SI-3Malicious Code Protection

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 5 mapping(s) from 3 framework(s): ASVS 5.0 3 (partial) · OWASP-Web 1 (partial) · CSF 2.0 1 (partial)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

• No implementations targeting this control yet.

ATT&CK techniques this control mitigates (224)

• T1001 Data Obfuscation Command And Control
• T1001.001 Junk Data Command And Control
• T1001.002 Steganography Command And Control
• T1001.003 Protocol or Service Impersonation Command And Control
• T1003 OS Credential Dumping Credential Access
• T1003.001 LSASS Memory Credential Access
• T1003.002 Security Account Manager Credential Access
• T1003.003 NTDS Credential Access
• T1003.004 LSA Secrets Credential Access
• T1003.005 Cached Domain Credentials Credential Access
• T1003.006 DCSync Credential Access
• T1003.007 Proc Filesystem Credential Access
• T1003.008 /etc/passwd and /etc/shadow Credential Access
• T1005 Data from Local System Collection
• T1008 Fallback Channels Command And Control
• T1011.001 Exfiltration Over Bluetooth Exfiltration
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.005 VNC Lateral Movement
• T1025 Data from Removable Media Collection
• T1027 Obfuscated Files or Information Stealth
• T1027.002 Software Packing Stealth
• T1027.007 Dynamic API Resolution Stealth
• T1027.008 Stripped Payloads Stealth
• T1027.009 Embedded Payloads Stealth
• T1027.010 Command Obfuscation Stealth
• T1027.012 LNK Icon Smuggling Stealth
• T1027.013 Encrypted/Encoded File Stealth
• T1027.014 Polymorphic Code Stealth
• T1029 Scheduled Transfer Exfiltration
• T1030 Data Transfer Size Limits Exfiltration
• T1036 Masquerading Stealth
• T1036.003 Rename Legitimate Utilities Stealth
• T1036.005 Match Legitimate Resource Name or Location Stealth
• T1036.008 Masquerade File Type Stealth
• T1037 Boot or Logon Initialization Scripts Persistence, Privilege Escalation
• T1037.002 Login Hook Persistence, Privilege Escalation
• T1037.003 Network Logon Script Persistence, Privilege Escalation
• T1037.004 RC Scripts Persistence, Privilege Escalation
• T1037.005 Startup Items Persistence, Privilege Escalation
• T1041 Exfiltration Over C2 Channel Exfiltration
• T1046 Network Service Discovery Discovery
• T1047 Windows Management Instrumentation Execution
• T1048 Exfiltration Over Alternative Protocol Exfiltration
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
• T1052 Exfiltration Over Physical Medium Exfiltration
• T1052.001 Exfiltration over USB Exfiltration
• T1055 Process Injection Stealth, Privilege Escalation
• T1055.001 Dynamic-link Library Injection Stealth, Privilege Escalation

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SI