CM-11User-installed Software

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 4 mapping(s) from 1 framework(s): CSF 2.0 4 (mostly)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

• No implementations targeting this control yet.

ATT&CK techniques this control mitigates (33)

• T1021.005 VNC Lateral Movement
• T1059 Command and Scripting Interpreter Execution
• T1059.006 Python Execution
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1176 Software Extensions Persistence
• T1195 Supply Chain Compromise Initial Access
• T1195.001 Compromise Software Dependencies and Development Tools Initial Access
• T1195.002 Compromise Software Supply Chain Initial Access
• T1218 System Binary Proxy Execution Stealth
• T1218.001 Compiled HTML File Stealth
• T1218.002 Control Panel Stealth
• T1218.003 CMSTP Stealth
• T1218.004 InstallUtil Stealth
• T1218.005 Mshta Stealth
• T1218.008 Odbcconf Stealth
• T1218.009 Regsvcs/Regasm Stealth
• T1218.012 Verclsid Stealth
• T1218.013 Mavinject Stealth
• T1218.014 MMC Stealth
• T1505 Server Software Component Persistence
• T1505.001 SQL Stored Procedures Persistence
• T1505.002 Transport Agent Persistence
• T1505.004 IIS Components Persistence
• T1543 Create or Modify System Process Persistence, Privilege Escalation
• T1543.001 Launch Agent Persistence, Privilege Escalation
• T1543.002 Systemd Service Persistence, Privilege Escalation
• T1543.003 Windows Service Persistence, Privilege Escalation
• T1543.004 Launch Daemon Persistence, Privilege Escalation
• T1547.013 XDG Autostart Entries Persistence, Privilege Escalation
• T1550.001 Application Access Token Lateral Movement
• T1564.009 Resource Forking Stealth
• T1569 System Services Execution
• T1569.001 Launchctl Execution

Weaknesses this control addresses (4)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family CM