AC-17Remote Access

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 5 mapping(s) from 2 framework(s): ASVS 5.0 3 (partial) · CSF 2.0 2 (mostly)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

• No implementations targeting this control yet.

ATT&CK techniques this control mitigates (81)

• T1020.001 Traffic Duplication Exfiltration
• T1021 Remote Services Lateral Movement
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.002 SMB/Windows Admin Shares Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.004 SSH Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1021.008 Direct Cloud VM Connections Lateral Movement
• T1037 Boot or Logon Initialization Scripts Persistence, Privilege Escalation
• T1037.001 Logon Script (Windows) Persistence, Privilege Escalation
• T1040 Network Sniffing Credential Access, Discovery
• T1047 Windows Management Instrumentation Execution
• T1059 Command and Scripting Interpreter Execution
• T1059.001 PowerShell Execution
• T1059.002 AppleScript Execution
• T1059.003 Windows Command Shell Execution
• T1059.004 Unix Shell Execution
• T1059.005 Visual Basic Execution
• T1059.006 Python Execution
• T1059.007 JavaScript Execution
• T1059.008 Network Device CLI Execution
• T1070 Indicator Removal Stealth
• T1070.008 Clear Mailbox Data Stealth
• T1114 Email Collection Collection
• T1114.001 Local Email Collection Collection
• T1114.002 Remote Email Collection Collection
• T1114.003 Email Forwarding Rule Collection
• T1119 Automated Collection Collection
• T1127.002 ClickOnce Stealth, Execution
• T1133 External Remote Services Persistence, Initial Access
• T1137 Office Application Startup Persistence
• T1137.002 Office Test Persistence
• T1213 Data from Information Repositories Collection
• T1213.001 Confluence Collection
• T1213.002 Sharepoint Collection
• T1213.005 Messaging Applications Collection
• T1219 Remote Access Tools Command And Control
• T1505.004 IIS Components Persistence
• T1505.005 Terminal Services DLL Persistence
• T1530 Data from Cloud Storage Collection
• T1537 Transfer Data to Cloud Account Exfiltration
• T1543 Create or Modify System Process Persistence, Privilege Escalation
• T1547.003 Time Providers Persistence, Privilege Escalation
• T1547.004 Winlogon Helper DLL Persistence, Privilege Escalation
• T1547.009 Shortcut Modification Persistence, Privilege Escalation
• T1547.012 Print Processors Persistence, Privilege Escalation
• T1547.013 XDG Autostart Entries Persistence, Privilege Escalation
• T1550.001 Application Access Token Lateral Movement
• T1552 Unsecured Credentials Credential Access

Weaknesses this control addresses (7)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family AC