CM-8System Component Inventory

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 4 mapping(s) from 2 framework(s): CSF 2.0 3 (mostly) · ASVS 5.0 1 (partial)

See the full cumulative-coverage rollup →

Implementations targeting this control (2)

• aws-config-ec2-instance-managed-by-systems-manager Ec2 Instance Managed By Systems Manager AWS::EC2::Instance partial protect enforce
• aws-config-ec2-managedinstance-association-compliance-status-check Ec2 Managedinstance Association Compliance Status Check AWS::EC2::Instance partial protect enforce

ATT&CK techniques this control mitigates (101)

• T1011.001 Exfiltration Over Bluetooth Exfiltration
• T1020.001 Traffic Duplication Exfiltration
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.004 SSH Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1046 Network Service Discovery Discovery
• T1052 Exfiltration Over Physical Medium Exfiltration
• T1052.001 Exfiltration over USB Exfiltration
• T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
• T1053.002 At Execution, Persistence, Privilege Escalation
• T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation
• T1059 Command and Scripting Interpreter Execution
• T1059.001 PowerShell Execution
• T1059.005 Visual Basic Execution
• T1059.007 JavaScript Execution
• T1059.010 AutoHotKey & AutoIT Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1091 Replication Through Removable Media Lateral Movement, Initial Access
• T1092 Communication Through Removable Media Command And Control
• T1098.004 SSH Authorized Keys Persistence, Privilege Escalation
• T1119 Automated Collection Collection
• T1127 Trusted Developer Utilities Proxy Execution Stealth, Execution
• T1127.001 MSBuild Stealth, Execution
• T1127.002 ClickOnce Stealth, Execution
• T1133 External Remote Services Persistence, Initial Access
• T1137 Office Application Startup Persistence
• T1137.001 Office Template Macros Persistence
• T1189 Drive-by Compromise Initial Access
• T1190 Exploit Public-Facing Application Initial Access
• T1195 Supply Chain Compromise Initial Access
• T1195.003 Compromise Hardware Supply Chain Initial Access
• T1203 Exploitation for Client Execution Execution
• T1210 Exploitation of Remote Services Lateral Movement
• T1211 Exploitation for Stealth Stealth
• T1212 Exploitation for Credential Access Credential Access
• T1213 Data from Information Repositories Collection
• T1213.001 Confluence Collection
• T1213.002 Sharepoint Collection
• T1213.005 Messaging Applications Collection
• T1218 System Binary Proxy Execution Stealth
• T1218.003 CMSTP Stealth
• T1218.004 InstallUtil Stealth
• T1218.005 Mshta Stealth
• T1218.008 Odbcconf Stealth
• T1218.009 Regsvcs/Regasm Stealth
• T1218.012 Verclsid Stealth
• T1218.013 Mavinject Stealth

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family CM