known adversary malware to block command-and-control traffic protected with symmetric cryptography.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1573.002 | Asymmetric Cryptography |
Comments
Network intrusion prevention solutions can use observable network signatures associated with known adversary malware to block command-and-control traffic protected with asymmetric cryptography.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over alternative protocols.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over symmetrically encrypted non-command-and-control protocols.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over asymmetrically encrypted non-command-and-control protocols.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over unencrypted non-command-and-control protocols.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1041 | Exfiltration Over C2 Channel |
Comments
Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable exfiltration occurring over command-and-control channels.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1008 | Fallback Channels |
Comments
Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable fallback command-and-control channels at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1105 | Ingress Tool Transfer |
Comments
Network intrusion prevention solutions can identify known malicious transfer patterns or unusual transfers over protocols such as FTP and block the associated tool-transfer activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1570 | Lateral Tool Transfer |
Comments
Network intrusion prevention solutions can identify known malicious transfer patterns or unusual transfers over common tools and protocols and block lateral tool-transfer activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1104 | Multi-Stage Channels |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable traffic associated with multi-stage command-and-control channels.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1046 | Network Service Discovery |
Comments
Network intrusion prevention solutions can identify and block remote service scanning that crosses monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1095 | Non-Application Layer Protocol |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block malicious use of non-application-layer protocols at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1571 | Non-Standard Port |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block malicious traffic using non-standard ports at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1566 | Phishing |
Comments
Network intrusion prevention solutions and network-based content controls can block malicious email links or attachments before they reach or execute on enterprise assets.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1566.001 | Spearphishing Attachment |
Comments
Network intrusion prevention solutions and network-based content controls can block malicious email attachments before they reach or execute on enterprise assets.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1542.004 | ROMMONkit |
Comments
Network intrusion prevention solutions can use signatures for protocols such as TFTP to block identifiable network activity associated with unauthorized modification of network-device boot components.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1542.005 | TFTP Boot |
Comments
Network intrusion prevention solutions can use signatures for protocols such as TFTP to block unauthorized TFTP traffic associated with network-device boot activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1572 | Protocol Tunneling |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware and tunneling traffic to block identifiable protocol-tunneling activity at monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1090 | Proxy |
Comments
Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable proxy communications used for adversary command and control.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1090.001 | Internal Proxy |
Comments
Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable internal proxy communications used for adversary command and control.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1090.002 | External Proxy |
Comments
Network intrusion prevention solutions can use malware- and protocol-specific signatures to block identifiable external proxy communications used for adversary command and control.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1219 | Remote Access Tools |
Comments
Network intrusion prevention solutions can use network signatures to block traffic associated with unauthorized remote-access services.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1029 | Scheduled Transfer |
Comments
Network intrusion prevention solutions can use signatures for known adversary infrastructure and malware to block identifiable scheduled command-and-control or data-transfer activity.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1221 | Template Injection |
Comments
Network intrusion prevention solutions can block network activity that attempts to fetch or execute malicious payloads through externally referenced document templates.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1204 | User Execution |
Comments
When user execution depends on visiting a malicious link or retrieving malicious content, network intrusion prevention solutions can block the associated network request or download.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1204.001 | Malicious Link |
Comments
Network intrusion prevention solutions can block requests to malicious links and prevent associated content from being downloaded across monitored network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1204.003 | Malicious Image |
Comments
Network intrusion prevention solutions can block malicious image downloads when the content or associated network activity matches known malicious indicators.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1204.004 | Malicious Copy and Paste |
Comments
Network intrusion prevention solutions can block network requests for malicious content used in copy-and-paste execution workflows when the destination or traffic matches known malicious indicators.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1204.005 | Malicious Library |
Comments
Network intrusion prevention solutions can block malicious library downloads when the content or associated network activity matches known malicious indicators.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1102 | Web Service |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable command-and-control traffic using web services.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1102.001 | Dead Drop Resolver |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable traffic to web services used as dead-drop resolvers.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1102.002 | Bidirectional Communication |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable bidirectional command-and-control traffic using web services.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1102.003 | One-Way Communication |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable one-way command-and-control traffic using web services.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Filtering unnecessary and legacy network traffic between network segments reduces opportunities for adversaries to establish adversary-in-the-middle conditions.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1071 | Application Layer Protocol |
Comments
Use network filtering between segments to permit only required application-layer protocols and authorized communications, limiting adversary use of application protocols for command and control.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1071.001 | Web Protocols |
Comments
Restrict HTTP and HTTPS traffic crossing network-segment boundaries from critical systems to approved destinations, reducing unauthorized outbound web communications used for command and control or payload transfer.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1071.002 | File Transfer Protocols |
Comments
Filter FTP and SFTP traffic between network segments so sensitive systems can transfer files only to trusted internal systems or other explicitly approved destinations.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1071.003 | Mail Protocols |
Comments
Restrict SMTP, IMAP, and POP3 traffic between segments so servers and critical systems communicate only with trusted mail infrastructure, reducing unauthorized mail-based command, control, or exfiltration paths.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1071.004 | DNS |
Comments
Restrict DNS traffic between segments to approved resolvers and filter requests to unknown, untrusted, or known malicious resources, reducing adversary use of DNS for command and control or concealed data transfer.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1071.005 | Publish/Subscribe Protocols |
Comments
Filter publish/subscribe protocol traffic crossing segment boundaries to approved brokers, destinations, and expected ports, reducing use of untrusted resources or irregular ports for command and control.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1602 | Data from Configuration Repository |
Comments
Apply network access-control rules between trusted and untrusted segments to block unauthorized management protocols used to reach configuration repositories and managed network devices.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Apply network access-control rules to restrict SNMP traffic across segment boundaries to authorized management systems, preventing unauthorized retrieval of Management Information Base data.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Apply network access-control rules to restrict management protocols used to retrieve network-device configurations to approved management segments and authorized systems.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Enforce network segmentation, proxies, and dedicated protocol services so only approved systems can communicate over protocols such as DNS, reducing opportunities to exfiltrate data through alternative protocols.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
Enforce proxies or dedicated services and restrict encrypted non-command-and-control protocol traffic between segments to systems with a legitimate requirement to use those protocols.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Enforce proxies or dedicated services and restrict asymmetric encrypted non-command-and-control protocol traffic between segments to approved systems and destinations.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
Restrict unencrypted alternative-protocol traffic between network segments and allow those protocols only where required for approved business communications.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Restrict outbound traffic from public-facing or DMZ network segments to approved internal and external destinations, limiting post-exploitation communication from a compromised public-facing server.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1570 | Lateral Tool Transfer |
Comments
Restrict file-sharing communications such as SMB between network segments to systems with a legitimate requirement, reducing adversary opportunities to transfer tools laterally.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1599 | Network Boundary Bridging |
Comments
Use unaffected firewalls or routers to block unauthorized traffic that attempts to bridge established network-segment boundaries and continue monitoring to ensure the filtering remains effective.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1599.001 | Network Address Translation Traversal |
Comments
Use unaffected network filtering devices to block unauthorized traffic attempting to traverse network boundaries through NAT or related boundary-bridging mechanisms.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1095 | Non-Application Layer Protocol |
Comments
Filter traffic at network-segment boundaries to prevent use of non-application-layer protocols that are not required for business operations.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1572 | Protocol Tunneling |
Comments
Filter network traffic between segments to untrusted, unauthorized, or known malicious destinations and restrict protocols that can be abused to tunnel communications across network boundaries.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1219 | Remote Access Tools |
Comments
Configure network firewalls and proxies at segment boundaries to restrict outgoing traffic to sites and services associated with unauthorized remote-access software.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1219.002 | Remote Desktop Software |
Comments
Restrict remote-desktop software traffic between network segments to authorized systems, destinations, and management paths using firewalls and proxy controls.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Restrict SMB and Windows administrative-share communications between network segments to explicitly authorized systems and management paths.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1021.005 | VNC |
Comments
Filter or block VNC traffic across network-segment boundaries, including commonly used VNC ports, except where the communication is explicitly required.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1205 | Traffic Signaling |
Comments
Use stateful filtering at network-segment boundaries to block traffic patterns used by traffic-signaling mechanisms when the signaling implementation can be identified and constrained.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1205.001 | Port Knocking |
Comments
Use stateful filtering at network-segment boundaries to prevent port-knocking sequences from reaching protected systems where the signaling pattern can be constrained.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1205.002 | Socket Filters |
Comments
Use stateful filtering at network-segment boundaries to block crafted traffic used to trigger socket-filter-based communication when the signaling implementation can be identified.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Implement network-based filtering restrictions between trusted and untrusted VPCs or equivalent network segments to prohibit unauthorized data transfers to external cloud accounts.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1197 | BITS Jobs |
Comments
Configure network filtering controls so only legitimate BITS traffic is permitted across network boundaries, restricting unauthorized BITS communications used for background transfer or execution activity.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1530 | Data from Cloud Storage |
Comments
Use network-based source restrictions and expected IP ranges when accessing cloud resources so data access is limited to authorized network locations in addition to valid user accounts.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1090 | Proxy |
Comments
Use network allow and block lists to prevent traffic between network segments and known anonymity networks or command-and-control infrastructure that may be used as proxy destinations.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1090.003 | Multi-hop Proxy |
Comments
Use network allow and block lists to restrict traffic to known anonymity networks and command-and-control infrastructure that may be chained together as multi-hop proxy destinations.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1218 | System Binary Proxy Execution |
Comments
Use network appliances at segment boundaries to filter ingress and egress traffic and restrict unnecessary protocols or destinations that trusted system binaries could otherwise use for malicious communications.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1218.012 | Verclsid |
Comments
Restrict unnecessary outbound traffic from systems that do not require external communications through Verclsid, using network filtering controls where the relevant traffic crosses a managed segment boundary.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1552 | Unsecured Credentials |
Comments
Restrict network access paths to cloud instance metadata services and use filtering controls to reduce exposure of metadata interfaces that may contain temporary credentials or other authentication material.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1552.005 | Cloud Instance Metadata API |
Comments
Restrict network access to the Cloud Instance Metadata API so only workloads with a legitimate requirement can reach the service, reducing adversary access to credentials and metadata through unintended network paths.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1550.004 | Web Session Cookie |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and the remediation configures applications and browsers to reduce persistent sessions, shorten cookie validity, require reauthentication, and invalidate session material more aggressively.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1543 | Create or Modify System Process |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and the remediation restricts insecure service/process behavior.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1606 | Forge Web Credentials |
Comments
Application and browser configuration can reduce persistent or weakly protected web credential artifacts such as cookies that were found/forged during penetration testing.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1543.005 | Container Service |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and the remediation is related to configuring container services to run rootless or otherwise reduce unnecessary service privileges, directly constraining persistence or privilege abuse through the container service. The mapping does not apply when the finding requires patching or architectural changes rather than configuration correction.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1555.005 | Password Managers |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and the remediation deals with enforcing password-manager locking, timeout, vault-access, and related security settings that reduce exposure of stored or decrypted credentials.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1685 | Disable or Modify Tools |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation relates to hardening security, logging, and monitoring tools so they are harder to disable or reconfigure, including by enforcing permissions, persistence settings, and service configuration.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1667 | Email Bombing |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthens mail service configuration, sender authentication policy, filtering, throttling, and related controls that reduce abusive high-volume email delivery.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1546.013 | PowerShell Profile |
Comments
This relationship applies when penetration testing identifies the described software-configuration weakness and remediation of the finding removes unnecessary PowerShell profiles, restrict profile modification, or configure PowerShell execution so untrusted profile content is not loaded.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1606.001 | Web Cookies |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the applications and browsers to minimize persistent cookies, shorten cookie lifetime, and apply secure cookie settings that reduce reusable credential material.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1590.002 | DNS |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the DNS zone transfers to explicitly authorized servers and correct other DNS service settings that expose internal naming information.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1559.002 | Dynamic Data Exchange |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding restricts the unnecessary DDE and embedded-content functionality in affected applications, directly reducing an execution path that relies on permissive application configuration.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1566.001 | Spearphishing Attachment |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthen mail system sender-authentication, attachment-handling, and filtering policies that reduce delivery of malicious attachments.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1566.002 | Spearphishing Link |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthens mail authentication, URL-handling, and browser or mail-client policy to reduce delivery or successful use of malicious links.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1598.002 | Spearphishing Attachment |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding strengthens sender-authentication and attachment-filtering configuration to reduce spoofed or malicious messages used to solicit sensitive information.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1677 | Poisoned Pipeline Execution |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding hardens CI/CD pipeline settings by restricting unreviewed code execution, isolating runners, reducing secrets exposure, constraining triggers, and preventing user-controlled input from being implicitly trusted.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1688 | Safe Mode Boot |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding configure system settings so defensive services remain active or recover correctly when Windows is booted into Safe Mode.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1684.002 | Email Spoofing |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes and enforces SPF, DKIM, DMARC, and related mail-domain protections to reduce successful sender impersonation.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1539 | Steal Web Session Cookie |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes by configuring secure cookie attributes, shorter lifetimes, session invalidation, and reduced persistence in affected applications or browsers.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the cloud applications and services to restrict external sharing, cross account transfers, and unapproved destinations, directly constraining data movement to adversary controlled cloud accounts.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1535 | Unused/Unsupported Cloud Regions |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes disables or restricts unused cloud regions and services so adversaries cannot create or operate resources in locations outside the organization's intended monitoring and governance scope.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1550.003 | Pass the Ticket |
Comments
Using role-based access control (RBAC) to prevent domain users from being local administrators on multiple systems can help limit adversaries’ ability to reuse Kerberos tickets for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1550.002 | Pass the Hash |
Comments
Using role-based access control (RBAC) to prevent domain users from being local administrators on multiple systems can help limit adversaries’ ability to reuse NTLM hashes for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Using role-based access control (RBAC) to enforce least privilege and prevent domain users from holding local-administrator rights across multiple systems can help limit an adversary’s ability to use alternate authentication material for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1552.007 | Container API |
Comments
Enforce authentication and role-based access control (RBAC) on the container API to restrict users to the least privileges required to help prevent adversaries from gathering credentials via APIs within a containers environment.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Using role-based access control (RBAC) to limit user-account and identity access management (IAM) permissions to the least privileges required can help prevent adversaries from transferring organizational data to cloud accounts they control.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1199 | Trusted Relationship |
Comments
Implement role-based access control (RBAC) to manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party or if the party is compromised by an adversary.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1569.003 | Systemctl |
Comments
Implement role-based access control (RBAC) to ensure lower-privileged users cannot create or interact with higher-privileged system services to help prevent adversaries from abusing systemctl to execute commands or programs.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1569.001 | Launchctl |
Comments
Implement role-based access control (RBAC) to ensure lower-privileged users cannot create or interact with higher-privileged system services to help prevent adversaries from abusing launchctl to execute commands or programs.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1047 | Windows Management Instrumentation |
Comments
Using role-based access control (RBAC) to restrict remote WMI access to authorized administrative roles can help prevent adversaries from abusing Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1195 | Supply Chain Compromise |
Comments
Implement role-based access control (RBAC) to ensure software and development tools run with the lowest necessary privileges to help limit an adversary’s ability to propagate or perform unauthorized actions in the event of a supply chain compromise.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1528 | Steal Application Access Token |
Comments
Enforce role-based access control (RBAC) to limit accounts to the least privileges they require to help prevent adversaries from obtaining or abusing application access tokens.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1489 | Service Stop |
Comments
Using role-based access control (RBAC) to limit user accounts and groups so that only authorized administrators can interact with service changes and service configurations can help prevent adversaries from stopping or disabling services.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1648 | Serverless Execution |
Comments
Using role-based access control (RBAC) to limit permissions to create, modify, or run serverless resources only to users that explicitly require them can help prevent adversaries from abusing serverless computing, integration, and automation services to execute arbitrary code in cloud environments.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1505.003 | Web Shell |
Comments
Using role-based access control (RBAC) to limit permissions to upload, create, or modify content in web-server application directories to users with a legitimate need can help prevent adversaries from backdooring web servers with web shells.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1505 | Server Software Component |
Comments
Using role-based access control (RBAC) to limit permissions to add or modify server software components to users with a legitimate need can help prevent adversaries from abusing legitimate extensible development features of servers.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Using role-based access control (RBAC) to limit Remote Desktop Users group membership and Remote Desktop Protocol (RDP) permissions to users with a legitimate need can help prevent adversaries from using RDP for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1053.006 | Systemd Timers |
Comments
Using role-based access control (RBAC) to limit permissions to create or modify scheduled tasks via system utilities to authorized administrator roles to help prevent adversaries from abusing task scheduling functionality.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1053.003 | Cron |
Comments
Using role-based access control (RBAC) to limit permissions to create or modify scheduled tasks via the cron utility to authorized administrator roles to help prevent adversaries from abusing task scheduling functionality.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1053 | Scheduled Task/Job |
Comments
Using role-based access control (RBAC) to limit permissions to create or modify scheduled tasks and jobs on remote systems to authorized administrator roles to help prevent adversaries from abusing task scheduling functionality.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1053.002 | At |
Comments
Using role-based access control (RBAC) to limit permissions to create or modify scheduled tasks via the at utility to authorized administrator roles to help prevent adversaries from abusing task scheduling functionality.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1053.005 | Scheduled Task |
Comments
Using role-based access control (RBAC) to limit permissions to create or modify scheduled tasks on remote systems to authorized administrator roles to help prevent adversaries from abusing task scheduling functionality.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1021.004 | SSH |
Comments
Using role-based access control (RBAC) to limit SSH access and permitted commands to users with a legitimate need can help prevent adversaries from using SSH for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1053.007 | Container Orchestration Job |
Comments
Using role-based access control (RBAC) to limit permissions to create or modify scheduled tasks via container orchestration tools to authorized administrator roles to help prevent adversaries from abusing task scheduling functionality.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1072 | Software Deployment Tools |
Comments
Using role-based access control (RBAC) to limit access to and use of centralized software suites to a limited number of authorized administrators with a verified business need can help prevent adversaries from accessing and abusing software deployment tools.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1021 | Remote Services |
Comments
Using role-based access control (RBAC) to limit which accounts can use remote services and restrict the commands or resources available to those accounts to help prevent adversaries from using remote services for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1563.001 | SSH Hijacking |
Comments
Using role-based access control (RBAC) to limit remote user permissions to necessary users to help prevent adversaries from commandeering these sessions.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1563.002 | RDP Hijacking |
Comments
Using role-based access control (RBAC) to limit remote user permissions to necessary users to help prevent adversaries from commandeering these sessions.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Using role-based access control (RBAC) to limit remote user permissions to necessary users to help prevent adversaries from commandeering these sessions.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1677 | Poisoned Pipeline Execution |
Comments
Using role-based access control (RBAC) to limit write access to internal repositories and CI/CD pipeline permissions to users and services with a legitimate need can help prevent adversaries from modifying pipelines to execute malicious code.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1566.003 | Spearphishing via Service |
Comments
Using role-based access control (RBAC) to limit third-party messaging and collaboration-service account privileges to users with a legitimate need can help prevent adversaries from abusing compromised service accounts for spearphishing.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1566.002 | Spearphishing Link |
Comments
Using role-based access control (RBAC) to apply limitations on which roles can grant consent to third-party applications can help prevent users from granting consent to unfamiliar or unverified third-party applications through spearphishing links.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1566.001 | Spearphishing Attachment |
Comments
Using role-based access control (RBAC) to limit file-opening and execution permissions to only the accounts that require them can help reduce the impact of malicious email attachments by preventing unauthorized execution or spread of malware.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1040 | Network Sniffing |
Comments
In cloud environments, using role-based access control (RBAC) to ensure that users are not granted permissions to create or modify traffic mirrors unless explicitly required can help prevent adversaries from capturing network traffic.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1666 | Modify Cloud Resource Hierarchy |
Comments
Using role-based access control (RBAC) to limit permissions to add, delete, or modify cloud resource groups and hierarchy structures to authorized roles can help prevent adversaries from evading organizational guardrails and cloud security policies.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1578.005 | Modify Cloud Compute Configurations |
Comments
Using role-based access control (RBAC) to limit permissions to modify cloud compute settings, quotas, and tenant-level configurations to authorized roles can help prevent adversaries from altering infrastructure resources or bypassing restrictions.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1578.003 | Delete Cloud Instance |
Comments
Using role-based access control (RBAC) to limit permissions to delete cloud instances to authorized roles can help prevent adversaries from removing instances to destroy evidence of malicious activity.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1578.002 | Create Cloud Instance |
Comments
Using role-based access control (RBAC) to limit permissions to create cloud instances to authorized roles can help prevent adversaries from deploying new instances to evade defenses or conduct unauthorized activity.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1578.001 | Create Snapshot |
Comments
Using role-based access control (RBAC) to limit permissions to create cloud snapshots and backups to authorized roles can help prevent adversaries from creating copies of cloud resources for unauthorized access or data collection.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1578 | Modify Cloud Compute Infrastructure |
Comments
Using role-based access control (RBAC) to limit permissions to create, delete, and modify cloud compute infrastructure to authorized roles can help prevent adversaries from altering cloud resources to evade defenses or gain unauthorized access.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1021.008 | Direct Cloud VM Connections |
Comments
Using role-based access control (RBAC) to limit direct cloud-native VM connection permissions to users with a legitimate need can help prevent adversaries from accessing cloud compute infrastructure for lateral movement.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1556.006 | Multi-Factor Authentication |
Comments
Using role-based access control (RBAC) to limit permissions to enroll, disable, or modify multi-factor authentication (MFA) methods and policies to authorized administrative roles can help prevent adversaries from weakening MFA protections on compromised accounts.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1556 | Modify Authentication Process |
Comments
Using role-based access control (RBAC) to limit permissions to modify authentication processes and identity-provider settings to authorized administrative roles can help prevent adversaries from altering authentication controls to gain unauthorized access.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1654 | Log Enumeration |
Comments
Using role-based access control (RBAC) to limit permissions to access and export sensitive system and service logs to privileged roles can help prevent adversaries from enumerating logs for valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1490 | Inhibit System Recovery |
Comments
Using role-based access control (RBAC) to limit permissions to backups to only required users with a legitimate need can help prevent adversaries from deleting or removing built-in data and turning off services designed to aid in the recovery of a corrupted system.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1574.012 | COR_PROFILER |
Comments
Using role-based access control (RBAC) to limit permissions to modify COR_PROFILER environment variables and related .NET configuration settings to users with a legitimate need can help prevent adversaries from loading malicious DLLs into .NET processes.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1574.010 | Services File Permissions Weakness |
Comments
Using role-based access control (RBAC) to limit permissions to modify service executables and their file paths to users with a legitimate need can help prevent adversaries from replacing service binaries with malicious payloads.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1574.005 | Executable Installer File Permissions Weakness |
Comments
Using role-based access control (RBAC) to limit permissions to modify installer executables and their file paths to users with a legitimate need can help prevent adversaries from replacing installer binaries with malicious payloads.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1574 | Hijack Execution Flow |
Comments
Using role-based access control (RBAC) to limit permissions to modify service configurations, registry settings, and protected file paths to users with a legitimate need can help prevent adversaries from hijacking execution flow.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1530 | Data from Cloud Storage |
Comments
Using role-based access control (RBAC) to limit user groups and roles for access to cloud storage to only users with a legitimate need can help prevent adversaries from accessing and collecting data from cloud storage solutions.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1606 | Forge Web Credentials |
Comments
Using role-based access control (RBAC) to limit access to identity infrastructure and token-issuance permissions to narrowly scoped privileged roles reduces opportunities to forge credential materials.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1657 | Financial Theft |
Comments
Using role-based access control (RBAC) to limit sensitive financial transactions and approval privileges to narrowly scoped roles can mitigate use of a compromised account to initiate or authorize unauthorized payments.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1556.009 | Conditional Access Policies |
Comments
Using role-based access control (RBAC) to limit permissions to modify conditional access policies to authorized administrative roles can help prevent adversaries from removing multi-factor authentication (MFA) requirements or adding exclusions that enable persistent access.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1606.002 | SAML Tokens |
Comments
Using role-based access control (RBAC) to limit access to identity infrastructure and token-issuance permissions to narrowly scoped privileged roles reduces opportunities to forge SAML tokens.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Using role-based access control (RBAC) to limit user groups and roles for access to cloud storage systems and objects to only users with a legitimate need can help prevent adversaries from exfiltrating data from cloud storage.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1484.001 | Group Policy Modification |
Comments
Role-based access control (RBAC) can be used to limit which users and computers can access Group Policy Objects (GPOs), helping to prevent adversaries from modifying GPOs.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1484 | Domain or Tenant Policy Modification |
Comments
Role-based access control (RBAC) can be used to limit which users and computers can access domain and identity tenant settings, helping to prevent adversaries from modifying their configuration settings.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1610 | Deploy Container |
Comments
Enforcing role-based access control (RBAC) to limit container dashboard access to only necessary users can prevent adversaries from deploying a container into an environment.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1213.006 | Databases |
Comments
Using role-based access control (RBAC) to limit database access to only authorized users helps prevent adversaries from leveraging these databases to mine valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1213.001 | Confluence |
Comments
Using role-based access control (RBAC) to limit Confluence repository access to only authorized users helps prevent adversaries from leveraging these repositories to mine valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1484.002 | Trust Modification |
Comments
In cloud environments, role-based access control (RBAC) can be used to limit permissions to create new identity providers to only those accounts that require them. This can prevent adversaries from adding new domain trusts, modifying the properties of existing domain trusts, or otherwise changing the configuration of trust relationships between domains and tenants.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1213.004 | Customer Relationship Management Software |
Comments
Using role-based access control (RBAC) to limit Customer Relationship Management (CRM) software access to only authorized users helps prevent adversaries from leveraging CRM software to mine valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1213.003 | Code Repositories |
Comments
Using role-based access control (RBAC) to limit code repository access to only authorized users helps prevent adversaries from leveraging these repositories to mine valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1213 | Data from Information Repositories |
Comments
Using role-based access control (RBAC) to limit information repository access to only authorized users helps prevent adversaries from leveraging these repositories to mine valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1543 | Create or Modify System Process |
Comments
Using role-based access control (RBAC) to ensure only authorized administrator roles can interact with system-level process changes and service configurations helps prevent adversaries from leveraging this functionality to establish persistence or escalate privileges.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1485.001 | Lifecycle-Triggered Deletion |
Comments
In cloud environments, using role-based access control (RBAC) to limit user permissions to modify cloud bucket lifecycle policies to only users with a legitimate need can help prevent adversaries from destroying all objects stored within buckets.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1485 | Data Destruction |
Comments
In cloud environments, using role-based access control (RBAC) to limit user permissions to modify cloud bucket lifecycle policies to only users with a legitimate need can help prevent adversaries from destroying data and files.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1543.005 | Container Service |
Comments
Using role-based access control (RBAC) to limit user access to utilities such as docker to only users with a legitimate need helps prevent adversaries from creating or modifying container or cluster management tools to establish persistence or escalate privileges.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1543.004 | Launch Daemon |
Comments
Using role-based access control (RBAC) to ensure only authorized administrator roles can create new Launch Daemons helps prevent adversaries from creating or modifying Launch Daemons to establish persistence or escalate privileges.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1543.003 | Windows Service |
Comments
Using role-based access control (RBAC) to ensure only authorized administrator roles can interact with service changes and service configurations helps prevent adversaries from leveraging this functionality to establish persistence or escalate privileges.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1543.002 | Systemd Service |
Comments
Using role-based access control (RBAC) to limit user access to system utilities to only users with a legitimate need helps prevent adversaries from creating or modifying systemd services to establish persistence or escalate privileges.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1213.002 | Sharepoint |
Comments
Using role-based access control (RBAC) to limit SharePoint repository access to only authorized users helps prevent adversaries from leveraging these repositories to mine valuable information.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1134.002 | Create Process with Token |
Comments
Role-based access control (RBAC) can help mitigate access token manipulation by restricting which roles are allowed to create new processes with tokens and limiting privileges to a small set of tightly controlled roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1609 | Container Administration Command |
Comments
Enforcing authentication and role-based access control (RBAC) on the container administration service to restrict users to the least privileges required can help prevent adversaries from abusing the service to execute commands within the container.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1059.008 | Network Device CLI |
Comments
Role-based access control (RBAC) helps mitigate this technique by enforcing least privilege and command authorization on network device CLI access, limiting which roles can run perform authorization changes.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1619 | Cloud Storage Object Discovery |
Comments
Role-based access control (RBAC) can help mitigate discovery of cloud storage objects by limiting cloud storage list permissions to narrowly scoped roles, reducing who can enumerate storage objects for discovery.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1580 | Cloud Infrastructure Discovery |
Comments
Role-based access control (RBAC) can help mitigate discovery of cloud infrastructure and resources by limiting which roles can access, manage, or query cloud infrastructure metadata and enforcing who can see and do what in cloud service dashboards.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1185 | Browser Session Hijacking |
Comments
Role-based access control (RBAC) can help mitigate browser session hijacking techniques by enforcing least privilege so that hijacked browser sessions are associated with minimally scoped roles, limiting what an adversary can do with a captured session.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1547.012 | Print Processors |
Comments
Role-based access control (RBAC) can help mitigate this technique by limiting which roles can load or unload device drivers by disabling SeLoadDriverPrivilege.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1613 | Container and Resource Discovery |
Comments
Role-based access control (RBAC) can help mitigate this technique by tightly controlling which roles can view or query container APIs and dashboards and restricting discovery of cluster resources to narrowly scoped roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1547.009 | Shortcut Modification |
Comments
Role-based access control (RBAC) can help mitigate this technique by limiting shortcut creation and modification to narrowly scoped roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1547.006 | Kernel Modules and Extensions |
Comments
Role-based access control (RBAC) can help mitigate this technique by limiting which roles can load or configure kernel modules and extensions to tightly controlled admin roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1547.004 | Winlogon Helper DLL |
Comments
Role-based access control (RBAC) can help mitigate this technique by restricting Winlogon configuration changes to a small set of tightly controlled admin roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1547.013 | XDG Autostart Entries |
Comments
Role-based access control (RBAC) can help mitigate this technique by limiting which roles can can create and modify XDG autostart entries to narrowly scoped privileged roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1098.004 | SSH Authorized Keys |
Comments
Role-based access control (RBAC) can help mitigate account manipulation by limiting which roles in cloud environments are allowed to modify SSH authorized_keys files and ensuring that only users who explicitly require the permissions to update instance metadata or configurations can do so.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1197 | BITS Jobs |
Comments
Role-based access control (RBAC) can help mitigate abuse of BITS jobs by limiting access to the BITS interface to specific user roles or groups.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1098.003 | Additional Cloud Roles |
Comments
Role-based access control (RBAC) can help mitigate account manipulation by limiting which roles are allowed to create or modify accounts and ensuring that low-privileged users do not have permissions to add permissions to accounts or update IAM policies.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1098.001 | Additional Cloud Credentials |
Comments
Role-based access control (RBAC) can help mitigate account manipulation by limiting which roles are allowed to create or modify accounts and ensuring that low-privileged users do not have permissions to add access keys to accounts.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1098 | Account Manipulation |
Comments
Role-based access control (RBAC) can help mitigate account manipulation by limiting which roles are allowed to create or modify accounts and ensuring that low-privileged users do not have permissions to modify accounts or account-related policies.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1087.004 | Cloud Account |
Comments
Role-based access control (RBAC) can help mitigate account discovery by limiting what each role can see or query.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1087 | Account Discovery |
Comments
Role-based access control (RBAC) can help mitigate account discovery by limiting what each role can see or query.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1098.006 | Additional Container Cluster Roles |
Comments
Role-based access control (RBAC) can help mitigate account manipulation by limiting which roles are allowed to add additional roles or permissions and ensuring that low-privileged accounts do not have permissions to add permissions to accounts or to update container cluster roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1546.003 | Windows Management Instrumentation Event Subscription |
Comments
Using role-based access control (RBAC) to restrict or disallow user groups allowed to connect to WMI can help prevent adversaries from maliciously using WMI event subscription capabilities.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1134.001 | Token Impersonation/Theft |
Comments
Role-based access control (RBAC) can help mitigate access token manipulation by restricting which roles are allowed to create or impersonate tokens and limiting privileges to a small set of tightly controlled roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1134 | Access Token Manipulation |
Comments
Role-based access control (RBAC) can help mitigate access token manipulation by restricting which roles are allowed to create or modify tokens and limiting privileges to a small set of tightly controlled roles.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1548.005 | Temporary Elevated Cloud Access |
Comments
Role-based access control (RBAC), implemented under least privilege and access enforcement controls, helps mitigate this technique by limiting which identities can use elevation mechanisms and what they can elevate to.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1548 | Abuse Elevation Control Mechanism |
Comments
Role-based access control (RBAC), implemented under least privilege and access enforcement controls, helps mitigate this technique by limiting which identities can use elevation mechanisms and what they can elevate to.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1134.003 | Make and Impersonate Token |
Comments
Role-based access control (RBAC) can help mitigate access token manipulation by restricting which roles are allowed to create and impersonate tokens and limiting privileges to a small set of tightly controlled roles.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1003 | OS Credential Dumping |
Comments
Encrypting sensitive data at rest prevents dumping credentials from OS caches, memory, or credential structures to obtain hashes or plaintext passwords on domain controller backups.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1059 | Command and Scripting Interpreter |
Comments
Behavioral anti-malware commonly monitors scripting engines and detects malicious script execution through behavioral indicators rather than signatures.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1059.006 | Python |
Comments
Products that explicitly monitor Python process behavior, command execution, child processes, and resulting system changes can detect or block malicious Python activity. Generic behavioral monitoring alone is insufficient.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1055 | Process Injection |
Comments
Some anti-malware products monitor cross-process memory writes, remote-thread creation, process hollowing, and similar injection behavior. Where these protections are enabled, the safeguard directly detects or blocks process injection.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1547.006 | Kernel Modules and Extensions |
Comments
Anti-malware products may detect malicious kernel drivers or unsigned modules during installation or loading. However, preventing unauthorized kernel module loading relies more heavily on platform integrity and driver enforcement controls (anti-malware product monitors and blocks malicious kernel modules, drivers, or extensions) than standard anti-malware alone.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
Remediating known vulnerabilities in kernels, drivers, services, and privileged applications directly removes exploit paths that adversaries could use to obtain elevated privileges. This does not prevent exploitation of unknown vulnerabilities or weaknesses that remain outside the remediation scope.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1189 | Drive-by Compromise |
Comments
Remediating detected vulnerabilities in browsers, plug-ins, and other client software reduces successful exploitation when users visit malicious or compromised websites. This does not prevent drive-by activity that relies on zero-day vulnerabilities, social engineering, or malicious content that does not require exploitation.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Correcting identified vulnerabilities in internet-facing applications, services, and appliances directly removes known initial-access paths. Remediation may include patching, upgrading, replacing, disabling, or isolating the vulnerable component.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1203 | Exploitation for Client Execution |
Comments
Remediating known vulnerabilities in browsers, Office products, PDF readers, and other client applications reduces successful exploit-based code execution. This does not prevent exploitation of unknown vulnerabilities or unremediated unsupported software.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1210 | Exploitation of Remote Services |
Comments
Patching or otherwise correcting vulnerabilities in remotely reachable services removes known lateral-movement and remote-execution paths.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1211 | Exploitation for Stealth |
Comments
Remediation can remove vulnerabilities in operating systems, applications, security tools, and logging components that adversaries could exploit to conceal activity or impair visibility. This relationship applies only when the stealth behavior depends on an identified vulnerability.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1212 | Exploitation for Credential Access |
Comments
Correcting vulnerabilities in authentication systems, credential-handling software, kernels, and related components prevents exploit-based access to credentials.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1611 | Escape to Host |
Comments
Remediating vulnerabilities in host kernels, hypervisors, and container runtimes reduces successful container or virtual-machine escape. This does not prevent escapes caused solely by unsafe configuration, privileged containers, or exposed management sockets.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1495 | Firmware Corruption |
Comments
Applying BIOS, UEFI, device, and component firmware updates can remove vulnerabilities that permit unauthorized firmware modification or corruption. Other protections are still required against adversaries that already possess authorized firmware-update capability.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1542 | Pre-OS Boot |
Comments
This is a partial parent mapping because remediation of vulnerable BIOS, UEFI, and component firmware can remove known pre-OS exploitation paths. Other pre-OS persistence methods may require boot-integrity, signing, and hardware-root-of-trust controls.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1542.001 | System Firmware |
Comments
Applying current BIOS and UEFI updates directly remediates known system-firmware vulnerabilities that could enable persistence or execution below the operating system.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1542.002 | Component Firmware |
Comments
Firmware updates for storage devices, controllers, network adapters, and other components remove known vulnerabilities that could allow malicious component-level persistence or modification.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1548 | Abuse Elevation Control Mechanism |
Comments
This is a partial parent mapping because remediation can remove known vulnerabilities and implementation weaknesses used to bypass elevation controls.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1548.002 | Bypass User Account Control |
Comments
Applying current Windows security updates and supported platform upgrades removes known UAC-bypass and auto-elevation weaknesses. This does not prevent every UAC bypass or activity performed by an account that already has administrative privileges.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1546 | Event Triggered Execution |
Comments
Remediation can remove specific vulnerable event-triggered execution mechanisms, including known AppInit DLL and Application Shimming behaviors. Most event-triggered persistence also depends on configuration and permissions.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1546.010 | AppInit DLLs |
Comments
Upgrading or patching affected Windows platforms removes older AppInit DLL behaviors and weaknesses that adversaries could abuse for persistence or execution. Configuration controls remain necessary where the feature is still supported.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1546.011 | Application Shimming |
Comments
Applying the relevant Windows security updates removes known auto-elevation behavior associated with application-shim installation. Remediation does not prevent all shim abuse by an adversary that already has sufficient privileges.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1552 | Unsecured Credentials |
Comments
Remediation can correct specific software weaknesses that store credentials insecurely, including the Group Policy Preferences implementation. Most unsecured credential exposures require separate configuration, access-control, or secret-management controls.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1552.006 | Group Policy Preferences |
Comments
Applying the applicable Microsoft security update prevents newly configured Group Policy Preferences from storing credentials in a recoverable form. Previously stored credentials may still require separate identification, removal, and rotation.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1550.002 | Pass the Hash |
Comments
Applying relevant Windows security updates can restrict default remote access available to local administrator accounts and reduce some pass-the-hash activity. Remediation does not eliminate hash theft, NTLM use, or pass-the-hash through accounts that retain applicable privileges.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1574 | Hijack Execution Flow |
Comments
Remediation can correct vulnerable library-loading behavior and unsafe execution paths in affected software. Many other execution-flow hijacking methods depend on writable paths, permissions, or configuration rather than a software vulnerability.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1574.001 | DLL |
Comments
Vendor patches can correct unsafe DLL search paths, missing library references, and other side-loading conditions that allow an adversary-controlled DLL to execute. This does not prevent DLL hijacking in unsupported software.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1072 | Software Deployment Tools |
Comments
Remediating vulnerabilities in centralized software-deployment and endpoint-management products prevents exploit-based privileged access and enterprise-wide remote execution. This does not prevent abuse through stolen administrator credentials or legitimate product functionality.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1137 | Office Application Startup |
Comments
This is a partial parent mapping because product remediation can restrict specific Outlook startup and persistence mechanisms, including Outlook Forms, Home Page, and Rules. Other Office startup methods may require configuration and application-control safeguards.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1137.003 | Outlook Forms |
Comments
Applying current Outlook security updates can disable or restrict custom forms that adversaries may abuse for persistence and execution. Unsupported or unpatched Outlook installations remain exposed.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1137.004 | Outlook Home Page |
Comments
Applying the relevant Outlook updates removes or restricts the legacy Home Page functionality used to load malicious content when a folder is accessed.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1137.005 | Outlook Rules |
Comments
Applying current Outlook updates reduces abuse of rule-triggered execution mechanisms. This does not prevent all malicious mailbox-rule activity or activity performed through valid cloud-account access.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1555 | Credentials from Password Stores |
Comments
Remediation can correct vulnerabilities in browsers, password managers, and other credential-storage applications. It does not address every operating-system, application, or cloud credential store.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Correcting identified browser vulnerabilities reduces exploit-based extraction of stored passwords, tokens, and other authentication data. This does not prevent theft by malware that already has sufficient access to the browser profile.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1555.005 | Password Managers |
Comments
Updating, upgrading, or replacing a vulnerable password-manager product removes known credential-exposure vulnerabilities. This does not prevent theft through a compromised master password, an unlocked vault, or an authorized session.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1539 | Steal Web Session Cookie |
Comments
Remediating vulnerabilities in browsers and related applications reduces exploit-based extraction of session cookies. This does not prevent cookie theft by malware or an adversary that already has sufficient access to browser storage or memory.
References
|
| CIS-7.7 | Remediate Detected Vulnerabilities | mitigates | T1686.002 | Network Device Firewall |
Comments
Applying security patches or supported software upgrades to vulnerable firewall appliances and network-device operating environments reduces exploit-based modification or disabling of firewall policy. This does not prevent changes made with valid administrative access.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1189 | Drive-by Compromise |
Comments
Automated application patching keeps browsers and browser plug-ins current, removing known vulnerabilities that malicious or compromised websites could exploit for client execution. The safeguard does not prevent drive-by attacks relying on zero-day vulnerabilities, social engineering, or malicious browser notifications.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Automated application patching removes known vulnerabilities from externally exposed web applications, databases, VPN products, management platforms, and other application services. It does not correct insecure configurations, unsupported custom code, or vulnerabilities for which no vendor patch exists.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1203 | Exploitation for Client Execution |
Comments
Applying current security updates to browsers, Office products, PDF readers, and other client applications reduces successful exploitation of known application vulnerabilities. Operating-system vulnerabilities and unknown application vulnerabilities require separate protections.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1072 | Software Deployment Tools |
Comments
Patching centralized deployment and endpoint-management applications removes known vulnerabilities that could provide adversaries with privileged access or enterprise-wide remote execution. The safeguard does not prevent abuse through stolen administrator credentials or legitimate product functionality.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1137.003 | Outlook Forms |
Comments
Applying current Outlook security updates can disable or restrict custom forms that adversaries may abuse for persistence and execution. The safeguard does not prevent all malicious Office content or abuse of an unpatched or unsupported Outlook installation.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1137.004 | Outlook Home Page |
Comments
Outlook application updates remove or restrict the legacy Home Page feature used to load malicious content when a folder is accessed. The relationship depends on deploying the relevant Outlook security updates.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1137.005 | Outlook Rules |
Comments
Applying current Outlook patches reduces abuse of rule-triggered Visual Basic and related persistence mechanisms. It does not prevent all malicious mailbox-rule activity or activity performed through valid cloud-account access.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Automated browser updates remove known vulnerabilities that could expose stored passwords, tokens, or browser authentication data. Patching does not prevent credential theft by malware already executing with sufficient access to the browser profile.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1555.005 | Password Managers |
Comments
Automated updates to password-manager applications remove known vulnerabilities that could expose stored or decrypted credentials.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1574.001 | DLL |
Comments
Applying vendor patches to vulnerable applications can correct unsafe DLL search paths, missing library references, and other side-loading conditions that allow an adversary-controlled DLL to execute. It does not prevent DLL hijacking in unpatched software or through writable application directories.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
Application patching removes known vulnerabilities in privileged applications, agents, services, and third-party drivers that could allow escalation of privileges. Operating-system and kernel vulnerabilities are addressed separately through operating-system patch management.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1210 | Exploitation of Remote Services |
Comments
Application patching removes known vulnerabilities from third-party database, web, virtualization, file-transfer, remote-management, and similar services used for lateral movement. Vulnerabilities in operating-system-supplied remote services require operating-system patching.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1211 | Exploitation for Stealth |
Comments
Updating applications and security products can remove known vulnerabilities that adversaries could exploit to conceal activity or impair application-level visibility. Operating-system and kernel implementations are outside this safeguard's application scope.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1212 | Exploitation for Credential Access |
Comments
Application patching removes known vulnerabilities in authentication products, browsers, identity applications, network-management products, and other credential-handling software. Vulnerabilities in operating-system authentication components require operating-system patching.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1137 | Office Application Startup |
Comments
Application patches can restrict specific Outlook startup and persistence mechanisms, including Outlook Forms, Home Page, and Rules. Other Office startup mechanisms that rely on macros, add-ins, templates, or configuration changes are not necessarily prevented by patching.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1555 | Credentials from Password Stores |
Comments
Application patching can remove browser and password-manager vulnerabilities used to extract stored credentials. Operating-system credential stores and cloud secrets platforms may require different update mechanisms.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1574 | Hijack Execution Flow |
Comments
Application updates can correct unsafe DLL search paths and other software defects that permit DLL side-loading. Most other execution-flow hijacking implementations require permissions, application control, or operating-system configuration protections.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1176 | Software Extensions |
Comments
Updating browsers and IDEs can remove insecure extension mechanisms, but it does not prevent a user or adversary from installing an otherwise permitted malicious extension.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1176.001 | Browser Extensions |
Comments
Automated browser updates can remove deprecated extension-loading mechanisms and strengthen extension permission and installation controls. Extension allowlisting and trusted-source restrictions remain necessary to prevent malicious extensions.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1176.002 | IDE Extensions |
Comments
Updating IDE applications can correct vulnerabilities in extension loading and provide improved extension security controls. The safeguard does not independently prevent installation of a malicious or compromised extension from an approved marketplace.
References
|
| CIS-7.4 | Perform Automated Application Patch Management | mitigates | T1539 | Steal Web Session Cookie |
Comments
Updating browsers, password managers, and related applications reduces exploitation of known vulnerabilities used to extract session cookies. It does not prevent cookie theft by malware or an adversary that already has sufficient access to browser storage or memory.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1495 | Firmware Corruption |
Comments
Applying BIOS, UEFI, device, and component firmware updates can remove vulnerabilities that permit unauthorized firmware modification or corruption. Other protections are still required against adversaries that already possess authorized firmware-update capability.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1542 | Pre-OS Boot |
Comments
This is a partial parent mapping because remediation of vulnerable BIOS, UEFI, and component firmware can remove known pre-OS exploitation paths. Other pre-OS persistence methods may require boot-integrity, signing, and hardware-root-of-trust controls.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1542.001 | System Firmware |
Comments
Applying current BIOS and UEFI updates directly remediates known system-firmware vulnerabilities that could enable persistence or execution below the operating system.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1542.002 | Component Firmware |
Comments
Firmware updates for storage devices, controllers, network adapters, and other components remove known vulnerabilities that could allow malicious component-level persistence or modification.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1176.002 | IDE Extensions |
Comments
ATT&CK mentions ensuring operating systems and software are using the most current version.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1176.001 | Browser Extensions |
Comments
ATT&CK mentions ensuring operating systems and software are using the most current version.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1176 | Software Extensions |
Comments
ATT&CK mentions ensuring operating systems and software are using the most current version.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1072 | Software Deployment Tools |
Comments
ATT&CK mentions having a patch deployment systems regularly to prevent potential remote access through Exploitation for Privilege Escalation.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1195.002 | Compromise Software Supply Chain |
Comments
ATT&CK mentions a patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1195.001 | Compromise Software Dependencies and Development Tools |
Comments
ATT&CK mentions a patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1195 | Supply Chain Compromise |
Comments
ATT&CK mentions a patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1546 | Event Triggered Execution |
Comments
OS patches that address specific Windows event-triggered execution mechanisms, particularly Application Shimming.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1552 | Unsecured Credentials |
Comments
ATT&CK specifically recommends applying patch KB2962486 which prevents credentials from being stored in GPPs.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1686.002 | Network Device Firewall |
Comments
ATT&CK specifically recommends maintaining network firewalls with current security patches. Include this where network firewall appliances and their operating systems are considered enterprise assets covered by the automated an OS-patching process.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1548 | Abuse Elevation Control Mechanism |
Comments
OS updates can close vulnerabilities and implementation weaknesses used to bypass native elevation mechanisms, especially UAC, but they do not prevent abuse of sudo permissions, temporary cloud elevation, or other correctly functioning mechanisms.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1211 | Exploitation for Stealth |
Comments
OS updates can correct vulnerabilities in kernels, logging components, security tools, and system services that could be exploited to conceal activity. Application-specific exploitation remains outside 7.3.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1210 | Exploitation of Remote Services |
Comments
OS patching directly addresses vulnerabilities in operating-system services such as SMB, RDP, RPC, SSH components, and other built-in remote services. The technique also includes independently installed applications that would fall under application patch management instead.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1550.002 | Pass the Hash |
Comments
ATT&CK identifies Windows 7 and higher system patch KB2871997 as limiting default access available to local administrator accounts, reducing some pass-the-hash lateral movement.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1552.006 | Group Policy Preferences |
Comments
ATT&CK identifies Windows patch KB2962486, which prevents credentials from being stored in Group Policy Preferences. This is a direct OS-patch implementation.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1546.011 | Application Shimming |
Comments
ATT&CK identifies a specific Windows patch, KB3045645, that removes an auto-elevation behavior used to abuse application shims. Automated OS patch deployment directly applies this type of mitigation.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1548.002 | Bypass User Account Control |
Comments
Windows updates include changes that close known UAC-bypass methods and improve elevation protections. ATT&CK directly recommends maintaining the latest Windows version and patch level.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1611 | Escape to Host |
Comments
Container and VM escapes may exploit vulnerabilities in the host kernel, hypervisor, or operating-system components. ATT&CK explicitly recommends keeping hosts current with security patches.
References
|
| CIS-7.3 | Perform Automated Operating System Patch Management | mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
OS and kernel vulnerabilities are a primary means of escalating from user privileges to SYSTEM or root. Automated OS patching directly removes known vulnerable code paths. ATT&CK specifically recommends patch management for internal endpoints and servers.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1204.002 | Malicious File |
Comments
When a user executes a malicious file, behavior-based anti-malware can identify suspicious runtime activity and terminate or contain the process. This directly reduces the effectiveness of the malicious file after execution begins.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1055 | Process Injection |
Comments
Process injection produces observable behaviors such as cross-process memory writes, remote-thread creation, process hollowing, and abnormal memory execution. Behavior-based anti-malware can directly detect or block these actions.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1547.006 | Kernel Modules and Extensions |
Comments
Behavior-based products may monitor driver installation, kernel module loading, and suspicious kernel-level changes. Where these events are blocked or detected, the safeguard directly addresses malicious kernel persistence.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1027.002 | Software Packing |
Comments
Behavior-based anti-malware can identify packed malware after it unpacks in memory or begins performing malicious actions. This reduces the effectiveness of packing as a method for evading static detection.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1059.005 | Visual Basic |
Comments
Behavior-based anti-malware can identify suspicious Visual Basic and macro execution chains, such as an Office application spawning interpreters, downloading payloads, or modifying system settings.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1059.001 | PowerShell |
Comments
Behavior-based anti-malware can analyze PowerShell process ancestry, commands, script content, memory activity, and resulting system changes. This enables direct detection or blocking of malicious PowerShell execution.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1687 | Exploitation for Defense Impairment |
Comments
Adversaries may exploit anti-malware, EDR, logging, or other defensive components to disable or impair them. Anti-exploitation controls protecting those components directly restrict this behavior.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1212 | Exploitation for Credential Access |
Comments
Adversaries may exploit authentication, kernel, or security processes to access credentials. Anti-exploitation protections that cover the targeted component directly reduce the likelihood that the exploit succeeds.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1210 | Exploitation of Remote Services |
Comments
Remote-service exploitation targets vulnerabilities in network-accessible services or protocol handlers. Anti-exploitation protections applied to the targeted service can block the exploit or prevent successful payload execution.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Public-facing services frequently become initial access vectors through software vulnerabilities. Exploit mitigation technologies increase resistance to successful exploitation by preventing or disrupting exploit execution.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1189 | Drive-by Compromise |
Comments
Drive-by attacks commonly rely on browser or plugin exploitation. DEP, ASLR, CFG, and exploit guards are intended to prevent exploitation of these vulnerabilities before malicious code executes.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
Kernel, memory, driver, and control-flow protections can prevent exploitation of vulnerable components used to obtain elevated privileges. This is a direct technical restriction on privilege-escalation exploits.
References
|
| CIS-10.5 | Enable Anti-Exploitation Features | mitigates | T1203 | Exploitation for Client Execution |
Comments
Data execution prevention, control-flow protections, exploit guards, and similar mechanisms interfere directly with memory corruption and code execution in client applications. These features reduce the ability of an exploit to execute its payload.
References
|
| CIS-10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | mitigates | T1204.002 | Malicious File |
Comments
Automatic scanning can detect and quarantine a malicious file on removable media before a user opens or executes it. This creates a direct preventive relationship when blocking or quarantine is enforced.
References
|
| CIS-10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | mitigates | T1091 | Replication Through Removable Media |
Comments
Malware commonly uses removable media to move between systems. Automatic scanning can identify and quarantine malicious files when the media is connected, directly reducing the effectiveness of removable-media propagation.
References
|
| CIS-10.3 | Disable Autorun and Autoplay for Removable Media | mitigates | T1091 | Replication Through Removable Media |
Comments
Many removable-media malware families rely on Autorun/Autoplay to automatically execute malicious code after an infected USB device is inserted. Disabling these operating system features directly interrupts the automatic execution mechanism used to propagate malware through removable media, forcing an attacker to rely on manual execution or another execution vector.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1204.002 | Malicious File |
Comments
Anti-malware can scan a file when it is opened or executed and quarantine or block the file before the malicious payload runs. This directly reduces the effectiveness of malicious files that depend on user execution.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1027.002 | Software Packing |
Comments
Packed executables are a common malware delivery method. Modern anti-malware engines unpack or emulate packed binaries during scanning, making this a direct technical capability of the safeguard.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1059.005 | Visual Basic |
Comments
Malicious VBScript is routinely inspected by anti-malware through script scanning and behavioral analysis prior to execution.
References
|
| CIS-10.1 | Deploy and Maintain Anti-Malware Software | mitigates | T1059.001 | PowerShell |
Comments
Anti-malware integrates with PowerShell logging and AMSI to inspect scripts and commands before execution, making PowerShell malware a primary detection target.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1110 | Brute Force |
Comments
Unique passwords and minimum password lengths, which directly reduce the effectiveness of brute-force attacks by increasing the number of possible password combinations and limiting the reuse of compromised credentials across systems. This makes online password guessing and offline password cracking more difficult and reduces the success of credential-stuffing attacks.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1110.001 | Password Guessing |
Comments
Enforced minimum password length increases the search space and reduces the effectiveness of password guessing.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1110.002 | Password Cracking |
Comments
Longer passwords materially increase the effort required to recover plaintext passwords from captured hashes or related material.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1110.003 | Password Spraying |
Comments
Unique, non-common passwords reduce success of spraying common passwords across many accounts.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1078.001 | Default Accounts |
Comments
Unique passwords reduce adversary use of default or vendor-provided account credentials.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1078.002 | Domain Accounts |
Comments
Domain accounts can span users, admins, and services; unique passwords reduce domain credential reuse and lateral reuse risk.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1078.003 | Local Accounts |
Comments
Unique local passwords reduce reuse of one compromised local account credential across multiple endpoints or servers.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1078 | Valid Accounts |
Comments
Unique passwords reduce credential reuse across systems and accounts, limiting adversary use of one compromised password to pivot through valid accounts.
References
|
| CIS-5.3 | Disable Dormant Accounts | mitigates | T1110.004 | Credential Stuffing |
Comments
Disabling dormant accounts removes stale accounts that may still have breached or reused credentials, reducing credential-stuffing success against abandoned identities.
References
|
| CIS-5.3 | Disable Dormant Accounts | mitigates | T1078.004 | Cloud Accounts |
Comments
Disabling inactive cloud/SaaS accounts removes abandoned identities usable for access, persistence, or privilege abuse.
References
|
| CIS-5.3 | Disable Dormant Accounts | mitigates | T1078.003 | Local Accounts |
Comments
Disabling inactive local accounts reduces stale local credential abuse, dependent on endpoint/server coverage.
References
|
| CIS-5.3 | Disable Dormant Accounts | mitigates | T1078.002 | Domain Accounts |
Comments
Dormant domain accounts can retain broad access; disabling them removes stale domain credentials from the attack surface.
References
|
| CIS-5.3 | Disable Dormant Accounts | mitigates | T1078 | Valid Accounts |
Comments
Disabling stale accounts removes valid authentication paths available to adversaries.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078 | Valid Accounts |
Comments
Separating privileged accounts from daily-use accounts limits the privilege available if a primary account is compromised.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078.002 | Domain Accounts |
Comments
Dedicated domain admin accounts reduce the chance that routine domain account compromise yields domain-level privileges.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078.003 | Local Accounts |
Comments
Restricting local admin rights to dedicated accounts reduces local privilege availability in routine user sessions.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1078.004 | Cloud Accounts |
Comments
Dedicated cloud admin accounts reduce privileged cloud exposure during normal user activity, though cloud-specific PAM controls are not required by the safeguard.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548 | Abuse Elevation Control Mechanism |
Comments
The safeguard limits which accounts can legitimately elevate, reducing the opportunity to abuse elevation paths from compromised routine accounts.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548.002 | Bypass User Account Control |
Comments
If routine accounts lack admin rights, UAC bypass from normal browsing/email sessions is less useful to an adversary.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548.003 | Sudo and Sudo Caching |
Comments
Dedicated admin accounts reduce privileged sudo exposure during routine activity, though sudo policy hardening is outside the safeguard.
References
|
| CIS-5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | mitigates | T1548.005 | Temporary Elevated Cloud Access |
Comments
If dedicated administrator accounts include cloud privileged-access workflows or separate privileged cloud identities, the safeguard can reduce abuse of temporary elevated cloud access.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1552.004 | Private Keys |
Comments
Private keys are frequently stored on disk. Encrypting storage can reduce exposure from theft of key files, especially during offline access or storage compromise.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1649 | Steal or Forge Authentication Certificates |
Comments
Certificates and private keys are commonly stored on disk. Encryption at rest can reduce exposure when attackers attempt to steal certificate material from storage.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1119 | Automated Collection |
Comments
Adversaries use automated methods to search for and copy data across systems, cloud APIs, pipelines, or RAT functionality. Encryption at rest can mitigate the automated collection of files/storage objects from being usable when the adversary lacks access to the decryption key.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1003.003 | NTDS |
Comments
NTDS dumping targets Active Directory credential material. Encryption and secure storage of DC backups can prevent an adversary who obtains an offline backup from directly accessing NTDS credential material.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1550.001 | Application Access Token |
Comments
Application access tokens are sensitive credential material commonly stored in databases, configuration stores, browser profiles, caches, or application files. Encrypting those tokens at rest can prevent an adversary who obtains raw storage, a database backup, snapshot, or filesystem access from reading and reusing the tokens.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1078.004 | Cloud Accounts |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1078.003 | Local Accounts |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1078 | Valid Accounts |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1078.002 | Domain Accounts |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078 | Valid Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1098 | Account Manipulation |
Comments
Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to maintain or elevate access using compromised credentials.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1599 | Network Boundary Bridging |
Comments
Using multi-factor authentication on accounts that administer network devices helps prevent adversaries from using compromised credentials to reconfigure or bypass network boundaries by limiting their ability to log in.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1601.002 | Downgrade System Image |
Comments
Using multi-factor authentication on administrator accounts helps prevent adversaries from using compromised credentials to install older operating systems by limiting their ability to log in.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1601.001 | Patch System Image |
Comments
Using multi-factor authentication on administrator accounts helps prevent adversaries from using compromised credentials to modify system images and introduce new capabilities or weaken defenses by limiting their ability to log in.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1601 | Modify System Image |
Comments
Using multi-factor authentication on administrator accounts helps prevent adversaries from using compromised credentials to modify system images by limiting their ability to log in.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1556.004 | Network Device Authentication |
Comments
Requiring multi-factor authentication on administrator accounts ensures that adversaries cannot rely on a single implanted or backdoor password to gain access to network devices without also satisfying an independent second factor.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1555.005 | Password Managers |
Comments
Inactive accounts may be targeted by attackers to gain unauthorized access. Disabling inactive accounts can prevent attackers from obtaining the user credentials from third-party password managers.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1098.005 | Device Registration |
Comments
Requiring multi-factor authentication (MFA) to register devices in Entra ID, configuring MFA systems to disallow enrolling new devices for inactive accounts, and using conditional access policies to restrict initial MFA device enrollment to trusted locations or devices reduces the success of adversary attempts to add additional devices to an adversary-controlled account.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1136.002 | Domain Account |
Comments
Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1136.001 | Local Account |
Comments
Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1136 | Create Account |
Comments
Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1199 | Trusted Relationship |
Comments
Using multi-factor authentication for administrative accounts reduces the success of adversaries breaching trusted third party relationships to compromise those networks and gain access to intended victims.
References
|
| CIS-6.4 | Require MFA for Remote Network Access | mitigates | T1021.004 | SSH |
Comments
Enabling multi-factor authentication for SSH connections helps minimize the adversary's ability to leverage stolen credentials.
References
|
| CIS-6.4 | Require MFA for Remote Network Access | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Enabling multi-factor authentication for remote logins helps minimize the adversary's ability to leverage stolen credentials.
References
|
| CIS-6.4 | Require MFA for Remote Network Access | mitigates | T1021 | Remote Services |
Comments
Enabling multi-factor authentication for remote service logons helps minimize the adversary's ability to leverage stolen credentials.
References
|
| CIS-6.4 | Require MFA for Remote Network Access | mitigates | T1133 | External Remote Services |
Comments
Enabling multi-factor authentication for external-facing remote service accounts to helps minimize the adversary's ability to leverage stolen credentials.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1114.002 | Remote Email Collection |
Comments
Enabling multi-factor authentication for public-facing webmail servers helps minimize the usefulness of email usernames and passwords collected by adversaries.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1114 | Email Collection |
Comments
Enabling multi-factor authentication for public-facing webmail servers helps minimize the usefulness of email usernames and passwords collected by adversaries.
References
|
| CIS-6.4 | Require MFA for Remote Network Access | mitigates | T1021.007 | Cloud Services |
Comments
Enabling multi-factor authentication on cloud services helps minimize the adversary's ability to leverage stolen credentials.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1110.003 | Password Spraying |
Comments
Enabling multi-factor authentication can prevent adversaries from gaining access through brute force password spraying attacks against authentication interfaces on externally facing services.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1110.002 | Password Cracking |
Comments
Enabling multi-factor authentication can prevent adversaries from gaining access through brute force password cracking attacks against authentication interfaces on externally facing services.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1110.001 | Password Guessing |
Comments
Enabling multi-factor authentication can prevent adversaries from gaining access through brute force password guessing attacks against authentication interfaces on externally facing services.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1110 | Brute Force |
Comments
Enabling multi-factor authentication can prevent adversaries from gaining access through brute force attacks against authentication interfaces on externally facing services.
References
|
| CIS-6.3 | Require MFA for Externally-Exposed Applications | mitigates | T1110.004 | Credential Stuffing |
Comments
Enabling multi-factor authentication can prevent adversaries from gaining access through brute force credential stuffing attacks against authentication interfaces on externally facing services.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Inactive accounts may be targeted by attackers to gain unauthorized access. Disabling inactive accounts can prevent attackers from acquiring credentials from web browsers.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1556.006 | Multi-Factor Authentication |
Comments
Removing accounts that are no longer needed helps to accounts that adversaries could abuse to disable or modify MFA and maintain persistent access.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078.004 | Cloud Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1078.001 | Default Accounts |
Comments
Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078.003 | Local Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.2 | Establish an Access Revoking Process | mitigates | T1078.002 | Domain Accounts |
Comments
Disabling accounts that are no longer needed immediately upon termination, rights revocation, or role change prevents adversaries from gaining and using those accounts.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1098.003 | Additional Cloud Roles |
Comments
Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to add additional roles or permissions to an adversary-controlled cloud account to maintain or elevate access.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1098.002 | Additional Email Delegate Permissions |
Comments
Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to grant additional permission levels to an adversary-controlled email account.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1098.001 | Additional Cloud Credentials |
Comments
Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to add adversary-owned credentials to a cloud account to maintain or elevate access.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1136.003 | Cloud Account |
Comments
Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1599.001 | Network Address Translation Traversal |
Comments
Using multi-factor authentication on accounts that administer network devices helps prevent adversaries from using compromised credentials to modify a network device’s Network Address Translation (NAT) configuration by limiting their ability to log in.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1566.001 | Spearphishing Attachment |
Comments
Email-server attachment scanning and sandboxing can identify, quarantine, or remove malicious attachments before they reach the recipient.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1204.002 | Malicious File |
Comments
Removing a malicious attachment before delivery prevents the user from opening the file and initiating its execution chain. The safeguard is limited to malicious files delivered through the protected email environment.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1203 | Exploitation for Client Execution |
Comments
Email sandboxing can detonate weaponized Office documents, PDFs, archives, and other attachments to identify exploit behavior before delivery.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1221 | Template Injection |
Comments
Email detonation chambers can open suspicious documents and observe attempts to retrieve or execute remote templates and payloads before the message reaches the recipient.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.012 | LNK Icon Smuggling |
Comments
Email scanning can identify suspicious LNK attachments and inspect icon-location or target fields that reference remote payloads.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1036.008 | Masquerade File Type |
Comments
Anti-malware scanners can compare file headers, MIME types, extensions, and content to detect attachments disguised as benign file formats.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1566 | Phishing |
Comments
Email-server anti-malware directly addresses malicious attachments.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1204 | User Execution |
Comments
Blocking malicious attachments prevents one major form of user execution.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027 | Obfuscated Files or Information |
Comments
Email anti-malware can use static, heuristic, and behavioral analysis to identify obfuscated files before delivery.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.002 | Software Packing |
Comments
Heuristic scanning and sandbox detonation can identify packed executables attached to messages, even when packing changes their static signature.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.006 | HTML Smuggling |
Comments
A sandbox capable of executing active HTML attachments may detect JavaScript that reconstructs and writes a malicious payload to disk.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.009 | Embedded Payloads |
Comments
Attachment scanners and sandboxes can identify malicious payloads hidden within documents, scripts, executables, or other carrier files.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.013 | Encrypted/Encoded File |
Comments
Anti-malware can identify encoded or high-entropy attachments and may block encrypted archives that cannot be inspected.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.015 | Compression |
Comments
Email anti-malware capable of recursively unpacking ZIP, RAR, 7z, self-extracting archives, and nested archives can identify malicious files before delivery.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1027.017 | SVG Smuggling |
Comments
A sandbox that renders SVG attachments and executes their embedded scripts may identify payload construction or malicious follow-on behavior.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1036 | Masquerading |
Comments
Anti-malware analysis can identify malicious attachments whose content, signature, or behavior conflicts with their apparent name or file type.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1036.007 | Double File Extension |
Comments
Email gateways can inspect the complete filename and actual file type rather than relying on the first visible extension, allowing attachments such as invoice.pdf.exe or report.pdf.lnk to be blocked.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1059.005 | Visual Basic |
Comments
Email anti-malware and sandboxing can analyze Visual Basic scripts and macro-enabled attachments and quarantine files that exhibit malicious behavior. This does not prevent Visual Basic abuse originating outside email.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1059 | Command and Scripting Interpreter |
Comments
Email anti-malware can block suspicious script attachments before they reach an interpreter. Most command and scripting activity occurs after compromise or through channels unrelated to email.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1059.001 | PowerShell |
Comments
Email scanning or sandboxing may identify PowerShell script attachments or documents that launch PowerShell.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1059.006 | Python |
Comments
Email anti-malware may quarantine malicious Python scripts or packed Python payloads sent specifically as email attachments. Python activity originating from installed tools or post-compromise execution remains unaffected.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1059.007 | JavaScript |
Comments
A sandbox may execute JavaScript, JScript, HTA, HTML, or SVG attachments and identify malicious file creation or process execution. Depends on the email security product supporting active-content detonation.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1176.001 | Browser Extensions |
Comments
Browser extension allowlists, denylists, installation restrictions, and removal of unauthorized extensions directly prevent malicious browser extensions from establishing persistence or abusing inherited browser permissions.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1137.006 | Add-ins |
Comments
Disabling unauthorized Outlook add-ins prevents those add-ins from automatically loading code when the email client starts. This directly reduces persistence through email-client add-on functionality.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1176 | Software Extensions |
Comments
This technique includes browser extensions, which are directly addressed by the safeguard.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1137 | Office Application Startup |
Comments
Restricting email-client add-ins mitigates the add-in portion of this parent technique.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1539 | Steal Web Session Cookie |
Comments
Malicious browser extensions may access browser cookies and session information. Restricting extensions removes one important cookie-theft path.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Malicious extensions may access credentials stored in browsers. Extension restrictions reduce that attack surface, but malware already executing with access to the browser profile may still extract stored credentials.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1189 | Drive-by Compromise |
Comments
Removing unnecessary or vulnerable browser plug-ins reduces components that a malicious website can enumerate and exploit during a drive-by attack.
References
|
| CIS-9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | mitigates | T1203 | Exploitation for Client Execution |
Comments
Uninstalling unnecessary browser or email-client plug-ins removes potential client-side exploitation targets.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1071.004 | DNS |
Comments
DNS filtering can prevent resolution of known malicious domains used for DNS-based command and control and can sinkhole requests before an endpoint reaches adversary infrastructure.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1189 | Drive-by Compromise |
Comments
Blocking known malicious or compromised domains prevents browsers from reaching websites used to exploit users or deliver malicious content.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1566.002 | Spearphishing Link |
Comments
DNS filtering can block the destination of a malicious link delivered through email before the user reaches a credential-harvesting page, exploit site, or malware download. Newly registered, compromised, or uncategorized domains may initially evade filtering.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1204.001 | Malicious Link |
Comments
Even when a user clicks a malicious link, DNS filtering can prevent successful navigation when the destination domain is known to be malicious.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1071 | Application Layer Protocol |
Comments
DNS filtering directly affects DNS and can also prevent connections to malicious domains used for web-based application-layer command and control.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1071.001 | Web Protocols |
Comments
DNS filtering can prevent HTTP, HTTPS, and WebSocket command-and-control connections when the destination domain has been classified as malicious.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
DNS and other domain-based destinations may be used as alternative exfiltration channels. DNS filtering only impedes implementations that depend on resolving a known malicious domain.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
DNS can carry encoded exfiltrated data over an unencrypted non-command-and-control protocol. Blocking resolution of an adversary-controlled domain can interrupt DNS-based exfiltration, although newly registered or uncategorized domains may initially be allowed.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1105 | Ingress Tool Transfer |
Comments
DNS filtering can prevent a compromised endpoint from resolving known malicious domains used to host tools or secondary payloads. Transfers over direct IP addresses, approved cloud services, compromised legitimate domains, or uncategorized domains may still succeed.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1566 | Phishing |
Comments
DNS filtering materially mitigates phishing that directs users to malicious domains. It does not mitigate phishing attachments, voice phishing, or messages that do not require visiting a domain.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1572 | Protocol Tunneling |
Comments
DNS filtering can block tunnels that depend on resolving known malicious domains, including some DNS and web-based tunnels. Tunnels using direct IP addresses, trusted domains, or infrastructure not yet classified as malicious may still succeed.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1568 | Dynamic Resolution |
Comments
DNS sinkholing and reputation-based filtering can prevent resolution of identified dynamic-DNS and generated domains used to reestablish command and control.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1568.002 | Domain Generation Algorithms |
Comments
DNS filtering services may block or sinkhole known and predicted algorithmically generated domains, for example those that have high entropy in the name.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
DNS filtering can block resolution of a known malicious exfiltration destination regardless of whether the transmitted data is encrypted.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Blocking a known malicious destination domain may interrupt an asymmetric encrypted exfiltration channel.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1212 | Exploitation for Credential Access |
Comments
Browsers and email clients are common targets for vulnerabilities. Requiring the latest vendor-supported versions directly reduces exposure to known client-software vulnerabilities.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
Browsers and email clients are common targets for vulnerabilities. Requiring the latest vendor-supported versions directly reduces exposure to known client-software vulnerabilities.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1211 | Exploitation for Stealth |
Comments
Browsers and email clients are common targets for vulnerabilities. Requiring the latest vendor-supported versions directly reduces exposure to known client-software vulnerabilities.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1189 | Drive-by Compromise |
Comments
Fully supported, current browsers contain vendor patches and modern security features that reduce successful exploitation when users visit compromised or malicious websites.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1203 | Exploitation for Client Execution |
Comments
Browsers and email clients are common targets for vulnerabilities that provide adversary code execution. Requiring the latest vendor-supported versions directly reduces exposure to known client-software vulnerabilities.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1137.003 | Outlook Forms |
Comments
Current Outlook versions include vendor changes that restrict or warn about custom Outlook forms that may otherwise be abused for persistence and execution. The safeguard ensures those security updates are present.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1137.004 | Outlook Home Page |
Comments
Microsoft updates removed or restricted the legacy Outlook Home Page functionality used for persistence. Preventing obsolete Outlook versions from executing directly prevents continued access to older vulnerable implementations.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1137.005 | Outlook Rules |
Comments
Vendor patches address Outlook mechanisms that adversaries may use to establish rule-triggered persistence or execution. Requiring current supported Outlook versions ensures the relevant security changes are applied.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1689 | Downgrade Attack |
Comments
Allowing only the latest supported browser and email-client versions prevents adversaries or users from running obsolete versions that lack current protections. This directly reduces downgrade opportunities involving older, weaker software versions.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1137 | Office Application Startup |
Comments
This is a partial mapping because several sub-techniques specifically abuse Outlook features addressed by vendor patches. Other Office startup methods involving templates, test keys, and general add-ins are outside the browser-and-email-client scope.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1176.001 | Browser Extensions |
Comments
Current browsers incorporate newer extension permission models, security controls, and protections against outdated installation methods. This does not prevent users or adversaries from installing an otherwise permitted malicious extension.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1539 | Steal Web Session Cookie |
Comments
Updating browsers reduces the likelihood that known vulnerabilities can be exploited to extract cookies from browser storage or memory. It does not prevent malware with sufficient local access from directly reading cookies or browser data.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Current browser versions reduce exploitation of known weaknesses that expose stored passwords and authentication data. Updating the browser does not prevent credential theft by malware already executing with access to the user's browser profile.
References
|
| CIS-9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | mitigates | T1176 | Software Extensions |
Comments
Keeping browsers current affects browser extensions.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1005 | Data from Local System |
Comments
A successful remote wipe removes enterprise files, local databases, cached content, and other managed data before an adversary with possession of the device can collect it.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1114.001 | Local Email Collection |
Comments
Wiping managed email applications and locally cached mailbox files can prevent collection of Outlook PST or OST files and other locally stored enterprise email.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1539 | Steal Web Session Cookie |
Comments
Wiping managed browsers and application data removes locally stored enterprise session cookies before they can be extracted from a lost or stolen device.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1552.001 | Credentials In Files |
Comments
Remote wipe can remove managed files containing passwords, API keys, connection strings, or other credential material. The mitigation is limited to files covered by the wipe and does not address credentials stored elsewhere.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1552.002 | Credentials in Registry |
Comments
A full Windows device wipe removes local Registry hives containing enterprise credential material before they can be searched or exported. A selective enterprise-data wipe may not remove operating-system Registry data.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1552.004 | Private Keys |
Comments
Wiping enterprise-managed key files, certificates, VPN profiles, and application containers can prevent private keys from being obtained from a lost device. Keys synchronized elsewhere or already exported remain exposed and should be revoked separately.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1555.001 | Keychain |
Comments
A full wipe of a managed macOS device removes locally stored Keychain databases and enterprise certificates. Items synchronized to other devices or already extracted are not revoked merely by wiping the device.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1555.003 | Credentials from Web Browsers |
Comments
Remote wipe of managed browser profiles can remove locally stored enterprise passwords and related authentication data. Browser-synchronized credentials and already extracted copies require separate account or server-side action.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1555.004 | Windows Credential Manager |
Comments
A full Windows wipe removes local Credential Manager vault files and associated enterprise credentials. Selective wipe implementations may not remove credentials stored outside managed application containers.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1552.003 | Shell History |
Comments
A full device wipe removes local shell-history files that may contain passwords, tokens, or sensitive commands. Selective enterprise wipes may not remove operating-system shell histories.
References
|
| CIS-4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | mitigates | T1555.005 | Password Managers |
Comments
Remote wipe can remove a managed password-manager application, its local vault, and cached decrypted data. Cloud-hosted vault contents remain available and require account revocation, device removal, or token invalidation.
References
|
| CIS-4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | mitigates | T1110.004 | Credential Stuffing |
Comments
Automatic device lockout limits the number of consecutive authentication attempts that can be made against a portable device, directly reducing the likelihood that repeated breached username password attempts will succeed.
References
|
| CIS-4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | mitigates | T1110.003 | Password Spraying |
Comments
Automatic device lockout limits the number of consecutive authentication attempts that can be made against a portable device, directly reducing the likelihood that repeated online password attempts will succeed.
References
|
| CIS-4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | mitigates | T1110.001 | Password Guessing |
Comments
Automatic device lockout limits the number of consecutive authentication attempts that can be made against a portable device, directly reducing the likelihood that repeated online password attempts will succeed.
References
|
| CIS-4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | mitigates | T1110 | Brute Force |
Comments
Automatic device lockout limits the number of consecutive authentication attempts that can be made against a portable device, directly reducing the likelihood that repeated online password attempts will succeed.
References
|
| CIS-4.9 | Configure Trusted DNS Servers on Enterprise Assets | mitigates | T1071.004 | DNS |
Comments
Directing DNS traffic through trusted enterprise resolvers can prevent systems from communicating directly with adversary-controlled DNS servers and can support blocking or sinkholing malicious DNS requests.
References
|
| CIS-4.9 | Configure Trusted DNS Servers on Enterprise Assets | mitigates | T1071 | Application Layer Protocol |
Comments
This is a partial mapping because DNS is one of the application-layer protocols covered by this technique. Configuring trusted DNS servers affects DNS-based command and control but does not mitigate web, mail, file-transfer, or publish-subscribe protocols.
References
|
| CIS-4.9 | Configure Trusted DNS Servers on Enterprise Assets | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Enforcing use of trusted DNS resolvers reduces the ability of enterprise assets to communicate directly with adversary-controlled DNS infrastructure for exfiltration. The mitigation applies only to implementations that use DNS or depend on unauthorized DNS servers.
References
|
| CIS-4.9 | Configure Trusted DNS Servers on Enterprise Assets | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
DNS can carry encoded exfiltrated data over an unencrypted non-command-and-control protocol. Routing requests through controlled resolvers provides an enforcement point for blocking unauthorized DNS servers, suspicious domains, or abnormal query activity.
References
|
| CIS-4.9 | Configure Trusted DNS Servers on Enterprise Assets | mitigates | T1572 | Protocol Tunneling |
Comments
DNS can be used to tunnel command-and-control traffic or other protocols. Enforcing trusted resolvers and preventing direct DNS communication can disrupt conventional DNS tunneling,
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021 | Remote Services |
Comments
Disabling unnecessary remote services eliminates the corresponding authentication and remote-access path, directly reducing lateral movement opportunities.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Disabling Remote Desktop Services where RDP is not operationally required prevents adversaries from connecting through that service.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Disabling unnecessary SMB file sharing and administrative shares directly removes common lateral movement, file-transfer, and remote-management paths.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.003 | Distributed Component Object Model |
Comments
Disabling DCOM when it is not required removes a remote RPC-based execution and management interface that adversaries may abuse.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.004 | SSH |
Comments
Disabling the SSH daemon or Remote Login on systems that do not require it eliminates an SSH-based remote-access path.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.005 | VNC |
Comments
Uninstalling unnecessary VNC server software removes the listener and prevents remote control through that implementation.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.006 | Windows Remote Management |
Comments
Disabling the WinRM service where it is unnecessary removes a remote command-execution and administration interface.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.008 | Direct Cloud VM Connections |
Comments
Disabling unnecessary cloud-native VM connection types, serial consoles, or direct management services eliminates those remote-administration paths.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1080 | Taint Shared Content |
Comments
Removing unnecessary shared folders and file-sharing services prevents adversaries from placing malicious content in those shares for other users or systems to execute.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1133 | External Remote Services |
Comments
Uninstalling or disabling unnecessary externally accessible VPN, remote desktop, SSH, and management services directly reduces external entry points.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Removing unused public-facing applications, services, and web modules eliminates exploitable listeners and reduces the externally exposed attack surface.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1210 | Exploitation of Remote Services |
Comments
A remote service that has been disabled or uninstalled can no longer be reached and exploited through its network interface.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1219 | Remote Access Tools |
Comments
Removing unauthorized or unnecessary remote-access products and disabling embedded remote-support functionality directly eliminates those access channels.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1219.002 | Remote Desktop Software |
Comments
Uninstalling unnecessary remote desktop products prevents adversaries from abusing that specific software for persistent or interactive access.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505 | Server Software Component |
Comments
Disabling unnecessary server extension mechanisms and components reduces the features adversaries can abuse to establish persistent server-side access.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505.003 | Web Shell |
Comments
Disabling unnecessary web server functionality, scripting engines, and dangerous application functions can prevent particular web shell implementations from executing.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505.004 | IIS Components |
Comments
Removing unused IIS modules, handlers, filters, and extensions directly reduces opportunities to install or abuse malicious IIS components.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1552.005 | Cloud Instance Metadata API |
Comments
Disabling unnecessary metadata services or insecure metadata-service versions directly prevents adversary access through those endpoints.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1602 | Data from Configuration Repository |
Comments
Removing unnecessary configuration-management protocols and repositories reduces the systems and services from which adversaries can collect configuration data.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Disabling SNMP where it is unnecessary removes the management service used to retrieve MIB and configuration information.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Removing unnecessary Telnet, HTTP management, TFTP, legacy SNMP, or similar configuration services reduces direct collection of network-device configurations.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1011 | Exfiltration Over Other Network Medium |
Comments
Disabling unnecessary Wi-Fi, cellular, modem, Bluetooth, or other secondary network services removes potential alternative exfiltration channels.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1011.001 | Exfiltration Over Bluetooth |
Comments
Disabling the Bluetooth service and adapter functionality where it is unnecessary prevents Bluetooth-based data transfer from that asset.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1021.007 | Cloud Services |
Comments
Disabling unnecessary cloud services, command-line integrations, and administrative applications reduces available cloud-management paths, although required web consoles may remain accessible.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1039 | Data from Network Shared Drive |
Comments
Removing unnecessary file-sharing services and shares reduces the network data repositories available for adversary collection.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1040 | Network Sniffing |
Comments
Removing unnecessary plaintext and broadcast-based services reduces sensitive service traffic available for interception, although it does not prevent sniffing of remaining traffic.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1047 | Windows Management Instrumentation |
Comments
Disabling unnecessary remote WMI and dependent management services reduces remote WMI execution, while local WMI functionality may remain available.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1059.008 | Network Device CLI |
Comments
Disabling unnecessary network-device command-line services, especially Telnet or direct CLI access, removes a command interface adversaries could abuse.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1072 | Software Deployment Tools |
Comments
Uninstalling unnecessary deployment agents and disabling unused remote-deployment functionality reduces the number of centralized execution mechanisms available to an adversary.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1090 | Proxy |
Comments
Removing unnecessary proxy, relay, port-forwarding, and tunneling services reduces the ability to turn an enterprise asset into a network intermediary.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1090.001 | Internal Proxy |
Comments
Disabling unnecessary internal proxy listeners, SSH forwarding, port proxies, and routing functions impedes the use of a compromised asset as an internal pivot.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1187 | Forced Authentication |
Comments
Disabling unnecessary SMB, WebClient, WebDAV, LLMNR, NBT-NS, and related services reduces mechanisms that can coerce outbound authentication.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1197 | BITS Jobs |
Comments
Disabling the Background Intelligent Transfer Service where it is genuinely unnecessary prevents adversary use of BITS for transfer, execution, or persistence.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1570 | Lateral Tool Transfer |
Comments
Removing unnecessary SMB, SSH, WinRM, file-sharing, and deployment services reduces common channels used to move tools between systems.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505.001 | SQL Stored Procedures |
Comments
Disabling unnecessary extended stored procedures, scripting extensions, or database execution features reduces opportunities to establish persistence through the database server.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505.002 | Transport Agent |
Comments
Removing unused mail transport agents and extension points reduces the components available for adversary persistence in messaging infrastructure.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505.005 | Terminal Services DLL |
Comments
Disabling unnecessary Terminal Services functionality reduces opportunities to replace or abuse associated DLL components, although required RDP systems remain exposed.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1505.006 | vSphere Installation Bundles |
Comments
Removing unnecessary vSphere Installation Bundles and disabling unused ESXi extension functionality reduces the components available for hypervisor persistence.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1609 | Container Administration Command |
Comments
Removing unnecessary container-management utilities, exposed APIs, and administrative services reduces the mechanisms available for remote container commands.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1611 | Escape to Host |
Comments
Minimal container images and removal of unnecessary tools, shells, runtimes, and privileged services reduce some prerequisites and post-exploitation options for container escape.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Disabling unnecessary remote services prevents sessions from being established through those services and therefore removes sessions that could later be hijacked.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1563.001 | SSH Hijacking |
Comments
Disabling unnecessary SSH and agent-forwarding functions removes some SSH sessions and forwarding sockets that adversaries could hijack.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1563.002 | RDP Hijacking |
Comments
Disabling unnecessary RDP services prevents creation of RDP sessions on those assets, eliminating that session-hijacking opportunity.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1649 | Steal or Forge Authentication Certificates |
Comments
Disabling unnecessary Active Directory Certificate Services web enrollment, enrollment agents, legacy authentication protocols, and certificate-service roles reduces certificate abuse paths.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1671 | Cloud Application Integration |
Comments
Disabling unnecessary SaaS integrations, plug-ins, application consent features, and service connections reduces the number of integrations an adversary can authorize or abuse.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1040 | Network Sniffing |
Comments
Replacing plaintext administrative protocols such as Telnet and HTTP with SSH and HTTPS prevents captured management traffic from directly exposing credentials, commands, and configuration data. Encryption does not prevent packet capture, but it materially reduces the value of the captured traffic.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1072 | Software Deployment Tools |
Comments
Safeguard 4.6 directly concerns securely managing software and configuration-management platforms, including tools integrated with CI/CD systems. Restricting administrative access and managing deployment configuration through controlled, versioned mechanisms reduces unauthorized use of these platforms for execution and lateral movement.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1210 | Exploitation of Remote Services |
Comments
Disabling obsolete management protocols and securely configuring required administrative services reduces the number of remotely reachable and vulnerable services. The safeguard does not patch vulnerabilities, but it directly removes insecure management paths that could be exploited.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1552.007 | Container API |
Comments
Disabling unauthenticated Docker and Kubernetes API access and requiring secured channels such as SSH or TLS directly reduces unauthorized access to container-management interfaces. This closely matches the safeguard's requirement to access administrative interfaces through secure protocols.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Authenticated encryption through SSH, HTTPS, and TLS limits an adversary's ability to read or alter administrative traffic even after obtaining a network interception position. Certificate and SSH host-key validation remain essential to the effectiveness of the mitigation.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1565.002 | Transmitted Data Manipulation |
Comments
SSH and HTTPS provide confidentiality and integrity protection for management commands and configuration data in transit. This makes undetected modification of administrative traffic substantially more difficult.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1602 | Data from Configuration Repository |
Comments
Secure management protocols, authenticated access, and controlled configuration repositories directly reduce unauthorized collection of device and infrastructure configuration. Version-controlled Infrastructure-as-Code can also reduce the need to retrieve configurations through insecure management interfaces.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Migrating from insecure SNMP versions to SNMPv3 with authentication and privacy protection directly reduces unauthorized MIB collection. Restricting management access to approved systems further limits successful enumeration.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Using SSH, HTTPS, SNMPv3, and securely managed configuration repositories reduces exposure of network-device configurations and embedded credentials. Insecure services such as Telnet, HTTP, TFTP, or legacy management protocols create substantially greater collection risk.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1609 | Container Administration Command |
Comments
Restricting Docker and Kubernetes administration to authenticated TLS, SSH, local sockets, or other secured management channels directly reduces unauthorized remote container commands. Version-controlled manifests and Infrastructure-as-Code also reduce unreviewed administrative changes.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1659 | Content Injection |
Comments
HTTPS and other authenticated encrypted protocols make it more difficult for an adversary positioned in the network path to inject malicious content into management downloads or administrative sessions. This is a direct benefit of prohibiting plaintext HTTP management.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1689 | Downgrade Attack |
Comments
This safeguard explicitly prohibits fallback to insecure protocols such as HTTP and Telnet. Enforcing HTTPS, modern TLS, SSH, and policies such as HSTS directly limits attempts to downgrade management communications to weaker or plaintext alternatives.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021 | Remote Services |
Comments
Securely managing which remote services are permitted and requiring authenticated encrypted protocols reduces exposed administrative paths. The safeguard does not independently prevent adversaries from using valid credentials through an approved service.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Secure RDP configuration, gateways, TLS, and restricted administrative access reduce interception and direct exposure. RDP remains usable by an adversary who possesses authorized credentials or an active session.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Secure management can disable unnecessary administrative shares and require modern SMB signing or encryption where remote administration is needed. It does not fully prevent abuse of an authorized SMB management path.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.003 | Distributed Component Object Model |
Comments
Securely managing DCOM availability and restricting it to approved administrative workflows reduces remote abuse. DCOM does not have a simple SSH or HTTPS replacement, so effectiveness depends on disabling or tightly constraining it.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.004 | SSH |
Comments
SSH protects administrative credentials and commands from plaintext interception and should replace Telnet. It does not prevent an adversary with valid credentials or an unauthorized SSH key from using the service.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.005 | VNC |
Comments
Secure management can prohibit unencrypted VNC deployments or require encrypted tunnels and approved administrative tooling. The relationship is partial because some VNC implementations or tunnels remain accessible with valid credentials.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.006 | Windows Remote Management |
Comments
Requiring WinRM over HTTPS rather than unencrypted HTTP protects management credentials and commands in transit. Authorized-account abuse remains possible through the secured channel.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.007 | Cloud Services |
Comments
Securing cloud administrative consoles and APIs, using controlled automation, and managing resources through version-controlled Infrastructure-as-Code reduces ad hoc and insecure administration. It does not prevent malicious activity performed through a compromised authorized cloud account.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1021.008 | Direct Cloud VM Connections |
Comments
Approved and securely configured cloud-native VM connection methods reduce exposure from direct or insecure management services. Cloud control-plane access may bypass the guest operating system's network controls, so identity and cloud policy protections are also required.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1059.008 | Network Device CLI |
Comments
Requiring SSH rather than Telnet protects command-line interface credentials and commands in transit and reduces interception or manipulation. Once an adversary has authorized administrative access, the encrypted CLI still permits malicious commands.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1133 | External Remote Services |
Comments
Requiring secure protocols and centrally managed administrative access reduces risk from externally accessible management services. Additional protections such as multi-factor authentication, gateways, and network restrictions remain necessary.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Administrative web interfaces should use HTTPS and should not be exposed through unnecessary plaintext or legacy services. HTTPS does not remediate an application vulnerability, so this mitigation primarily reduces unnecessary exposure and traffic manipulation.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1098.004 | SSH Authorized Keys |
Comments
Version-controlled SSH configuration and managed deployment of approved keys can prevent or identify unauthorized additions to authorized_keys. File permissions and privileged access controls are still needed to prevent local modification.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1213.003 | Code Repositories |
Comments
Infrastructure-as-Code repositories may reveal infrastructure topology, administrative endpoints, configuration, and embedded credentials. Secure repository administration and keeping secrets outside version control reduce the value and accessibility of these repositories.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1219 | Remote Access Tools |
Comments
Secure software management can limit administration to approved and securely configured remote-access products. The safeguard does not prevent an approved tool or account from being abused by an adversary.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1219.001 | IDE Tunneling |
Comments
Securely managing development tools can disable unnecessary tunneling functions and restrict approved remote-development services. Legitimate HTTPS or SSH development channels may still be abused.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1219.002 | Remote Desktop Software |
Comments
Organizations can centrally approve, configure, and secure remote-support software while removing unauthorized products. An adversary may still misuse an approved product or compromised support account.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1552.001 | Credentials In Files |
Comments
Infrastructure code, configuration files, deployment manifests, and automation scripts frequently create a risk of embedded passwords or tokens. Secure management should keep credentials out of source-controlled configuration and use protected secret stores or runtime injection.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1552.004 | Private Keys |
Comments
SSH administration depends on protecting private keys and preventing them from being embedded in repositories or widely distributed. Managed key storage, permissions, and rotation reduce the likelihood that stolen keys can be used for administration.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1610 | Deploy Container |
Comments
Requiring container deployments through approved, authenticated orchestration interfaces and version-controlled manifests reduces unauthorized container creation. A compromised orchestrator account or approved pipeline may still deploy a malicious container.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1612 | Build Image on Host |
Comments
Securing container-management APIs and restricting builds to controlled Infrastructure-as-Code or pipeline processes reduces unauthorized image construction on managed hosts. It does not prevent misuse by a compromised authorized build identity.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1651 | Cloud Administration Command |
Comments
Version-controlled Infrastructure-as-Code and controlled cloud-administration interfaces reduce unreviewed interactive commands and restrict administration to approved mechanisms. The technique remains possible through a compromised privileged cloud account.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1677 | Poisoned Pipeline Execution |
Comments
Version-controlled infrastructure and reviewed changes can prevent untrusted code or malicious Infrastructure-as-Code modifications from automatically reaching privileged deployment pipelines. Additional CI/CD isolation, branch protection, and secrets controls are required.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
SSH host-key validation, HTTPS certificate validation, SMB signing, and encrypted management channels reduce the ability to capture or relay administrative authentication. Disabling LLMNR, NBT-NS, and unnecessary SMB remains an important complementary control.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1557.002 | ARP Cache Poisoning |
Comments
An adversary may still redirect management traffic through ARP poisoning, but properly validated SSH and HTTPS sessions protect the confidentiality and integrity of that traffic. The safeguard does not prevent the underlying ARP manipulation.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1557.003 | DHCP Spoofing |
Comments
Secure protocols reduce credential theft and command manipulation even if DHCP spoofing redirects traffic. DHCP snooping and network-level controls are still required to prevent the spoofing behavior itself.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1565 | Data Manipulation |
Comments
Version-controlled configuration and authenticated encrypted management channels reduce unauthorized or undetected changes to enterprise configuration. The safeguard does not protect every type of business or application data.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1565.001 | Stored Data Manipulation |
Comments
Version-controlled Infrastructure-as-Code provides history, review, comparison, and restoration for managed configurations, reducing the persistence of unauthorized configuration changes. This applies only where the affected configuration is actually managed as code.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Securely configuring remote services can reduce unnecessary sessions and restrict features that facilitate hijacking. Encryption does not prevent an adversary already executing on a system from taking control of an existing session.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1563.001 | SSH Hijacking |
Comments
Disabling SSH agent forwarding and tightly managing SSH configuration reduces some hijacking paths. It does not prevent local theft or reuse of an established SSH socket or session.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1563.002 | RDP Hijacking |
Comments
Secure RDP gateways and restricted administration reduce access to RDP sessions. They do not prevent a locally privileged adversary from taking control of an existing session.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1090.001 | Internal Proxy |
Comments
Secure SSH configuration can disable unnecessary forwarding and proxy features, reducing the ability to turn a managed asset into a pivot.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1572 | Protocol Tunneling |
Comments
Securely configuring SSH, VPN, and administrative tools can disable unnecessary port forwarding and tunneling functions. The safeguard does not prevent tunneling through an otherwise approved secure protocol when that capability is operationally required.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1484 | Domain or Tenant Policy Modification |
Comments
Version-controlled domain or tenant configuration can make unauthorized policy changes visible and allow restoration to approved state. Many identity policies are still managed directly through consoles or APIs rather than Infrastructure-as-Code.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1484.001 | Group Policy Modification |
Comments
Managing Group Policy definitions through controlled configuration processes can identify or reverse unauthorized changes. Version control does not prevent direct modification by an account that retains write access to the policy.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1578 | Modify Cloud Compute Infrastructure |
Comments
Version-controlled Infrastructure-as-Code can define expected compute infrastructure and identify or reverse out-of-band changes. An adversary with sufficient cloud permissions may still modify resources directly.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1578.005 | Modify Cloud Compute Configurations |
Comments
Infrastructure-as-Code provides an approved baseline for quotas, instance settings, and compute configurations, allowing unauthorized drift to be identified or corrected.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021 | Remote Services |
Comments
A default-deny endpoint firewall directly restricts unsolicited remote-service connections and permits access only through explicitly approved services, ports, and management paths.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Restricting TCP 3389 to approved management sources directly prevents unauthorized RDP connections and reduces RDP-based lateral movement.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Blocking or tightly restricting TCP 445 and 139 directly impedes access to administrative shares and other SMB-based lateral movement paths.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.004 | SSH |
Comments
A default-deny firewall can block inbound SSH or restrict TCP 22 to approved management systems, directly limiting remote access to SSH-enabled end-user devices.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.005 | VNC |
Comments
VNC requires an accessible listener, commonly on TCP 5900 and related ports. Blocking those ports unless specifically authorized directly prevents unauthorized VNC access.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.006 | Windows Remote Management |
Comments
Restricting TCP 5985 and 5986 to approved systems directly limits adversary use of WinRM for remote administration and lateral movement.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1210 | Exploitation of Remote Services |
Comments
Exploiting a remote service requires network reachability to that service. Default-deny endpoint rules remove unnecessary exposure and can restrict necessary services to trusted source systems.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1571 | Non-Standard Port |
Comments
Default-deny rules directly block arbitrary and unexpected ports unless they have been explicitly approved, limiting adversary communications over non-standard ports.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.003 | Distributed Component Object Model |
Comments
A firewall can restrict DCOM by controlling RPC endpoint mapper traffic and dynamic RPC ports. The relationship is direct, but implementation is more complex than filtering a single fixed port.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Restrictive outbound rules can prevent an endpoint from using unapproved protocols and ports for data exfiltration. The technique remains possible over protocols the organization must allow.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
The firewall can block unapproved encrypted protocols, ports, or destinations used for exfiltration. It generally cannot identify malicious content inside an allowed encrypted connection.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Default-deny egress controls can prevent asymmetric encrypted sessions using unauthorized ports or services. Connections through an approved service may still succeed.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
Unapproved outbound services and ports used for cleartext exfiltration can be directly blocked. Effectiveness decreases when the adversary uses an operationally required protocol.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1071 | Application Layer Protocol |
Comments
Endpoint firewalls can restrict which application protocols and services may communicate externally. The mapping is partial because common application protocols may need to remain available.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1071.002 | File Transfer Protocols |
Comments
FTP, SFTP, FTPS, and related file-transfer traffic can be denied or limited to approved destinations. File transfer over a generally permitted web protocol may remain possible.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1071.003 | Mail Protocols |
Comments
SMTP, IMAP, and POP traffic can be restricted to authorized mail infrastructure, reducing adversary use of attacker-controlled mail services for command and control.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1071.004 | DNS |
Comments
The firewall can force devices to use approved DNS resolvers and block direct DNS traffic to external systems. It does not by itself identify malicious data embedded in DNS traffic sent through an approved resolver.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1071.005 | Publish/Subscribe Protocols |
Comments
Default-deny policies can block MQTT and other publish/subscribe services unless they are explicitly required. An approved publish/subscribe service could still be misused.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1090.001 | Internal Proxy |
Comments
Restricting inbound listeners and lateral outbound connections makes it more difficult for a compromised endpoint to act as an unauthorized proxy for other systems.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1095 | Non-Application Layer Protocol |
Comments
A host firewall can deny unnecessary ICMP, GRE, raw IP, and other non-application protocols that adversaries may use for command and control.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1105 | Ingress Tool Transfer |
Comments
Default-deny egress policies can prevent compromised endpoints from retrieving payloads from unapproved systems, ports, or protocols. Transfers from an approved destination remain possible.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1187 | Forced Authentication |
Comments
Blocking outbound SMB, NetBIOS, and unnecessary WebDAV traffic prevents many attempts to coerce an endpoint into authenticating to an attacker-controlled system. WebDAV over permitted web ports may require application-aware filtering.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1205 | Traffic Signaling |
Comments
Stateful default-deny firewalls can block unsolicited signaling traffic and the resulting unauthorized connections for some implementations of this technique. Effectiveness depends on the signaling mechanism.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1205.001 | Port Knocking |
Comments
A managed firewall can prevent unauthorized knock sequences from opening services and can preserve the default-deny state. The relationship becomes weaker if malware has already obtained privileges to modify firewall rules.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1219 | Remote Access Tools |
Comments
Application-aware or destination-restricted firewall policies can block communications to unauthorized remote-access services. Tools communicating through generally permitted HTTPS may bypass basic port filtering.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1219.002 | Remote Desktop Software |
Comments
The firewall can block application traffic, service endpoints, or dedicated ports associated with unauthorized remote-desktop products. Effectiveness depends on whether the product uses an otherwise permitted web connection.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Blocking unnecessary local-link, legacy name-resolution, and file-sharing protocols reduces the network conditions available for several adversary-in-the-middle behaviors. Other sub-techniques require switch or network-infrastructure protections.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
Blocking LLMNR, NBT-NS, mDNS, NetBIOS, and unnecessary SMB traffic reduces poisoning and relay opportunities involving end-user devices. Disabling the protocols and enforcing SMB signing remain stronger complementary mitigations.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1570 | Lateral Tool Transfer |
Comments
Restricting SMB, WinRM, SSH, VNC, and other peer-to-peer services impedes common channels used to transfer adversary tools between endpoints.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1572 | Protocol Tunneling |
Comments
Limiting approved ports, protocols, services, and destinations can prevent many unauthorized tunnels. Tunnels encapsulated within an approved HTTPS, DNS, or SSH connection may still succeed.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1071.001 | Web Protocols |
Comments
Destination-aware or application-aware firewall restrictions can disrupt web-based command and control, but basic port filtering cannot distinguish malicious traffic from legitimate browsing.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1090 | Proxy |
Comments
Blocking known proxy infrastructure and unauthorized listeners can disrupt some proxy usage. Proxies operating through approved web services or destinations may remain accessible.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1090.002 | External Proxy |
Comments
Firewall egress restrictions can block known or unauthorized external proxy destinations. External proxies commonly operate over permitted HTTP or HTTPS, limiting basic port-filtering effectiveness.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1090.003 | Multi-hop Proxy |
Comments
Destination filtering may prevent access to identified anonymity or command-and-control infrastructure.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1133 | External Remote Services |
Comments
Host firewall map help when an external remote service terminates directly on the end-user device. Many VPN, VDI, and access-gateway implementations terminate on centralized infrastructure outside the endpoint firewall's control.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1197 | BITS Jobs |
Comments
Process-aware firewall rules may restrict BITS to approved destinations. The firewall does not prevent local creation or execution of a BITS job and may not distinguish BITS traffic over allowed web ports.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1205.002 | Socket Filters |
Comments
Stateful firewall may block the triggering traffic or resulting connection. Socket filters may observe raw traffic or reuse an already permitted protocol, limiting the safeguard's effectiveness.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1218.012 | Verclsid |
Comments
Process-aware host firewall can prevent verclsid.exe from making outbound connections which is part of the outcomes of this technique. But it does not prevent the local signed-binary proxy-execution behavior that defines the technique.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1219.001 | IDE Tunneling |
Comments
Firewall policy can block unapproved IDE-tunneling services or destinations. Developer endpoints may legitimately require the same HTTPS or SSH channels, reducing the usefulness of simple port filtering.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1499 | Endpoint Denial of Service |
Comments
Host firewall can discard traffic targeting blocked ports, protocols, or identified hostile sources, reducing malicious traffic processed by the endpoint.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1499.001 | OS Exhaustion Flood |
Comments
Dropping unwanted inbound traffic through dynamic host based firewalls may reduce some operating-system resource floods.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1499.002 | Service Exhaustion Flood |
Comments
The firewall can block floods against services that do not need to be exposed or restrict permitted sources.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1499.003 | Application Exhaustion Flood |
Comments
Application-aware or source-restricted firewall rules may reduce hostile requests reaching an exposed endpoint application. Basic port filtering cannot distinguish an exhaustion attack from legitimate requests to an explicitly allowed application service.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Destination-aware egress rules may block connections to unauthorized cloud environments. Basic port filtering cannot determine which cloud account owns an HTTPS destination, and some transfers occur entirely within the cloud.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Blocking unnecessary remote-service connectivity reduces the opportunity to reach a session that could be hijacked.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1563.001 | SSH Hijacking |
Comments
Restricting SSH reachability reduces remote paths to SSH sessions.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1563.002 | RDP Hijacking |
Comments
Restricting RDP to approved sources limits remote access to sessions.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.007 | Cloud Services |
Comments
Destination-aware or application-aware endpoint firewall can restrict access to unauthorized cloud consoles, APIs, and command-line management endpoints.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1021.008 | Direct Cloud VM Connections |
Comments
Endpoint egress rules can prevent a compromised end-user device from reaching cloud-native VM connection services, APIs, or management endpoints. Cloud-native console access targets the cloud control plane and may not traverse the destination VM's host firewall.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1102 | Web Service |
Comments
An application-aware or destination-restricted endpoint firewall can block unauthorized web, cloud, file-sharing, or social-media services used for command and control.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1102.001 | Dead Drop Resolver |
Comments
A firewall that restricts outbound applications or destinations can prevent malware from contacting unauthorized web services used to retrieve secondary command-and-control addresses.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1102.002 | Bidirectional Communication |
Comments
Blocking unauthorized web-service destinations or preventing unapproved processes from accessing the network can disrupt bidirectional command-and-control communications.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1102.003 | One-Way Communication |
Comments
Endpoint firewall policy can prevent malware from sending data or retrieving instructions through unauthorized web services. One-way traffic to an approved and commonly used service may be difficult to distinguish from legitimate activity through basic port filtering.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1498 | Network Denial of Service |
Comments
A host firewall can discard traffic targeting blocked ports, protocols, or identified hostile sources, reducing the amount of malicious traffic processed by the endpoint.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1498.001 | Direct Network Flood |
Comments
A host firewall rules can block unnecessary protocols, targeted ports, or known attacking sources and may reduce endpoint resource consumption during smaller floods. High-volume floods normally require upstream filtering because traffic may saturate the connection before reaching the device.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1498.002 | Reflection Amplification |
Comments
A host firewall can drop unsolicited reflected traffic and deny unnecessary UDP protocols used in amplification attacks. It cannot recover bandwidth already consumed by the reflected traffic, and spoofed or distributed sources reduce source-based filtering effectiveness.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021.002 | SMB/Windows Admin Shares |
Comments
Blocking inbound SMB (TCP 445/139) is a primary server firewall function and directly reduces lateral movement via administrative shares.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Restricting TCP 3389 to authorized management hosts directly limits unauthorized RDP access to servers.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021 | Remote Services |
Comments
A default-deny host firewall directly restricts inbound remote service access to servers, reducing opportunities for remote administration and lateral movement.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021.003 | Distributed Component Object Model |
Comments
DCOM relies on RPC communications that can be restricted through host firewall rules, limiting remote DCOM access to authorized systems. Dynamic RPC ports make the effectiveness dependent on careful firewall configuration.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021.004 | SSH |
Comments
A default-deny server firewall can directly restrict inbound SSH, normally TCP 22, to approved management systems. This reduces unauthorized remote administration and lateral movement against Linux, macOS, and other SSH-enabled servers.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021.005 | VNC |
Comments
A server firewall prevents unauthorized inbound VNC connections unless the relevant service and source systems are explicitly permitted.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1021.006 | Windows Remote Management |
Comments
Restricting WinRM ports, commonly TCP 5985 and 5986, to approved administrative systems directly limits unauthorized remote management of servers.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
When outbound filtering is configured, a server firewall can block unauthorized protocols used to exfiltrate data. Effectiveness depends on whether egress rules are enforced rather than allowing unrestricted outbound traffic.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
Outbound firewall restrictions can block unapproved encrypted non-C2 protocols or destinations used for exfiltration. The control is less effective when the traffic uses an explicitly permitted protocol and destination.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
A managed egress policy can prevent servers from establishing unapproved asymmetric encrypted connections used to transfer data. This mitigation depends on restrictive outbound rules and destination controls.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
A host firewall can block unauthorized outbound protocols and ports used for unencrypted data exfiltration. Exfiltration over an explicitly permitted service may remain possible.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1071 | Application Layer Protocol |
Comments
Application-aware or restrictive outbound firewall rules can limit unauthorized HTTP, HTTPS, DNS, SMTP, and other application-layer communications used for command and control. A basic port-only policy provides limited protection when adversaries use permitted protocols.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1090 | Proxy |
Comments
Restricting outbound server connections can prevent malware from reaching unauthorized proxy infrastructure or accepting proxy traffic on unapproved ports. Proxy activity over approved channels may still succeed.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1095 | Non-Application Layer Protocol |
Comments
Host firewalls can restrict raw IP, ICMP, GRE, and other non-application-layer protocols used for command and control. The mitigation depends on denying protocols that the server does not explicitly require.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1105 | Ingress Tool Transfer |
Comments
Restrictive outbound firewall rules can prevent a compromised server from downloading tools or payloads from unapproved external systems. The mapping is partial because transfers over approved destinations and protocols may still be possible.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1133 | External Remote Services |
Comments
A default-deny host firewall reduces the exposure of externally accessible remote services by permitting only explicitly authorized ports, protocols, and source systems.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1190 | Exploit Public-Facing Application |
Comments
A host firewall cannot remove vulnerabilities in a public-facing application, but it can ensure that only intended application ports are reachable and restrict access by source where operationally feasible. This reduces unnecessary exposure and possible exploitation paths.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1205.001 | Port Knocking |
Comments
Port knocking relies on specific traffic patterns that cause a firewall or related mechanism to expose a service port. Managed default-deny rules and monitoring of unauthorized firewall changes can restrict the trigger traffic and prevent unapproved ports from being opened.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1210 | Exploitation of Remote Services |
Comments
Exploitation of a remote service requires network reachability to the vulnerable service. A default-deny server firewall reduces the number of reachable services and limits access to authorized source systems.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1219 | Remote Access Tools |
Comments
Host firewall rules can block inbound or outbound communications associated with unauthorized remote access software. The firewall does not prevent the software from being installed or executed when it communicates over an allowed channel.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Egress filtering can restrict server connections to unauthorized cloud services or accounts, making cloud-based data transfer more difficult. The mitigation depends on destination-aware outbound controls.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
Blocking unnecessary LLMNR, NBT-NS, mDNS, NetBIOS, and SMB traffic can reduce name-resolution poisoning and relay opportunities involving servers. Disabling the protocols and enforcing SMB signing remain stronger primary mitigations.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1557.002 | ARP Cache Poisoning |
Comments
A host firewall may restrict follow-on connections created through ARP poisoning, but it has limited ability to prevent manipulation of Layer 2 address resolution itself. This is therefore a weak and environment-dependent mitigation.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1557.003 | DHCP Spoofing |
Comments
A host firewall may limit some follow-on communications after a malicious DHCP configuration is accepted, but it does not directly prevent DHCP spoofing. Network access controls and DHCP protections are the primary mitigations.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1570 | Lateral Tool Transfer |
Comments
Lateral tool transfers often rely on SMB, WinRM, SSH, or other network services that are directly governed by server firewall rules. Restricting those services to approved systems impedes common transfer channels.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1571 | Non-Standard Port |
Comments
A default-deny firewall blocks communication over arbitrary or non-standard ports unless they are explicitly permitted, directly limiting adversary use of unexpected ports.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1572 | Protocol Tunneling |
Comments
Restricting permitted ports, protocols, and destinations can impede protocol tunneling from compromised servers. Tunnels carried inside an explicitly allowed protocol may still bypass simple port-based filtering.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Blocking unnecessary SNMP traffic and restricting authorized SNMP sources reduces the ability to query management information from servers or server-hosted management services. The applicability depends on whether the server exposes SNMP.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1686 | Disable or Modify System Firewall |
Comments
Adversaries may disable or alter host firewall configurations to expose services or enable unrestricted network communication, directly undermining the safeguard. Implementing and actively managing the firewall establishes the required configuration and supports identifying or correcting unauthorized changes.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1686.001 | Cloud Firewall |
Comments
This sub-technique concerns changes to cloud firewall rules or security groups rather than a host-based firewall installed on a server. The relationship to Safeguard 4.4 is therefore indirect and primarily relevant where server firewall management also encompasses associated cloud firewall controls.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1686.002 | Network Device Firewall |
Comments
This sub-technique targets firewalls implemented on network infrastructure rather than host-based firewalls on servers. Its relationship to Safeguard 4.4 is weak and applies only where the server firewall management process also governs supporting network firewall policy.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1686.003 | Windows Host Firewall |
Comments
This sub-technique explicitly covers disabling or modifying the Windows host firewall, including changing profiles or rules to expose services or permit command-and-control traffic. Implementing and managing the required firewall configuration helps identify, prevent, or reverse unauthorized changes.
References
|
| CIS-4.7 | Manage Default Accounts on Enterprise Assets and Software | mitigates | T1586.003 | Cloud Accounts |
Comments
Default accounts are defined as built-in or factory/provider-set accounts across systems, software, and devices. Managing, changing default passwords, disabling state accounts, or otherwise hardening them through additional mechanisms directly constrains an adversary's abuse of the valid account technique.
References
|
| CIS-4.7 | Manage Default Accounts on Enterprise Assets and Software | mitigates | T1078.003 | Local Accounts |
Comments
Default accounts are defined as built-in or factory/provider-set accounts across systems, software, and devices. Managing, changing default passwords, disabling state accounts, or otherwise hardening them through additional mechanisms directly constrains an adversary's abuse of the valid account technique.
References
|
| CIS-4.7 | Manage Default Accounts on Enterprise Assets and Software | mitigates | T1078.002 | Domain Accounts |
Comments
Default accounts are defined as built-in or factory/provider-set accounts across systems, software, and devices. Managing, changing default passwords, disabling state accounts, or otherwise hardening them through additional mechanisms directly constrains an adversary's abuse of the valid account technique.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1667 | Email Bombing |
Comments
ATT&CK explicitly discusses DMARC, SPF, and DKIM on the Email bombing technique page, including how enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation to mitigate this technique.
References
|
| CIS-4.7 | Manage Default Accounts on Enterprise Assets and Software | mitigates | T1078.001 | Default Accounts |
Comments
Default accounts are defined as built-in or factory/provider-set accounts across systems, software, and devices. Managing, changing default passwords, disabling state accounts, or otherwise hardening them through additional mechanisms directly constrains an adversary's abuse of the valid account technique.
References
|
| CIS-4.7 | Manage Default Accounts on Enterprise Assets and Software | mitigates | T1078 | Valid Accounts |
Comments
Default accounts are defined as built-in or factory/provider-set accounts across systems, software, and devices. Managing, changing default passwords, disabling state accounts, or otherwise hardening them through additional mechanisms directly constrains an adversary's abuse of the valid account technique.
References
|
| CIS-4.3 | Configure Automatic Session Locking on Enterprise Assets | mitigates | T1078 | Valid Accounts |
Comments
The safeguard forces a renewed authentication checkpoint after inactivity and therefore reduces any possibility of opportunistic use of a still-authenticated user on an open unlocked enterprise asset.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1566.002 | Spearphishing Link |
Comments
DMARC may materially reduces phishing campaigns that rely on spoofed or unauthenticated sender domains. DMARC may reduce link-led spearphishing at the sender-authentication and mail acceptance time. It does not inspect the attachment itself though.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1566.001 | Spearphishing Attachment |
Comments
DMARC may materially reduces phishing campaigns that rely on spoofed or unauthenticated sender domains. DMARC may reduce attachment-led spearphishing when the campaign depends on spoofed sender trust and domain authentication failure. It does not inspect the attachment itself though.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1566 | Phishing |
Comments
DMARC may materially reduces phishing campaigns that rely on spoofed or unauthenticated sender domains.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1684 | Social Engineering |
Comments
Social engineering is broadly defined as influencing users into actions while minimizing technical indicators, DMARC can be a meaningful control against the email-spoofing branch of this broader technique.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1684.001 | Impersonation |
Comments
DMARC may not stop all impersonation, but it reduces a major subset where trust is created through control of the visible sender identity and aligned sending domain.
References
|
| CIS-9.5 | Implement DMARC | mitigates | T1684.002 | Email Spoofing |
Comments
ATT&CK explicitly discusses DMARC, SPF, and DKIM on the Email Spoofing technique page, including how weak or absent DMARC leaves spoofed messages deliverable and how DMARC-enabled filtering mitigates the behavior
References
|
| CIS-5.3 | Disable Dormant Accounts | mitigates | T1078.001 | Default Accounts |
Comments
Disabling stale accounts removes valid authentication paths available to adversaries.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1041 | Exfiltration Over C2 Channel |
Comments
This technique may be mitigated depending on where ingress and egress is tightly controlled. For example, the use network signatures such as IP addresses or domain names to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1205.002 | Socket Filters |
Comments
ATT&CK mentions that the mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1552.005 | Cloud Instance Metadata API |
Comments
ATT&CK mentions to limit access to the Instance Metadata API using a host-based firewall such as iptables. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1218.012 | Verclsid |
Comments
Consider modifying host firewall rules to prevent egress traffic from verclsid.exe.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1090.003 | Multi-hop Proxy |
Comments
This technique may be lessened or mitigated though the use of firewall policy that constrains relay and redirect paths.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1197 | BITS Jobs |
Comments
Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1205 | Traffic Signaling |
Comments
ATT&CK mentions that the mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1071.001 | Web Protocols |
Comments
Adversaries use web protocols to blend with normal traffic. A server firewall can partially restrict which destinations, ports, and web services a server may contact, though it will not stop all HTTP/S abuse.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1563.002 | RDP Hijacking |
Comments
Adversaries leverage RDP if it is reachable. Firewall rules are among the most direct ways to prevent unauthorized RDP reachability to servers.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1553.005 | Mark-of-the-Web Bypass |
Comments
Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads. The execution prevention mitigation mentions the use of blocking container file types at web and/or email gateways which could apply to the implementation of this safeguard.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1059.005 | Visual Basic |
Comments
Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into spearphishing Attachment payloads. If .VB objects are blocked at the email boundary then it can mitigate the spearphishing delivery of this technique.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1218.001 | Compiled HTML File |
Comments
A custom CHM file containing embedded payloads could be delivered to a victim through email then triggered by User Execution If those custom CHM files are blocked at the email boundary, then it can mitigate the delivery of this technique.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1137.006 | Add-ins |
Comments
dversaries often weaponize Office add-ins (e.g., Excel .xll files or Outlook .wll / .ecf extensions) by sending them via phishing campaigns. Blocking these file types at the email boundary prevents the initial execution and subsequent installation of malicious persistence mechanisms.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1027.009 | Embedded Payloads |
Comments
File blocking mitigates embedded payloads by completely stripping high-risk file types at the perimeter, denying attackers the ability to deliver the initial malicious file or its nested, obfuscated components. Attackers frequently embed malicious scripts (e.g., .js, .vbs) inside legitimate document formats (e.g., PDFs, Word docs). By blocking macro-enabled or script-based file types, gateways prevent these malicious combinations from ever reaching the user's inbox
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1027.012 | LNK Icon Smuggling |
Comments
LNK files are used as phishing payloads and when a user invokes them they can download or execute additional payloads. If .lnk objects are blocked at the email boundary then it can mitigate the delivery of this technique.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1027.006 | HTML Smuggling |
Comments
For this technique, adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. If the implementation for 9.3 can mitigate this technique if it disallows .html, .htm, .hta, and similar active content files as email attachments on the block list.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1027.015 | Compression |
Comments
9.6 can prevent this type of technique if it blocks RAR, 7z, and other known unauthorized self-extracting archive types from specific machines.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1204.002 | Malicious File |
Comments
9.6 enforcement can reduce user exposure by removing risky files upstream at the point of email delivery.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1204 | User Execution |
Comments
9.6 enforcement can reduce user exposure by removing risky files upstream at the point of email delivery.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1566.001 | Spearphishing Attachment |
Comments
9.6 is a preventive email-gateway control that blocks disallowed attachment types before delivery.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1566 | Phishing |
Comments
9.6 is a preventive email-gateway control that blocks disallowed attachment types before delivery.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1070.009 | Clear Persistence |
Comments
This sub-technique removes scheduled tasks or registry keys after use. Retaining system modification logs according to enterprise timelines ensures the lifecycle of the persistence mechanism remains fully reviewable.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1070.008 | Clear Mailbox Data |
Comments
This sub-technique permanently purges emails to hide phishing or exfiltration. CIS 3.4 requires a minimum retention window for email archives, blocking adversaries from destroying corporate messaging records.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1070.007 | Clear Network Connection History and Configurations |
Comments
This sub-technique wipes local network state data and active connection logs. Enforcing retention timelines on network telemetry ensures lateral movement records survive local configuration resets.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1070.003 | Clear Command History |
Comments
This sub-technique purges terminal histories like .bash_history or PowerShell logs. Data retention policies mandate logging shell commands directly to a central repository, preserving the operational history despite local terminal purges.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1685.005 | Clear Windows Event Logs |
Comments
This technique targets local Windows security and system event logs. Enforcing a minimum retention timeline ensures Windows event data is moved off-host and preserved, defeating local log-clearing attempts.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1685.006 | Clear Linux or Mac System Logs |
Comments
This technique deletes critical Unix artifacts like /var/log system logs. Documented retention processes guarantee that Unix system trails are streamed to a repository where minimum storage timelines are strictly enforced.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1070 | Indicator Removal |
Comments
This overarching technique covers deleting artifacts across an environment. CIS 3.4 protects the evidence chain by establishing mandatory retention periods that an attacker cannot alter or shorten.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1485 | Data Destruction |
Comments
Retention is protective because it limits the time window in which valuable data remains available for destruction, tampering, or cleanup by an attacker. Data retention policies protect against adversaries deleting logs by mandating strict storage lifecycles, off-site replication, and immutability.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1552 | Unsecured Credentials |
Comments
Credentials and authentication material are often stored within files, databases, configuration repositories, and application data stores. Encrypting sensitive data at rest reduces the usefulness of credential artifacts obtained from protected storage locations by preventing direct access to plaintext credential material.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1110.004 | Credential Stuffing |
Comments
This directly counters password overlap from breached credentials reused across personal, third-party, and enterprise accounts.
References
|
| CIS-5.2 | Use Unique Passwords | mitigates | T1078.004 | Cloud Accounts |
Comments
Unique passwords reduce cloud/SaaS credential overlap and lateral reuse risk
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1546.013 | PowerShell Profile |
Comments
PowerShell profile persistence relies on executing a script at interpreter startup. Script allowlisting prevents unauthorized profile scripts from executing.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1216 | System Script Proxy Execution |
Comments
If script payload execution is enforced regardless of invoking binary, proxy-based script execution is reduced.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1137.001 | Office Template Macros |
Comments
Macro scripts blocked if script enforcement applies to macro execution policies.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1037 | Boot or Logon Initialization Scripts |
Comments
Startup scripts not on the allowlist cannot execute, disrupting persistence.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.007 | JavaScript |
Comments
Script enforcement blocks execution of non-authorized JavaScript files invoked via host interpreters.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.006 | Python |
Comments
Unauthorized Python scripts are blocked when interpreter policies enforce script validation.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.005 | Visual Basic |
Comments
Malicious VB scripts/macros are prevented if not allowlisted.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.004 | Unix Shell |
Comments
Unauthorized shell scripts fail execution when enforced through script hash/signature/path validation.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.003 | Windows Command Shell |
Comments
Non-authorized batch or shell scripts are blocked.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.002 | AppleScript |
Comments
Script allowlisting prevents execution of unauthorized AppleScript files under enforced script validation policies.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.001 | PowerShell |
Comments
Unauthorized PowerShell scripts fail execution under enforced script allowlisting.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1546.010 | AppInit DLLs |
Comments
Prevents unauthorized AppInit DLL persistence where load control is enforced.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1546.009 | AppCert DLLs |
Comments
Unauthorized persistence DLLs cannot load if restricted by library allowlisting.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1574.006 | Dynamic Linker Hijacking |
Comments
Enforced library validation prevents execution of malicious shared objects via linker abuse.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1574.012 | COR_PROFILER |
Comments
COR_PROFILER abuse requires loading a malicious profiling DLL. Library enforcement prevents unauthorized profiler DLLs from loading into .NET processes.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1547.005 | Security Support Provider |
Comments
SSP persistence requires loading a malicious authentication DLL. Load validation blocks unauthorized SSP modules from being loaded into LSASS.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1547.004 | Winlogon Helper DLL |
Comments
Winlogon helper persistence relies on loading an unauthorized DLL. Library allowlisting prevents loading of non-authorized modules, directly disrupting this persistence method.
References
|
| CIS-2.6 | Allowlist Authorized Libraries | mitigates | T1574.001 | DLL |
Comments
Unauthorized DLLs fail to load if not on the allowlist, directly mitigating search order hijacking. Side-loaded malicious libraries are blocked when load validation is enforced.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1105 | Ingress Tool Transfer |
Comments
Transferred malware payloads cannot execute if not explicitly authorized. Control reduces operational effectiveness post-transfer.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1543 | Create or Modify System Process |
Comments
Services relying on non-allowlisted binaries will fail to execute.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1219 | Remote Access Tools |
Comments
Application allowlisting prevents execution of unauthorized remote access tools (e.g., AnyDesk, TeamViewer, custom RATs). If not explicitly authorized, these binaries cannot execute, directly reducing adversary persistence and command-and-control capability.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1218 | System Binary Proxy Execution |
Comments
If policy restricts execution to explicitly authorized binaries, unauthorized or abused proxy binaries may be prevented from executing.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1059 | Command and Scripting Interpreter |
Comments
If interpreters themselves are restricted or constrained by allowlisting, adversary-launched unauthorized interpreter binaries are blocked.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1204.002 | Malicious File |
Comments
Malicious binaries fail execution if not on the allowlist.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1204 | User Execution |
Comments
Non-allowlisted executables cannot run, directly preventing execution of malicious binaries delivered via user interaction.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1547 | Boot or Logon Autostart Execution |
Comments
If unauthorized startup software is identified and removed, persistence via installed startup components is disrupted.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1543.003 | Windows Service |
Comments
Removal of unauthorized service binaries prevents continued execution of adversary-installed services.
References
|
| CIS-2.3 | Address Unauthorized Software | mitigates | T1543 | Create or Modify System Process |
Comments
Automated detection and removal of unauthorized installed services can directly disrupt adversary-created system services used for persistence. Enforcement reduces persistence reliability.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1530 | Data from Cloud Storage |
Comments
Secure disposal reduces sensitive data retained in cloud object storage, lowering the value of compromised storage access
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1552 | Unsecured Credentials |
Comments
This applies when secure disposal explicitly removes old credential files, keys, exports, secrets, or configuration files that could expose credentials.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1213 | Data from Information Repositories |
Comments
Secure disposal reduces stale sensitive records in repositories such as document stores, collaboration platforms, or knowledge bases.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1039 | Data from Network Shared Drive |
Comments
Secure disposal reduces obsolete or unnecessary sensitive data left on shared drives, limiting what an adversary can collect from network shares.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1005 | Data from Local System |
Comments
Secure disposal reduces residual sensitive files on endpoints and servers that an adversary could later collect from local storage.
References
|
| CIS-3.12 | Segment Data Processing and Storage Based on Sensitivity | mitigates | T1530 | Data from Cloud Storage |
Comments
Segregated cloud environments reduce exposure of sensitive cloud storage resources.
References
|
| CIS-3.12 | Segment Data Processing and Storage Based on Sensitivity | mitigates | T1021 | Remote Services |
Comments
Segmentation directly limits attacker movement between remote-accessible systems and sensitive environments.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1070 | Indicator Removal |
Comments
Data Retention restricts, hardens against, or increases visibility into the adversary behavior.
References
|
| CIS-3.4 | Enforce Data Retention | mitigates | T1485 | Data Destruction |
Comments
Retention is protective because it limits the time window in which valuable data remains available for destruction, tampering, or cleanup by an attacker.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions commonly inspect and restrict uploads to external cloud services.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP inspection capabilities may identify sensitive-data transfer across non-standard protocols.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1567 | Exfiltration Over Web Service |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Web upload monitoring and restriction are core DLP use cases.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1052.001 | Exfiltration over USB |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Device-control and removable-media DLP policies directly target USB-based exfiltration.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1041 | Exfiltration Over C2 Channel |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions explicitly monitor and restrict unauthorized outbound transfer of sensitive data.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1039 | Data from Network Shared Drive |
Comments
Encryption protects sensitive shared-drive data against unauthorized disclosure
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1530 | Data from Cloud Storage |
Comments
Cloud storage encryption directly protects sensitive stored cloud data.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1213 | Data from Information Repositories |
Comments
Repository encryption protects stored sensitive data even after unauthorized access.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1005 | Data from Local System |
Comments
Encryption at rest directly reduces usability of stolen or accessed local data.
References
|
| CIS-3.10 | Encrypt Sensitive Data in Transit | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Transport encryption directly constrains interception and manipulation of communications.
References
|
| CIS-3.10 | Encrypt Sensitive Data in Transit | mitigates | T1040 | Network Sniffing |
Comments
Encryption in transit directly mitigates readable interception of network traffic.
References
|
| CIS-3.9 | Encrypt Data on Removable Media | mitigates | T1052.001 | Exfiltration over USB |
Comments
Encrypting removable media directly reduces the usefulness of data exfiltrated via USB storage devices.
References
|
| CIS-3.9 | Encrypt Data on Removable Media | mitigates | T1025 | Data from Removable Media |
Comments
The safeguard explicitly protects removable-media-stored data from unauthorized access.
References
|
| CIS-3.6 | Encrypt Data on End-User Devices | mitigates | T1025 | Data from Removable Media |
Comments
Encryption protects copied endpoint data stored on removable media from unauthorized disclosure.
References
|
| CIS-3.6 | Encrypt Data on End-User Devices | mitigates | T1005 | Data from Local System |
Comments
Encryption on endpoints reduces the value of locally collected data and raises the bar for simple exfiltration after collection.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1070.004 | File Deletion |
Comments
The safeguard specifically concerns secure deletion and sanitization of residual data artifacts.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1561 | Disk Wipe |
Comments
This control protects against attacker behaviors that destroy or overwrite data and storage media.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1485 | Data Destruction |
Comments
Secure disposal directly addresses preventing unauthorized recovery or persistence of sensitive data remnants.
References
|
| CIS-3.3 | Configure Data Access Control Lists | mitigates | T1078 | Valid Accounts |
Comments
ACLs constrain which accounts can reach data and therefore directly reduce abuse of valid accounts and local data access for collection.
References
|
| CIS-3.3 | Configure Data Access Control Lists | mitigates | T1005 | Data from Local System |
Comments
The control either restricts, detects, hardens against, or increases visibility into the adversary behavior associated with this technique. The control reduces unauthorized access opportunities and raises the difficulty of account misuse.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1189 | Drive-by Compromise |
Comments
CIS 9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1105 | Ingress Tool Transfer |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists.
In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery. If 9.3 implementation blocks outbound traffic from machines to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1567.003 | Exfiltration to Text Storage Sites |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. If 9.3 implementation blocks unauthorized text storage sites, the technique is defensible.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1567.002 | Exfiltration to Cloud Storage |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved sites. If 9.3 implementation blocks the URLs of unauthorized cloud storage services that are not approved by the organization then this technique is defensible.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1593.003 | Code Repositories |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content. If 9.3 implementation blocks unapproved code repositories and repository APIs, this is applicable.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1102.002 | Bidirectional Communication |
Comments
If 9.3 implementation includes outbound web-service use broadly enough to block unauthorized services and risky websites, then this technique is applicable. ATT&CK describes two-way C2 via legitimate web services and again points to web proxies and blocking unauthorized external services as mitigation.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1102.003 | One-Way Communication |
Comments
Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content. If 9.3 implementation includes outbound web-services used broadly enough to block unauthorized services and restrict access to unsafe websites, then this technique is defensible.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1102.001 | Dead Drop Resolver |
Comments
CIS 9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content. If 9.3 implementation blocks unapproved social media, code repositories, paste sites, and similar web services across enterprise HTTP/S traffic, this becomes defensible. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1102 | Web Service |
Comments
CIS 9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery. If 9.3 implementation includes certain risky or suspicious web-services used broadly enough to block unauthorized services, then this technique is applicable.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1204 | User Execution |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery. If 9.3 is implemented as a secure web gateway or proxy that can stop the post-click fetch/download, then this technique is applicable.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1204.001 | Malicious Link |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery. If 9.3 is implemented as a secure web gateway or proxy that can stop the post-click fetch/download, then this technique is applicable.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1566.002 | Spearphishing Link |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1566 | Phishing |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1574.001 | DLL |
Comments
Use vetted platform and application security modules to validate component integrity; where applicable, include hash values in manifest files to help prevent malicious DLL side-loading.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Using vetted authentication modules or services that support token-binding protections that cryptographically bind a token to a secret can help prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1212 | Exploitation for Credential Access |
Comments
Validating authentication requests using vetted platform authentication and identity management services, rather than relying on custom authentication code, can help prevent adversaries from targeting credentialing and authentication mechanisms for exploitation.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1574 | Hijack Execution Flow |
Comments
Use vetted platform services and trusted application security modules that validate component integrity; where applicable, include hash values in manifest files to help prevent malicious library side-loading.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1550.001 | Application Access Token |
Comments
Using vetted authentication modules or services that support token-binding protections that cryptographically bind a token to a secret can help prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1195.001 | Compromise Software Dependencies and Development Tools |
Comments
Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1195 | Supply Chain Compromise |
Comments
Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build.
References
|
| CIS-16.11 | Leverage Vetted Modules or Services for Application Security Components | mitigates | T1496.003 | SMS Pumping |
Comments
Using a vetted SMS/messaging service that provides and is configured with anti-abuse controls such as CAPTCHA or equivalent bot protection can help prevent adversaries from leveraging messaging services for SMS pumping.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1078 | Valid Accounts |
Comments
Apply secure design principles to ensure that applications do not store sensitive data or credentials insecurely (e.g. plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage) to help prevent adversaries from obtaining valid accounts.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Apply secure design principles to implement token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, to help prevent the token from being used by adversaries
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1593.003 | Code Repositories |
Comments
Apply secure design principles to prevent exposure of sensitive information by ensuring credentials and API keys are not embedded in or published through public code repositories to help prevent adversaries from finding information online about victims that can be used during targeting.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1593 | Search Open Websites/Domains |
Comments
Apply secure design principles to prevent exposure of sensitive information by ensuring credentials and API keys are not embedded in or published through public code repositories to help prevent adversaries from finding information online about victims that can be used during targeting.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1496.003 | SMS Pumping |
Comments
Applying secure design principles by implementing CAPTCHA protection on forms that send SMS messages to help prevent adversaries from leveraging messaging services for SMS pumping.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1647 | Plist File Modification |
Comments
Applying secure design principles through Apple developer guidance which enables hardened runtime protections for applications to help prevent adversaries from modifying property list files (plist files).
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1559.003 | XPC Services |
Comments
Applying secure design principles by enabling the Hardened Runtime capability and not including the com.apple.security.get-task-allow entitlement with the value set to any value of true can help prevent adversaries from providing malicious content to an XPC service daemon.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1559 | Inter-Process Communication |
Comments
Applying secure design principles by enabling the Hardened Runtime capability and not including the com.apple.security.get-task-allow entitlement with the value set to any value of true can help prevent adversaries from abusing inter-process communication (IPC) mechanisms.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1574.001 | DLL |
Comments
Applying secure design principles to include hash values in manifest files, where possible, can help prevent adversaries from side-loading malicious dynamic-link library (DLL) files.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1574 | Hijack Execution Flow |
Comments
Applying secure design principles to include hash values in manifest files, where possible, can help prevent adversaries from hijacking the way operating systems run programs and executing their own malicious payloads.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1564.012 | File/Path Exclusions |
Comments
Applying secure design principles to limit custom or difficult-to-manage file and folder exclusions and use trusted, access-restricted installation paths can help prevent adversaries from hiding file-based artifacts in specific folders or filenames excluded from defensive capabilities.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1564.009 | Resource Forking |
Comments
Applying secure design principles by using the application bundle structure and its designated /Resources folder can help prevent adversaries from abusing resource forks to hide malicious code or executables.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1564 | Hide Artifacts |
Comments
Applying secure design principles to limit custom file and folder exclusions and installing applications only in trusted paths protected by restricted file and directory permissions can help prevent adversaries from hiding artifacts associated with their behaviors.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1212 | Exploitation for Credential Access |
Comments
Applying secure design principles to validate authentication requests, including one-time passwords, timestamps or sequence numbers for messages sent, digital signatures, and random session keys, can help prevent adversaries from exploiting software vulnerabilities to attempt to collect credentials.
References
|
| CIS-16.10 | Apply Secure Design Principles in Application Architectures | mitigates | T1550.001 | Application Access Token |
Comments
Apply secure design principles to implement token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, to help prevent the token from being used by adversaries
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Static and dynamic application security testing can identify exploitable application weaknesses such as injection flaws, unsafe input handling, authentication defects, and other code-level vulnerabilities before or during release, reducing opportunities to exploit public-facing applications.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1078 | Valid Accounts |
Comments
Where code-level security checks scan application code, configuration, and repositories for hardcoded or otherwise insecurely stored credentials, exposed authentication material can be identified and removed before release, reducing opportunities for adversaries to obtain and abuse valid accounts.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1195 | Supply Chain Compromise |
Comments
Code-level security checks within the application lifecycle can identify vulnerable, malicious, or unexpected code and software components introduced through software supply-chain compromise. This relationship applies to software and development-chain compromise that can be detected through static, dynamic, dependency, integrity, or release-pipeline analysis.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1195.001 | Compromise Software Dependencies and Development Tools |
Comments
Static analysis, dependency review, and build-pipeline security checks can identify vulnerable, unexpected, or suspicious third-party dependencies and development artifacts before they are incorporated into or released with enterprise software.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1195.002 | Compromise Software Supply Chain |
Comments
Automated or manual code review, static and dynamic testing, and release-pipeline integrity checks can identify unexpected or malicious modifications introduced into software before the compromised build or update is distributed.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1574 | Hijack Execution Flow |
Comments
Code-level and build-time security checks can identify unsafe executable or library search paths, missing integrity values, and other application-loading conditions that permit adversaries to hijack execution flow, allowing those weaknesses to be corrected before release.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1574.001 | DLL |
Comments
Static and build-time checks can identify insecure DLL search behavior and verify expected library paths or manifest integrity information, reducing opportunities for malicious DLL side-loading or search-order hijacking in developed applications.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1559 | Inter-Process Communication |
Comments
For applications that use inter-process communication, code-level security checks can verify hardened runtime settings, entitlements, and IPC-related security configuration so insecure development settings that permit unauthorized process interaction can be identified before release.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1559.003 | XPC Services |
Comments
For macOS applications using XPC services, build and code-level checks can verify hardened runtime and entitlement settings and identify insecure configurations that could allow unauthorized interaction with or abuse of XPC services.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1550 | Use Alternate Authentication Material |
Comments
Static and dynamic security checks can verify secure implementation of token handling and token-binding or proof-of-possession controls, helping identify application designs that would allow stolen authentication material to be reused without the intended cryptographic or device-bound protections.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1550.001 | Application Access Token |
Comments
Code-level and dynamic security testing can identify insecure application access-token handling and verify token-binding or proof-of-possession protections, reducing the ability to reuse a stolen application token outside its intended security context.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1212 | Exploitation for Credential Access |
Comments
Static and dynamic security testing can verify application controls that validate authentication requests, such as one-time values, timestamps, sequence numbers, digital signatures, or random session keys, helping identify weaknesses that could otherwise be exploited to obtain credential material.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1036.001 | Invalid Code Signature |
Comments
Where development or release pipelines validate code signatures as part of code-level security checks, invalid, missing, or untrusted signatures can be identified before software is released, reducing opportunities to distribute or execute software that misrepresents its authenticity or provenance.
References
|
| CIS-16.12 | Implement Code-Level Security Checks | mitigates | T1647 | Plist File Modification |
Comments
For macOS applications, code-level and build-pipeline checks can verify hardened runtime, signing, and expected application configuration settings, helping identify insecure development conditions that could make application behavior or configuration more susceptible to malicious plist modification.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1098 | Account Manipulation |
Comments
Separating production and non-production environments with enforced network and administrative boundaries can restrict non-production systems and management paths from reaching production identity infrastructure, reducing opportunities to modify production accounts or authentication settings.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1098.001 | Additional Cloud Credentials |
Comments
Separate production cloud environments, VPCs, and control-plane access paths can prevent non-production systems or administrators from reaching production identity interfaces used to add cloud credentials to existing accounts.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1557 | Adversary-in-the-Middle |
Comments
Network separation between production and non-production environments limits the infrastructure and traffic paths visible from either environment, reducing the scope in which an adversary can position for interception or manipulation of communications.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1557.001 | Name Resolution Poisoning and SMB Relay |
Comments
Separating production and non-production broadcast, name-resolution, and SMB communication paths can constrain poisoning activity and prevent non-production systems from directly relaying authentication to production services.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1612 | Build Image on Host |
Comments
Production and non-production container or virtualization infrastructure can be placed behind separate gateways, firewalls, or control-plane boundaries so a compromised non-production system cannot directly reach production hosts used to build images.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1613 | Container and Resource Discovery |
Comments
Separating production and non-production container control planes and network paths can prevent a compromised non-production workload from directly querying production container APIs, dashboards, nodes, or resource inventories.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1136 | Create Account |
Comments
Enforced separation can restrict access from non-production systems and administrative paths to production account-management infrastructure, reducing the ability to create accounts in the production environment from a compromised non-production environment.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1136.002 | Domain Account |
Comments
Production domain controllers and account-management services can be isolated from non-production networks so non-production systems cannot directly reach the services used to create or manage production domain accounts.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1136.003 | Cloud Account |
Comments
Separate production cloud environments and restricted control-plane connectivity can limit non-production access to production identity services used to create cloud accounts.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1602 | Data from Configuration Repository |
Comments
Production configuration-management interfaces and repositories can be placed on network or management segments that are not directly reachable from non-production systems, reducing unauthorized collection of production configuration data.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1602.001 | SNMP (MIB Dump) |
Comments
Separating production management traffic from non-production networks can restrict SNMP access to approved production management systems and prevent non-production hosts from directly querying production MIB data.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Production network-device management interfaces can be isolated from non-production environments so non-production systems cannot directly access SNMP, Smart Install, or other interfaces used to retrieve production device configurations.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1565 | Data Manipulation |
Comments
Separating production from non-production systems reduces unauthorized cross-environment access to production data and business processes, limiting the ability of a compromise in development or test infrastructure to directly manipulate production information.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1565.003 | Runtime Data Manipulation |
Comments
Enforced production boundaries can prevent non-production systems from directly reaching production applications and runtime services, reducing opportunities to alter data while it is being processed in the production environment.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1610 | Deploy Container |
Comments
Separate production and non-production container control planes can prevent compromised non-production systems from directly accessing production APIs or orchestrators used to deploy containers.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1482 | Domain Trust Discovery |
Comments
Separating sensitive production identity infrastructure from non-production networks can restrict the connectivity required for systems in non-production environments to enumerate production domains and trust relationships.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Firewalls and access controls between production and non-production environments can permit only required protocols and destinations, blocking unauthorized alternate-protocol transfers across the production boundary.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Comments
Production/non-production boundary controls can deny unapproved encrypted protocols, ports, and destinations, limiting exfiltration over symmetrically encrypted non-command-and-control channels across environments.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
Production/non-production boundary controls can restrict unapproved encrypted protocols and destinations, limiting exfiltration over asymmetrically encrypted non-command-and-control channels across environments.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol |
Comments
Production/non-production segmentation can block unnecessary plaintext protocols and destinations across the environment boundary, directly restricting unencrypted non-command-and-control exfiltration paths.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1190 | Exploit Public-Facing Application |
Comments
Production services can be placed on separate hosting or security zones from non-production systems so exploitation of an exposed application does not provide unrestricted network reachability into other production resources.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1210 | Exploitation of Remote Services |
Comments
Separating production and non-production systems with controlled network paths reduces the remote services reachable across environments and limits exploitation-based movement from a compromised non-production system into production.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1133 | External Remote Services |
Comments
Production remote-access services can be exposed only through dedicated gateways, proxies, or approved access paths that are separate from non-production access, preventing direct remote connectivity from less-trusted environments into production.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1046 | Network Service Discovery |
Comments
Network segmentation between production and non-production systems limits host and service reachability, reducing the production systems that can be discovered from a compromised development or test environment.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1040 | Network Sniffing |
Comments
Separating production and non-production network segments limits the traffic, broadcasts, and multicast communications visible from either environment, reducing opportunities to capture production traffic from non-production systems.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1095 | Non-Application Layer Protocol |
Comments
Production/non-production firewalls and gateways can restrict communication to approved interfaces and protocols, blocking unauthorized non-application-layer traffic across the environment boundary.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1571 | Non-Standard Port |
Comments
Boundary firewalls between production and non-production environments can allow only explicitly required ports, preventing arbitrary cross-environment communication over non-standard or unauthorized ports.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Restricting remote-service traffic between production and non-production security zones reduces the ability of an adversary in one environment to reach and hijack remote sessions in the other.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1563.002 | RDP Hijacking |
Comments
Blocking unnecessary RDP traffic between production and non-production environments prevents non-production systems from directly reaching production RDP sessions that could otherwise be hijacked.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1021.001 | Remote Desktop Protocol |
Comments
Production/non-production segmentation can restrict RDP to explicitly approved administrative paths and block ordinary cross-environment RDP connectivity.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1021.003 | Distributed Component Object Model |
Comments
Firewall rules between production and non-production environments can restrict DCOM and RPC connectivity, reducing opportunities for remote DCOM execution across the environment boundary.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1021.006 | Windows Remote Management |
Comments
Production systems can use separate WinRM management paths and firewall rules that permit access only from approved administrative systems, preventing general non-production systems from reaching production WinRM services.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1489 | Service Stop |
Comments
Separating production systems and supporting security or response infrastructure from non-production networks can reduce the ability of an adversary who compromises non-production systems to reach and stop critical production or defensive services.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1072 | Software Deployment Tools |
Comments
Production deployment and management infrastructure can be isolated from non-production systems and reachable only through approved administrative paths, reducing the ability to abuse a compromised non-production deployment tool to execute software in production.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1199 | Trusted Relationship |
Comments
Separating production and non-production environments prevents a trusted integration or relationship available in a less-restricted non-production environment from automatically providing equivalent network reachability into production.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1552.007 | Container API |
Comments
Production container APIs can be isolated behind separate gateways, firewalls, or control-plane networks so non-production workloads cannot directly access production container interfaces that may expose credentials or sensitive configuration.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1669 | Wi-Fi Networks |
Comments
Where non-production or general wireless access is separated from production network segments, enforced segmentation prevents systems that gain Wi-Fi connectivity from directly reaching sensitive production resources.
References
|
