SI-7Software, Firmware, and Information Integrity

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 5 mapping(s) from 2 framework(s): CSF 2.0 4 (mostly) · OWASP-Web 1 (partial)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

• No implementations targeting this control yet.

ATT&CK techniques this control mitigates (207)

• T1003 OS Credential Dumping Credential Access
• T1003.003 NTDS Credential Access
• T1020.001 Traffic Duplication Exfiltration
• T1027 Obfuscated Files or Information Stealth
• T1027.002 Software Packing Stealth
• T1027.007 Dynamic API Resolution Stealth
• T1027.008 Stripped Payloads Stealth
• T1027.009 Embedded Payloads Stealth
• T1036 Masquerading Stealth
• T1036.001 Invalid Code Signature Stealth
• T1036.005 Match Legitimate Resource Name or Location Stealth
• T1037 Boot or Logon Initialization Scripts Persistence, Privilege Escalation
• T1037.002 Login Hook Persistence, Privilege Escalation
• T1037.003 Network Logon Script Persistence, Privilege Escalation
• T1037.004 RC Scripts Persistence, Privilege Escalation
• T1037.005 Startup Items Persistence, Privilege Escalation
• T1040 Network Sniffing Credential Access, Discovery
• T1047 Windows Management Instrumentation Execution
• T1053.006 Systemd Timers Execution, Persistence, Privilege Escalation
• T1056.002 GUI Input Capture Collection, Credential Access
• T1059 Command and Scripting Interpreter Execution
• T1059.001 PowerShell Execution
• T1059.002 AppleScript Execution
• T1059.003 Windows Command Shell Execution
• T1059.004 Unix Shell Execution
• T1059.005 Visual Basic Execution
• T1059.006 Python Execution
• T1059.007 JavaScript Execution
• T1059.008 Network Device CLI Execution
• T1059.010 AutoHotKey & AutoIT Execution
• T1059.011 Lua Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1070 Indicator Removal Stealth
• T1070.003 Clear Command History Stealth
• T1070.007 Clear Network Connection History and Configurations Stealth
• T1070.008 Clear Mailbox Data Stealth
• T1070.009 Clear Persistence Stealth
• T1070.010 Relocate Malware Stealth
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1080 Taint Shared Content Lateral Movement
• T1098.001 Additional Cloud Credentials Persistence, Privilege Escalation
• T1098.002 Additional Email Delegate Permissions Persistence, Privilege Escalation
• T1098.003 Additional Cloud Roles Persistence, Privilege Escalation
• T1112 Modify Registry Defense Impairment, Persistence
• T1114 Email Collection Collection
• T1114.001 Local Email Collection Collection
• T1114.002 Remote Email Collection Collection
• T1114.003 Email Forwarding Rule Collection
• T1119 Automated Collection Collection
• T1127 Trusted Developer Utilities Proxy Execution Stealth, Execution

Weaknesses this control addresses (7)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SI