RA-5Vulnerability Monitoring and Scanning

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 7 mapping(s) from 1 framework(s): CSF 2.0 7 (mostly)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

• No implementations targeting this control yet.

ATT&CK techniques this control mitigates (107)

• T1011.001 Exfiltration Over Bluetooth Exfiltration
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.004 SSH Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1046 Network Service Discovery Discovery
• T1047 Windows Management Instrumentation Execution
• T1052 Exfiltration Over Physical Medium Exfiltration
• T1052.001 Exfiltration over USB Exfiltration
• T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
• T1053.002 At Execution, Persistence, Privilege Escalation
• T1053.003 Cron Execution, Persistence, Privilege Escalation
• T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation
• T1059 Command and Scripting Interpreter Execution
• T1059.001 PowerShell Execution
• T1059.005 Visual Basic Execution
• T1059.007 JavaScript Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
• T1091 Replication Through Removable Media Lateral Movement, Initial Access
• T1092 Communication Through Removable Media Command And Control
• T1098.004 SSH Authorized Keys Persistence, Privilege Escalation
• T1127 Trusted Developer Utilities Proxy Execution Stealth, Execution
• T1127.001 MSBuild Stealth, Execution
• T1127.002 ClickOnce Stealth, Execution
• T1133 External Remote Services Persistence, Initial Access
• T1137 Office Application Startup Persistence
• T1137.001 Office Template Macros Persistence
• T1176 Software Extensions Persistence
• T1190 Exploit Public-Facing Application Initial Access
• T1195 Supply Chain Compromise Initial Access
• T1195.001 Compromise Software Dependencies and Development Tools Initial Access
• T1195.002 Compromise Software Supply Chain Initial Access
• T1204.003 Malicious Image Execution
• T1210 Exploitation of Remote Services Lateral Movement
• T1211 Exploitation for Stealth Stealth
• T1212 Exploitation for Credential Access Credential Access
• T1213 Data from Information Repositories Collection
• T1213.001 Confluence Collection
• T1213.002 Sharepoint Collection
• T1213.003 Code Repositories Collection
• T1213.005 Messaging Applications Collection
• T1218 System Binary Proxy Execution Stealth
• T1218.003 CMSTP Stealth
• T1218.004 InstallUtil Stealth
• T1218.005 Mshta Stealth
• T1218.008 Odbcconf Stealth
• T1218.009 Regsvcs/Regasm Stealth
• T1218.012 Verclsid Stealth

Weaknesses this control addresses (9)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family RA