CM-7Least Functionality

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 4 mapping(s) from 2 framework(s): CSF 2.0 2 (full) · ASVS 5.0 2 (partial)

See the full cumulative-coverage rollup →

Implementations targeting this control (3)

• aws-config-restricted-common-ports Restricted Common Ports AWS::EC2::SecurityGroup partial protect enforce CIS v5 §5.4CIS v3 §5.3Hub EC2.54
• aws-config-no-unrestricted-route-to-igw No Unrestricted Route To Igw AWS::EC2::RouteTable partial protect enforce
• aws-config-restricted-ssh Restricted Ssh AWS::EC2::SecurityGroup partial protect enforce CIS v5 §5.3CIS v3 §5.2Hub EC2.53

ATT&CK techniques this control mitigates (223)

• T1003 OS Credential Dumping Credential Access
• T1003.001 LSASS Memory Credential Access
• T1003.002 Security Account Manager Credential Access
• T1003.005 Cached Domain Credentials Credential Access
• T1008 Fallback Channels Command And Control
• T1011 Exfiltration Over Other Network Medium Exfiltration
• T1011.001 Exfiltration Over Bluetooth Exfiltration
• T1020.001 Traffic Duplication Exfiltration
• T1021 Remote Services Lateral Movement
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.002 SMB/Windows Admin Shares Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1021.008 Direct Cloud VM Connections Lateral Movement
• T1027 Obfuscated Files or Information Stealth
• T1036 Masquerading Stealth
• T1036.005 Match Legitimate Resource Name or Location Stealth
• T1036.007 Double File Extension Stealth
• T1036.008 Masquerade File Type Stealth
• T1037 Boot or Logon Initialization Scripts Persistence, Privilege Escalation
• T1037.001 Logon Script (Windows) Persistence, Privilege Escalation
• T1040 Network Sniffing Credential Access, Discovery
• T1046 Network Service Discovery Discovery
• T1047 Windows Management Instrumentation Execution
• T1048 Exfiltration Over Alternative Protocol Exfiltration
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
• T1052 Exfiltration Over Physical Medium Exfiltration
• T1052.001 Exfiltration over USB Exfiltration
• T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
• T1053.002 At Execution, Persistence, Privilege Escalation
• T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation
• T1059 Command and Scripting Interpreter Execution
• T1059.005 Visual Basic Execution
• T1059.007 JavaScript Execution
• T1059.009 Cloud API Execution
• T1059.010 AutoHotKey & AutoIT Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1071 Application Layer Protocol Command And Control
• T1071.001 Web Protocols Command And Control
• T1071.002 File Transfer Protocols Command And Control
• T1071.003 Mail Protocols Command And Control
• T1071.004 DNS Command And Control
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
• T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
• T1080 Taint Shared Content Lateral Movement
• T1087 Account Discovery Discovery

Weaknesses this control addresses (8)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family CM