NIST 800-53 r5 · Controls catalogue · Family SI
SI-4System Monitoring
Monitor the system to detect: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: {{ insert: param, si-04_odp.01 }} ; and Unauthorized local, network, and remote connections; Identify unauthorized use of the system through the following techniques and methods: {{ insert: param, si-04_odp.02 }}; Invoke internal monitoring capabilities or deploy monitoring devices: Strategically within the system to collect organization-determined essential information; and At ad hoc locations within the system to track specific types of transactions of interest to the organization; Analyze detected events and anomalies; Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; Obtain legal opinion regarding system monitoring activities; and Provide {{ insert: param, si-04_odp.03 }} to {{ insert: param, si-04_odp.04 }} {{ insert: param, si-04_odp.05 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 11 mapping(s) from 2 framework(s): CSF 2.0 10 (mostly) · ASVS 5.0 1 (partial)
Implementations targeting this control (3)
- aws-config-cloud-trail-log-file-validation-enabled CloudTrail log file validation is enabled AWS::CloudTrail::Trail partial detect enforce CIS §3.2Hub CloudTrail.4
- aws-config-guardduty-enabled-centralized Guardduty Enabled Centralized AWS::GuardDuty::Detector partial detect enforce
- aws-config-s3-event-notifications-enabled S3 Event Notifications Enabled AWS::S3::Bucket partial protect enforce
ATT&CK techniques this control mitigates (373)
- T1001 Data Obfuscation Command And Control
- T1001.001 Junk Data Command And Control
- T1001.002 Steganography Command And Control
- T1001.003 Protocol or Service Impersonation Command And Control
- T1003 OS Credential Dumping Credential Access
- T1003.001 LSASS Memory Credential Access
- T1003.002 Security Account Manager Credential Access
- T1003.003 NTDS Credential Access
- T1003.004 LSA Secrets Credential Access
- T1003.005 Cached Domain Credentials Credential Access
- T1003.006 DCSync Credential Access
- T1003.007 Proc Filesystem Credential Access
- T1003.008 /etc/passwd and /etc/shadow Credential Access
- T1005 Data from Local System Collection
- T1008 Fallback Channels Command And Control
- T1011 Exfiltration Over Other Network Medium Exfiltration
- T1011.001 Exfiltration Over Bluetooth Exfiltration
- T1020.001 Traffic Duplication Exfiltration
- T1021 Remote Services Lateral Movement
- T1021.001 Remote Desktop Protocol Lateral Movement
- T1021.002 SMB/Windows Admin Shares Lateral Movement
- T1021.003 Distributed Component Object Model Lateral Movement
- T1021.004 SSH Lateral Movement
- T1021.005 VNC Lateral Movement
- T1021.006 Windows Remote Management Lateral Movement
- T1021.008 Direct Cloud VM Connections Lateral Movement
- T1025 Data from Removable Media Collection
- T1027 Obfuscated Files or Information Stealth
- T1027.002 Software Packing Stealth
- T1027.007 Dynamic API Resolution Stealth
- T1027.008 Stripped Payloads Stealth
- T1027.009 Embedded Payloads Stealth
- T1027.010 Command Obfuscation Stealth
- T1027.011 Fileless Storage Stealth
- T1027.012 LNK Icon Smuggling Stealth
- T1029 Scheduled Transfer Exfiltration
- T1030 Data Transfer Size Limits Exfiltration
- T1036 Masquerading Stealth
- T1036.001 Invalid Code Signature Stealth
- T1036.003 Rename Legitimate Utilities Stealth
- T1036.005 Match Legitimate Resource Name or Location Stealth
- T1036.007 Double File Extension Stealth
- T1036.008 Masquerade File Type Stealth
- T1036.010 Masquerade Account Name Stealth
- T1037 Boot or Logon Initialization Scripts Persistence, Privilege Escalation
- T1037.002 Login Hook Persistence, Privilege Escalation
- T1037.003 Network Logon Script Persistence, Privilege Escalation
- T1037.004 RC Scripts Persistence, Privilege Escalation
- T1037.005 Startup Items Persistence, Privilege Escalation
- T1040 Network Sniffing Credential Access, Discovery
Weaknesses this control addresses (9)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 14,364 | Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior. |
CWE-352 | Cross-Site Request Forgery (CSRF) | 10,576 | Detects anomalous request patterns consistent with cross-site request forgery. |
CWE-284 | Improper Access Control | 5,367 | Directly detects unauthorized local/network/remote connections and system use that result from improper access control. |
CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 4,965 | Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring. |
CWE-287 | Improper Authentication | 4,908 | Detects unauthorized use and connections stemming from authentication bypass or failure. |
CWE-400 | Uncontrolled Resource Consumption | 3,572 | Monitors for resource exhaustion and denial-of-service patterns that indicate uncontrolled consumption. |
CWE-918 | Server-Side Request Forgery (SSRF) | 3,202 | Detects server-side request forgery through monitoring of unexpected outbound connections. |
CWE-611 | Improper Restriction of XML External Entity Reference | 1,522 | Identifies XML external entity processing via monitoring of unusual file/network access or resource usage. |
CWE-693 | Protection Mechanism Failure | 613 | Reveals failures or bypasses of existing protection mechanisms via event and anomaly analysis. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-25388 | 7.0 | 9.8 | 0.0073 | partial |
CVE-2025-11251 UPD | 7.0 | 9.8 | 0.0040 | good |
CVE-2025-50706 UPD | 7.0 | 9.8 | 0.0099 | partial |
CVE-2022-23898 | 7.0 | 9.8 | 0.0773 | partial |
CVE-2024-38773 | 7.0 | 9.3 | 0.0200 | partial |
CVE-2024-20290 UPD | 6.0 | 7.5 | 0.3356 | partial |
CVE-2023-4548 | 6.0 | 6.3 | 0.2011 | partial |
CVE-2024-12146 | 5.5 | 7.5 | 0.0034 | partial |
CVE-2025-7184 UPD | 5.5 | 7.3 | 0.0040 | partial |
CVE-2026-3200 | 5.5 | 7.3 | 0.0032 | partial |
CVE-2025-15424 | 5.5 | 7.3 | 0.0039 | partial |
CVE-2026-1160 | 5.5 | 7.3 | 0.0033 | partial |
CVE-2026-2211 | 5.5 | 7.3 | 0.0032 | partial |
CVE-2026-2195 | 5.5 | 7.3 | 0.0032 | partial |
CVE-2026-2083 | 5.5 | 7.3 | 0.0032 | partial |
CVE-2026-2073 | 5.5 | 7.3 | 0.0032 | partial |
CVE-2026-1121 | 5.5 | 7.3 | 0.0046 | partial |
CVE-2026-1422 | 5.5 | 7.3 | 0.0048 | partial |
CVE-2018-25165 | 5.5 | 7.1 | 0.0024 | partial |
CVE-2025-7187 UPD | 3.5 | 6.3 | 0.0038 | partial |
CVE-2026-0584 | 3.5 | 6.3 | 0.0032 | partial |
CVE-2026-2122 | 3.5 | 6.3 | 0.0027 | partial |
CVE-2026-3771 | 3.5 | 6.3 | 0.0029 | partial |
CVE-2026-3785 | 3.5 | 6.3 | 0.0028 | partial |
CVE-2026-1546 | 3.5 | 6.3 | 0.0034 | partial |