Cyber Resilience

← ISO 27001 Annex A

A.5.18 Organizational

Access rights

AttributesPreventive C·I·A Protect Identity and access management Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (21)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-2←F →M AC-3←M →M AC-5←P →P AC-6←M →M PS-4←P →M PS-5←M →M PS-6←M

Why these map — AI rationale (under review)

AC-2mostlyaligns with — Both controls establish the full lifecycle of account provisioning, modification, and timely revocation tied to personnel changes and business need.
AC-2mostlycovers — A.5.18's requirement to define and authorize access rights according to business needs accounts for the bulk of ac-2's account provisioning, types, privileges, and approval elements, but leaves a residual on ac-2's explicit prohibitions, account-manager assignment, and group/role mechanics not required by the ISO control.
AC-3mostlyaligns with — Both enforce that access decisions are made only after explicit authorization and that granted rights are consistent with policy and risk.
AC-3mostlycovers — A.5.18's definition and authorization of access rights according to business requirements accounts for the bulk of AC-3's enforcement of approved authorizations per policy, but leaves a residual on the actual runtime enforcement mechanism itself
AC-6mostlycovers — A.5.18's broad mandate to define and authorize access rights according to business requirements accounts for the bulk of AC-6's least-privilege rule (authorized accesses must be necessary), but leaves a residual of explicit least-privilege enforcement mechanisms and ongoing review that sit outside A.5.18's wording.
PS-4mostlyaligns with — Both mandate review and removal of access rights before or upon personnel termination or role change to reduce residual risk.
PS-5mostlyaligns with — Both require adjustment of access rights when individuals transfer or change positions within the organization.
AC-5partialaligns with — Both embed segregation-of-duties considerations into the approval and implementation steps of granting access rights.
AC-5partialcovers — A.5.18's broad requirement to define and authorize access rights according to business needs accounts for only a slice of ac-5 (the 'define system access authorizations' part), but does not address identifying/documenting the separation-of-duties policy or the specific SoD analysis that drives those authorizations.
AC-6partialaligns with — Both require that the scope of access granted is limited to what is necessary and that privileged rights receive additional scrutiny.

Aligned NIST CSF 2.0 outcomes (13)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

PR.AA-05←F →F GV.RR-02gov GV.RR-04gov ID.AM-08gov PR.AA-01gov PR.AA-06gov

Why these map — AI rationale (under review)

PR.AA-05fullcovers — The ISO control's detailed provisioning, review, and revocation procedures directly implement the CSF outcome of defining, managing, enforcing, and reviewing access permissions and authorizations.
PR.AA-01mostlyaligns with — Managing the full lifecycle of identities and credentials through authorization, activation, modification, and timely removal aligns with the CSF requirement to manage identities and credentials for authorized users.
GV.RR-02partialaligns with — Establishing explicit approval, segregation of duties, and record-keeping for access rights supports the CSF outcome of defining and communicating roles, responsibilities, and authorities for cybersecurity risk management.
ID.AM-08partialaligns with — Requiring access rights to be adjusted or removed when personnel change roles or leave the organization contributes to managing assets throughout their life cycles.
GV.RR-02implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.AM-08implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-01implements — A.5.18 operationalizes identity/credential management within the access-rights domain that PR.AA-01 names, but the outcome does not cite access-rights definition explicitly

Related OWASP ASVS 5.0 requirements (13)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V6.3.2→P V7.4.2←F V8.1.1←P V8.2.1←M →M V8.2.2←M →M V8.3.1←M →P V8.3.2→P V8.3.3←P V8.4.2←P →P

Why these map — AI rationale (under review)

V8.2.1mostlyaligns with — The ISO control's requirement to grant access only after explicit authorization and to enforce topic-specific access policies directly supports the ASVS mandate that function-level access be restricted to consumers with explicit permissions.
V8.2.2mostlyaligns with — By requiring authorization from asset owners and maintaining a central record of granted rights, the ISO control ensures that data-specific access is limited to consumers who have explicit permissions for those items.
V6.3.2partialaligns with — The ISO control's explicit removal of access rights for users who leave or change roles supports the ASVS requirement to disable or remove default and unused accounts.
V8.3.1partialaligns with — The ISO guidance that access rights must be activated only after authorization procedures complete and must be enforced at a trusted service layer aligns with the ASVS requirement to enforce authorization rules outside untrusted consumer control.
V8.3.2partialaligns with — Regular reviews and immediate adjustment of access rights when roles change or employment ends ensure that authorization decisions reflect current permissions without delay.
V8.4.2partialaligns with — Requiring separate approval, segregation of duties, and privileged-access reviews in the ISO control aligns with the ASVS demand for layered security around administrative interfaces.

Related weaknesses / CWE (90)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-282nonemitigates — Managing access rights includes verifying and maintaining proper ownership of resources.
CWE-653noneprevents — Managing access rights is the operational mechanism for compartmentalizing privileges.
CWE-669nonemitigates — Managing access rights reduces risk of unauthorized resource transfer.
CWE-673nonemitigates — Managing access rights prevents unauthorized external actors from altering sphere definitions.
CWE-1220prevents — Defines the assignment and review of access rights; insufficient granularity in those rights is the root of CWE-1220.
CWE-1268prevents — Directly governs the assignment and review of access rights, addressing inconsistent privilege mappings between agents.
CWE-1334prevents — Managing access rights restricts privileges that could be abused to inject faults into redundant components.
CWE-15prevents — Access rights assignment determines who may change system settings.
CWE-202prevents — Granular access rights reduce the ability of users to craft inference queries.
CWE-213mitigates — Rights assignment can be aligned with the strictest applicable stakeholder policy.
CWE-219mitigates — Granting only the minimum rights prevents unauthorized retrieval of sensitive files.
CWE-250prevents — Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.
CWE-266prevents — The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
CWE-268prevents — Managing access rights helps prevent the accumulation or chaining of privileges that lead to unsafe actions.
CWE-269prevents — Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.
CWE-270prevents — Managing access rights includes privilege assignment but not runtime context-switch enforcement.
CWE-274prevents — Access-rights provisioning and review reduce privilege gaps, yet do not address the software’s failure to handle insufficient privileges gracefully.
CWE-278prevents — Managing access rights includes reviewing and adjusting permissions when objects are copied or inherited.
CWE-283prevents — Access rights reviews can enforce checks that only legitimate owners retain privileges over critical assets.
CWE-284prevents — Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.
CWE-286prevents — Access rights provisioning and de-provisioning ensure users are correctly created, modified, and removed.
CWE-288prevents — Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
CWE-289prevents — Access-rights provisioning can enforce canonical-name validation when granting rights.
CWE-290prevents — Access rights assignment limits exposure but does not enforce authentication strength.
CWE-291prevents — Access-rights assignment should be tied to authenticated identities, not network location.
CWE-302mitigates — Access-rights reviews can detect and revoke rights granted via tampered immutable data.
CWE-402prevents — Managing access rights helps ensure resources are not granted to untrusted parties.
CWE-408prevents — Access rights provisioning can restrict expensive operations until authorization is granted.
CWE-424prevents — Managing access rights must cover every alternate path that could bypass intended restrictions.
CWE-527prevents — Managing access rights ensures only authorized personnel can access source-code repositories.
CWE-528prevents — Granting only the minimum rights needed can prevent unauthorized access to core dumps, but does not address how or where they are generated.
CWE-529prevents — Managing access rights includes ensuring ACL files themselves are not exposed outside their intended sphere.
CWE-530prevents — Proper access-rights provisioning prevents unauthorized actors from reaching backup locations.
CWE-612prevents — Managing access rights ensures only authorized users can reach indexed sensitive content.
CWE-638prevents — Managing access rights lifecycle ensures checks reflect current privileges on each use.
CWE-639prevents — Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
CWE-642prevents — Managing access rights prevents unauthorized actors from altering critical state stored externally.
CWE-708prevents — Access-rights provisioning includes ownership assignment; fixing CWE-708 directly supports this control's intent.
CWE-732prevents — Documented provisioning and revocation procedures reduce the chance that critical resources retain overly permissive default or leftover permissions after personnel changes.
CWE-842prevents — Access rights control explicitly requires review and approval of group memberships, preventing erroneous placement.
CWE-862prevents — Mandatory authorization checks and central records of granted rights ensure that every access attempt is preceded by an explicit decision rather than relying on missing checks.
CWE-863prevents — Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.
CWE-921prevents — Granting and reviewing access rights prevents unauthorized access to sensitive data on storage media.

Mitigated MITRE ATT&CK techniques (557)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001.003←M T1003→P T1003.002→P T1003.003→P T1003.005→P T1003.006→P T1003.008→P T1005→P T1006←F T1014←M T1021→M T1021.001→M T1021.002→M T1021.003←P →P T1021.004→M T1021.005→M T1021.006→P T1021.007←P →M T1021.008←P →M T1027.001←M T1027.005←M T1027.006←M T1027.014←M T1030←M T1036←M T1036.003←M T1036.005←M T1036.007←M T1036.008←M T1036.009←M T1037→P T1037.001→P T1037.003→P T1039→P T1052→P T1052.001→P T1053→P T1053.002→P T1053.003→P T1053.005←P →P T1055←M T1055.001←M T1055.002←M T1055.003←M →P T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1056.002←M T1059.008←P →P T1059.009←M →P T1059.013→P T1068←M T1070←M T1070.003←M T1070.008←P T1070.010←M T1071.004←M T1072←P →P T1078→P T1078.001→P T1078.002→M T1078.003→P T1078.004→M T1080→P T1083→P T1087.003→P T1090.002←M T1090.003←M T1098→P T1098.001→P T1098.002→M T1098.003→P T1098.004→P T1098.005→P T1098.006→M T1098.007→P T1102←M T1102.002←M T1110→P T1110.001→M T1110.002→M T1110.003→M T1110.004→P T1111←M T1112←P →P T1114→P T1114.001→P T1114.002→P T1114.003→P T1127←M T1127.001←M T1127.003←M T1133→P T1134←M T1134.001←M →P T1134.002←M →P T1134.003←M →P T1134.004←M T1134.005←M T1135→P T1136→M T1136.001←M →M T1136.002←P →P T1136.003←M →P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1176←P →P T1176.001←P →P T1185←M T1199←M →P T1202←M T1204.002←M T1204.004←M T1205.001←M T1207←M →P T1211←P T1212←M T1213←M →M T1213.001→P T1213.002→M T1213.004→P T1213.005→P T1213.006→P T1216←M T1216.001←M T1218←M T1218.002←M T1218.003←M T1218.004←M T1218.005←M →P T1218.007←M T1218.008←M →P T1218.009←M T1218.010←M T1218.011←M T1218.012←M →P T1218.013←M T1218.014→P T1219←M →P T1219.002←M →P T1219.003←M T1220←M T1221←M T1222←M →P T1222.001←M T1222.002←M T1480.001←M T1484←M →P T1484.001←M →P T1484.002←M →P T1485.001→P T1489←P T1490←M T1496.004→P T1499←F T1526→P T1528←M →P T1530←M →M T1531←M T1534←M T1535←M T1537←M →P T1538→M T1539←F →P T1542←M T1542.002←M T1543.002→P T1543.003→P T1543.004→P T1543.005→P T1546→P T1546.002→P T1546.003→P T1546.004→P T1546.007→P T1546.008←M T1546.012←P →P T1546.013→P T1547.001→P T1547.004→P T1547.009→P T1547.010→P T1547.012→P T1547.014→P T1547.015→P T1548←M →M T1548.001←P T1548.002←M →P T1548.003←M →M T1548.004←M →P T1548.005→P T1548.006←M →P T1550←M →P T1550.001←F →P T1550.002←F →P T1550.003←F →P T1550.004→P T1552.004→P T1552.005→P T1552.006→P T1552.007→P T1553.001←M T1553.002←P T1553.003←M T1553.004←P T1553.005←M T1553.006←M T1555→P T1555.004→P T1555.006→P T1556←M →P T1556.001←F T1556.002←F T1556.003←M →P T1556.004←M T1556.005←P →P T1556.006←M →P T1556.007←M T1556.008←M →P T1556.009←M →P T1558←M →P T1558.001←M →P T1558.002←M →P T1558.003→P T1558.004→P T1558.005→P T1561←P T1563→P T1563.001←M →P T1563.002←M →P T1564←M T1564.001←M T1564.002→P T1564.004←M T1565→P T1566.003←M T1567.001→P T1571←M T1572←M T1574←M T1574.001←M →P T1574.004←M T1574.005→P T1574.009→P T1574.010←P →P T1574.011←M →P T1574.012→P T1574.013←M T1578←M T1578.001←M T1578.002←M T1578.003←M →P T1578.004←M T1578.005←M T1580→P T1584.001→P T1584.006←M T1586←M →P T1586.002←M T1586.003←M →P T1589.001←M T1599←M T1599.001←M T1600←M T1600.001←P T1601.001←P T1601.002←M T1602.001→P T1602.002→P T1606←M T1606.001←F T1606.002←M →P T1609→P T1610←P T1611←M →P T1612←M T1619→P T1620←M T1621←M →P T1647←P T1649←M →P T1650←M T1651→P T1653←P T1657→P T1665←P T1666←M →P T1668←P T1669←P →P T1671→P T1678←M T1684→P T1684.002←M T1685←M T1685.001←M T1685.002←M →P T1685.003←M T1685.004←M T1685.005←M T1685.006←M T1686←F T1686.001←M T1686.002←M T1686.003←M T1687←P T1688←M T1689←M T1690←M

Why these map — AI rationale (under review)

T1003detects — A.5.18 mandates maintaining records of access rights plus regular reviews (especially of privileged rights and post-role-change/termination), which can surface anomalous credential-dumping indicators after the fact; this is only a minority slice of detection because the control is governance-oriented, does not mandate runtime monitoring or anomaly detection on the credential structures themselves, and leaves most technical detection to other clauses.
T1003prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of access rights (especially privileged ones) stop many post-compromise credential-dumping paths that rely on retained or over-privileged accounts, but do not stop the initial extraction techniques themselves or dumping from memory/caches of currently authorized sessions.
T1003.002prevents — A.5.18's provisioning, timely revocation, role-change review, and least-privilege-aligned access rights directly stop many non-SYSTEM accounts from ever reaching the privilege level required to enumerate the SAM, but the technique's core prerequisite (SYSTEM) can still be obtained through other privilege-escalation paths the control does not address.
T1003.003prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of access rights (including privileged ones and segregation of duties) directly prevents many legitimate paths to NTDS.dit access on domain controllers and backups, but leaves technical extraction methods (Volume Shadow Copy, ntdsutil.exe, Invoke-NinjaCopy) available to already-authorized or compromised accounts.
T1003.005prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (including to credential stores) directly stops many legitimate accounts from retaining cached-domain-credential access that an adversary could later extract with SYSTEM/sudo, but does not address on-disk caches left by previously authorized users, default caching configuration, or extraction after privilege escalation.
T1003.006detects — A.5.18 mandates maintaining records of access rights, regular reviews (especially for privilege changes/terminations), and risk-based adjustments, which can surface anomalous or unauthorized privileged access that would enable DCSync, but this is governance-oriented detection after the fact rather than real-time monitoring of the replication API abuse itself.
T1003.006prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of access rights (especially privileged groups like Domain Admins) directly stops many unauthorized accounts from gaining the rights needed to run DCSync, but leaves residual cases such as insider abuse by already-authorized admins, misconfigured defaults, or post-compromise privilege escalation.
T1003.008prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned access-right rules (including segregation of duties and timely removal on role/employment change) stop many non-root accounts from ever gaining the read access needed to reach /etc/shadow, but cannot prevent root-level or already-privileged accounts from performing the dump, which is the technique's dominant case.
T1005prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned access rights directly stop many authenticated local collection paths on user and service accounts, but leave the remainder of local admin, default, or unauthenticated collection vectors (e.g. world-readable files, memory scraping by already-privileged processes) untouched.
T1021prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (incl. domain credentials) directly stops adversaries from obtaining/using valid accounts for remote service logins in the bulk of enterprise cases; partial remainder exists for stolen credentials, temporary access, or pre-revocation compromise.
T1021.001detects — A.5.18 mandates maintaining records of access rights, changes to them, and regular reviews (including of privileged rights and post-role-change/termination), which can surface anomalous or unauthorized RDP logins when cross-checked against expected patterns, but this is after-the-fact governance review rather than real-time detection of the technique in flight.
T1021.001prevents — A.5.18's provisioning, timely revocation, role-change review, pre-termination adjustment, and segregation requirements directly stop most unauthorized valid-account RDP logons by ensuring only currently authorized identities retain active rights; the bounded remainder is dormant/compromised credentials obtained via separate Credential Access (T1555 etc.) that survive until next review cycle.
T1021.002prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to admin shares) directly stops adversary use of valid accounts for SMB/Windows Admin Shares in the bulk of cases; the bounded remainder is post-compromise credential use (e.g. pass-the-hash) where rights were already authorized.
T1021.003prevents — A.5.18's provisioning, revocation, review, and adjustment of logical access rights (including privileged ones, per business/policy/SoD rules) directly stops adversaries from obtaining or retaining the Valid Accounts needed to abuse DCOM, though default ACLs and some edge cases remain outside its direct mandate.
T1021.004detects — A.5.18 mandates maintaining records of access rights, regular reviews of rights (especially after role changes or termination), and verification of granted rights, which can surface anomalous or outdated SSH access (e.g. via unauthorized keys or lingering accounts) but does not require active monitoring or detection of the technique in flight.
T1021.004prevents — A.5.18's provisioning, review, revocation, and pre-termination adjustment of logical access rights (incl. SSH keys per its explicit scope) directly stops adversaries from obtaining or retaining the Valid Accounts needed to execute T1021.004; residual exists for unmonitored/unsynchronized accounts, shared keys, or post-compromise persistence outside the defined review triggers.
T1021.005detects — A.5.18 mandates maintaining records of access rights plus regular reviews (especially for privilege changes, role changes, and terminations), which can surface anomalous or unauthorized VNC access grants after the fact; this is genuine but limited to the access-rights layer rather than runtime detection of VNC abuse itself.
T1021.005prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to remote desktop services like VNC) directly stops adversaries from obtaining or retaining the Valid Accounts needed to execute T1021.005; the bounded remainder is VNC-specific credential brute-force or library flaws that bypass proper account controls.
T1021.006detects — A.5.18 mandates maintaining records of access rights plus regular reviews (including of privileged rights and post-role-change), which can surface anomalous or unauthorized WinRM usage by valid accounts; this is a genuine but minority slice of detection compared to runtime monitoring or anomaly detection that would catch the technique in flight.
T1021.006prevents — A.5.18's provisioning, authorization, review, timely revocation (esp. on role change/termination), and segregation directly stop adversaries from obtaining or retaining the valid accounts needed to execute T1021.006; residual exists for compromised credentials obtained outside the access-right lifecycle (e.g. phishing, credential dumping).
T1021.007prevents — A.5.18's provisioning, timely revocation, role-change reviews, pre-termination adjustments, and segregation requirements directly stop most valid-account abuse of federated cloud logins by ensuring rights are authorized, limited, and removed when unneeded.
T1021.008prevents — A.5.18's provisioning, review, revocation, SoD, and pre-termination adjustment of logical access rights (incl. keys/tokens) directly stops adversaries from obtaining or retaining the Valid Accounts needed to perform T1021.008; the bounded remainder is post-compromise account abuse or un-reviewed privileged defaults that survive the control's explicit checks.
T1037prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of authorized access rights (including segregation of duties and privileged rights) directly stops adversaries from legitimately obtaining the admin/local accounts needed to install or modify boot/logon scripts for persistence on many platforms, but leaves open the remainder where scripts can be planted via other vectors (e.g. remote exploitation, unmonitored service accounts, or post-compromise without role change).
T1037.001detects — A.5.18 mandates maintaining records of access rights and performing regular reviews (including after role changes or termination), which can surface anomalous or unauthorized logon-script modifications as part of access-right drift, but this is indirect governance review rather than runtime or technical detection of the T1037.001 technique itself.
T1037.001prevents — A.5.18's provisioning, review, and timely revocation of logical access rights (incl. before role changes/termination) directly stops unauthorized addition or retention of the registry key that enables the logon script, but only for identities already inside the access-control boundary; it does not reach the initial local-credential or admin-account compromise that the technique's own text says may be required.
T1037.003detects — A.5.18 mandates maintaining records of access rights and performing regular reviews (including after role changes or termination), which can surface anomalous or unauthorized logon-script assignments used for persistence, but this is governance-oriented review rather than active/continuous detection of the technique in flight or at execution time.
T1037.003prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (incl. via AD/Group Policy) directly stops adversaries from assigning or retaining the privileged logon-script configuration needed for T1037.003 persistence, but only reaches the subset of cases tied to user/role changes or explicit revocation rather than all possible abuse vectors (e.g. initial malicious assignment by a compromised admin).
T1039prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of logical access rights (including network shares) directly stops many unauthorized accesses that would let T1039 run, but leaves a bounded remainder: already-compromised accounts, misconfigured shares that pre-exist the control, and insider-authorized paths.
T1052prevents — A.5.18's provisioning, review, and timely revocation of physical access rights (including to removable media/devices) directly stops authorized users from introducing exfiltration media in many standard cases, but leaves the insider-threat slice where a malicious authorized user still obtains approval or uses an already-authorized device.
T1052.001prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of physical access rights (including to removable media like USB devices) directly stops many insider or post-compromise uses of USB for exfiltration, but leaves open vectors such as temporary authorized USB use, social engineering to obtain a device, or malicious insiders with current legitimate access.
T1053prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (incl. privileged) directly stops many abuse paths that rely on obtaining or retaining the admin/privileged group membership required to schedule tasks, but leaves open paths that use already-granted rights, unmonitored local accounts, or non-privilege-dependent scheduling vectors.
T1053.002prevents — A.5.18 mandates defined/authorized provisioning, revocation on role/employment change, segregation of duties, and review of privileged rights, which directly constrains the admin/superuser or allow-file membership required to invoke `at`; this prevents the technique for non-privileged users and many change/termination scenarios but leaves the privileged baseline (and sudo-enabled Linux cases) untouched.
T1053.003prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review requirements for logical access rights (including to files such as crontab) directly constrain who can install or modify cron jobs, preventing the technique for many identities and roles; it leaves the remainder of privileged or already-authorized accounts that can still create them.
T1053.005detects — A.5.18 mandates maintaining records of access rights, regular reviews of those rights (especially after role changes or for privileged access), and pre-termination reviews; these surface anomalous or unauthorized scheduled-task creation/usage when it touches access rights, but the control is silent on runtime detection of task execution, hidden tasks, or non-access aspects of the technique.
T1053.005prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of logical access rights (including to scheduled-task creation and SYSTEM-impersonation rights) stops many abuse paths, but leaves the remainder of local admin or already-compromised accounts that can still create tasks, plus all hiding and remote-execution vectors.
T1055.003detects — A.5.18 mandates regular reviews of access rights (especially privileged ones) and pre-termination/change reviews, which can surface anomalous or unauthorized access patterns that enable or result from thread hijacking, but this is governance-focused access hygiene rather than runtime detection of the injection technique itself.
T1059.008prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of logical access rights (including on network devices via CLI permission levels) stops many unauthorized CLI abuse paths before they can be exercised, but leaves open vectors such as compromised legitimate privileged accounts, insider misuse, and post-compromise CLI use that the control does not address.
T1059.009prevents — A.5.18's provisioning, review, and timely revocation of authorized access rights (including for privileged/cloud API use, role changes, and terminations) stops many permission-based abuses of cloud APIs from being possible, but leaves open cases such as initial over-provisioning, compromised credentials, or insider abuse where the rights were legitimately granted.
T1059.013prevents — A.5.18's provisioning, revocation, segregation-of-duties, and review processes for logical access rights directly constrain who may legitimately invoke container CLIs/APIs (e.g., docker, kubectl, or the Kubernetes API server), preventing the technique for unauthorized identities while leaving the technique fully available to any properly authorized container administrator or service account.
T1072prevents — A.5.18's provisioning, review, and timely revocation of logical access rights (incl. for role changes, terminations, and privileged accounts) directly constrains the administrative credentials and permissions an adversary must obtain or retain to abuse deployment tools, but leaves open paths such as local credentials, direct third-party access, or pre-existing compromised accounts that the control does not address.
T1078prevents — Strict authorization, timely revocation on role change or departure, and central logging of access rights directly limit an adversary’s ability to retain or abuse valid accounts after employment ends or privileges are altered.
T1078detects — A.5.18 mandates regular reviews of access rights (especially after role changes, termination, or for privileged accounts) plus record-keeping of changes, which surfaces inactive or over-privileged accounts that adversaries can abuse; this is genuine but bounded detection that does not cover credential compromise itself or real-time anomalous use of valid accounts.
T1078.001prevents — A.5.18's provisioning, review, and timely revocation of default/privileged accounts (incl. before role changes or termination) stops many abuse paths, but leaves residual cases such as factory defaults on un-reviewed appliances, post-integration accounts like vpxuser, and unchanged built-in accounts that are never touched by the access-right process.
T1078.002prevents — Enforcing segregation of duties and periodic reviews of privileged domain accounts makes it harder for attackers to maintain long-term access via compromised domain credentials.
T1078.003prevents — Mandatory revocation of local accounts when users leave or change roles shrinks the pool of stale local credentials an attacker could leverage.
T1078.004prevents — A.5.18's provisioning, timely revocation, role-change reviews, segregation-of-duties checks, and explicit pre-termination adjustment of access rights directly stop most adversary paths that rely on valid but stale, over-privileged, or improperly assigned cloud accounts (including hybrid/federated ones), leaving only the bounded remainder of initial credential compromise (phishing/brute-force) and certain misconfiguration-driven privilege escalations that the control does not itself enforce.
T1080prevents — A.5.18's provisioning, revocation, review, and least-privilege-style checks on shared-asset access rights (including network drives and repositories) constrain who can write tainting content and who can reach already-tainted files, preventing the technique for authorized users only; it does not stop an already-privileged adversary from adding malicious content or block execution after tainting occurs.
T1083prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of access rights (including before role changes or termination) directly stops many unauthorized discovery attempts that rely on excessive or lingering permissions, but leaves the technique fully executable by any correctly authorized user or process and on files that do not require elevated rights.
T1087.003prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to directories and email systems) directly stops many authenticated sessions that would let an adversary run Get-GlobalAddressList or equivalent enumeration, but leaves open cases such as over-provisioned service accounts, temporary rights that expire after the fact, and insider abuse of already-granted rights.
T1098prevents — Requiring documented approval and maintaining a central record of access-right changes makes unauthorized account manipulation or privilege additions more detectable and harder to sustain.
T1098detects — A.5.18 mandates maintaining records of granted/changed access rights plus regular reviews (especially for privilege changes, role moves, or terminations), which surfaces anomalous manipulations after the fact but only for reviewed accounts and does not instrument real-time detection of the technique itself.
T1098.001prevents — A.5.18's provisioning/revocation process, authorization checks, timely removal on role change/termination, and record maintenance directly stop many unauthorized credential-addition paths (especially post-compromise persistence via legitimate accounts), but cannot block an adversary who already holds sufficient privileges to call the credential APIs themselves.
T1098.002detects — A.5.18 mandates maintaining records of granted/changed access rights plus regular reviews of those rights (especially after role changes or for privileged ones), which can surface anomalous delegations such as adversary-added mailbox permissions; this is genuine detection of the post-grant state but only a minority slice of the technique because it is after-the-fact, does not instrument the actual Add-MailboxPermission or delegation API calls, and leaves the bulk of in-flight or folder-level abuse undetected.
T1098.002prevents — A.5.18 mandates authorization, segregation of duties, timely revocation (especially on role/employment change), verification against access policies, and central records; this directly stops unauthorized permission grants like Add-MailboxPermission or folder delegation that adversaries use for persistence, with a bounded remainder for insider-abuse or post-compromise execution of the cmdlet itself.
T1098.003detects — A.5.18 mandates maintaining records of access rights changes plus regular reviews of (especially privileged) rights after role changes or terminations, which surfaces anomalous additions but only after the fact and only within the scope of those reviews; it does not instrument real-time detection of the API-driven role-attachment technique itself.
T1098.003prevents — A.5.18's provisioning/revocation process, authorization checks, segregation of duties, timely removal on role change/termination, and access-right reviews directly constrain the addition of unauthorized extra roles or IAM policy attachments to maintain persistence, but only for changes that route through the organization's defined approval and review gates; adversary-controlled accounts (especially external ones) and post-compromise modifications that bypass those gates remain outside its reach.
T1098.004prevents — A.5.18 mandates authorization, segregation, timely revocation, review before role/employment changes, and records for physical/logical access rights (including SSH keys as an authentication vector); this directly constrains the adversary technique of adding unauthorized keys for persistence/escalation on a bounded slice (managed identities, timely revocation, pre-change reviews), but leaves the dominant remainder (post-compromise direct file/API edits on running systems, unmonitored cloud metadata, network devices) untouched.
T1098.005detects — A.5.18 mandates maintaining records of access rights (incl. changes) and conducting regular reviews of physical/logical access rights (incl. after role changes or for privileged ones), which can surface anomalous device registrations as unauthorized access changes, but this is governance-oriented review after the fact and does not instrument or monitor for the technique in real time.
T1098.005prevents — A.5.18's provisioning/revocation process, authorization checks, segregation of duties, timely removal on role change/termination, and record maintenance directly block unauthorized device registration to adversary-controlled or compromised accounts in many cases, but self-enrollment paths needing only credentials, inactive accounts, and post-compromise registration remain unaddressed.
T1098.006detects — A.5.18 mandates regular reviews of access rights (especially after role changes, privilege escalations, or terminations) plus centralized records, which can surface unauthorized role additions like new RoleBindings/ClusterRoleBindings after the fact, but does not require continuous monitoring, anomaly detection, or real-time discovery of the modification itself.
T1098.006prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, role-change review, and pre-termination adjustment requirements directly stop an adversary from successfully adding unauthorized roles/permissions to maintain persistence, with a bounded remainder for post-compromise abuse of already-elevated legitimate sessions before detection or revocation.
T1098.007detects — A.5.18 mandates maintaining records of access rights and performing regular reviews (including after role changes or for privileged groups), which can surface unauthorized group additions to an adversary-controlled account; this is limited to post-facto review of granted rights rather than real-time detection of the addition technique itself.
T1098.007prevents — A.5.18's provisioning/revocation process, segregation-of-duties rules, timely removal on role change or termination, and explicit reviews of privileged-group memberships directly stop many legitimate-account-to-group additions that adversaries rely on for persistence, but cannot block covert abuse of already-authorized administrative sessions or unmonitored machine-account manipulations.
T1110prevents — A.5.18's provisioning, timely revocation, role-change reviews, and segregation-of-duties requirements stop many brute-force paths that rely on stale, over-privileged, or improperly authorized accounts, but do not address guessing strong passwords, offline hash cracking, or conditional-access bypasses once credentials exist.
T1110.001detects — A.5.18 mandates maintaining records of access rights, changes to them, and regular reviews (including after role changes or termination), which can surface anomalous or unauthorized access attempts like password guessing; however, it is governance-oriented and does not mandate technical detection mechanisms, real-time monitoring, or coverage of guessing on services/protocols.
T1110.001prevents — A.5.18 mandates provisioning/revocation processes, authorization, timely removal (esp. on termination/role change), temporary rights, and reviews that directly stop guessed passwords from succeeding against valid accounts; the named remainder is that it does not stop the guessing technique itself from being attempted against guessed or non-existent accounts.
T1110.002prevents — A.5.18's provisioning, timely revocation, role-change reviews, and pre-termination adjustment of logical access rights (incl. credentials) directly stop many cracked passwords from being usable for login, with a bounded remainder for unrevoked/legacy accounts and non-organizational cracking targets.
T1110.003prevents — A.5.18's provisioning, timely revocation, role-change reviews, and pre-termination adjustment of logical access rights (incl. to management/SSO services) directly stop valid credentials from remaining usable for spraying, with a bounded remainder for external/federated accounts or pre-revocation windows.
T1110.004prevents — A.5.18's provisioning, timely revocation, role-change reviews, pre-termination adjustments, and central records of access rights directly stop valid-but-stolen credentials (from unrelated breaches) from being usable on the target account, closing the overlap vector for most enterprise identities; the bounded remainder is external/SaaS/federated accounts or pre-provisioned service accounts where the control's authorization/review process has limited reach.
T1112prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of logical access rights (including to registry-modifying accounts) directly stops many unauthorized or excessive-privilege registry modifications that rely on improper accounts, but leaves the bulk of the technique (authorized admin-level registry changes used for evasion/persistence) untouched.
T1114prevents — A.5.18's provisioning, revocation, review, and adjustment of authorized access rights (including to mail servers/clients) directly stops many unauthorized collection paths when followed, but leaves open collection via already-authorized accounts, client-side theft after legitimate login, or forwarding rules set by a compromised insider.
T1114.001prevents — A.5.18's provisioning, revocation, review, and adjustment of logical access rights (including to local files/assets per business rules and segregation) can prevent an adversary from using a compromised or former user's account to reach .ost/.pst email files, but leaves the technique possible via other vectors such as direct filesystem access, unrevoked service accounts, or post-collection exfiltration.
T1114.002detects — A.5.18 mandates maintaining records of access rights and performing regular reviews (including for privilege changes or terminations), which can surface anomalous or unauthorized credential use that enables remote email collection, but this is governance-oriented detection after the fact and does not instrument or monitor the actual Exchange/Office 365 interactions or tool behaviors described.
T1114.002prevents — A.5.18's provisioning, revocation, review, and adjustment of authorized access rights (including for changed/terminated roles and privileged accounts) directly stops many credential-abuse paths to Exchange/Office 365 email collection, but leaves open social-engineering, phishing, and insider-abuse vectors that obtain valid rights the control itself would then honor.
T1114.003prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to email systems) directly stops unauthorized rule creation by insiders or post-compromise actors in the dominant user/admin case, but leaves the administrator/organization-wide transport-rule slice and hidden-MAPI abuse largely unreached.
T1133prevents — A.5.18's provisioning, review, revocation, and authorization of logical/physical access rights (including for remote services, VPNs, temporary accounts, and post-role-change removal) directly stops many T1133 vectors that rely on valid accounts or misconfigured external services, but leaves unauthenticated exposed services (e.g. Docker/K8s APIs) and post-compromise Tor hidden service setup untouched.
T1134.001prevents — A.5.18's provisioning, revocation, review, and least-privilege/segregation rules for logical access rights directly constrain many avenues for obtaining/using a stolen token, but the control is silent on runtime token duplication APIs, session hijacking mechanics, and enforcement of token integrity once a valid authenticated identity already exists.
T1134.002prevents — A.5.18's provisioning, revocation, review, and segregation-of-duties rules for logical access rights directly constrain the credential/privilege/token prerequisites the technique requires, but do not reach the Windows API surface or block an already-privileged actor who satisfies those prerequisites.
T1134.003detects — A.5.18 mandates maintaining records of access rights and performing regular reviews (including of privileged rights and post-role-change), which can surface anomalous or unauthorized token-based impersonation after the fact, but this is governance-oriented access review rather than runtime detection of the technique itself.
T1134.003prevents — A.5.18's provisioning/revocation, SoD, timely removal on role/employment change, and record-keeping directly stop many legitimate credential paths that adversaries would abuse with LogonUser+SetThreadToken to create and impersonate new tokens, but do not address the technique when the adversary already holds stolen credentials or can bypass the authorization step itself.
T1135prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of access rights (including to shares) directly stops many unauthorized discovery opportunities on SMB shares and network folders; it leaves the remainder of shares that are intentionally public or required for business functions, plus purely local enumeration that does not cross an access-control boundary.
T1136prevents — Authorization workflows and separation of duties reduce the likelihood that an adversary can create new local, domain, or cloud accounts without detection.
T1136.001prevents — Requiring documented approval before any new local account is provisioned makes covert creation of local accounts for persistence significantly harder.
T1136.002prevents — A.5.18 mandates authorization, segregation, timely revocation, reviews before role/employment changes, and records for all access rights (including domain accounts), which constrains unauthorized adversary creation/maintenance of such accounts; however, it is a governance process that does not technically block the net user command or other creation methods when an insider already holds sufficient privileges.
T1136.003detects — A.5.18 mandates maintaining central records of granted access rights plus regular reviews (especially after role changes or for privileged rights), which surfaces anomalous or unauthorized cloud account creations after the fact as part of access-right oversight.
T1136.003prevents — A.5.18 mandates authorization, segregation-of-duties, timely revocation, and review of all access rights (including before role changes or termination), which directly stops most unauthorized cloud-account creation by insiders or via compromised identities; residual attacker-controlled creation (external adversary, stolen privileged creds, or sanctioned-but-abused service principals) remains outside its reach.
T1137prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to Office applications and add-ins) can stop an adversary from registering or activating a persistence mechanism that requires elevated or unauthorized access, but leaves the dominant slice of T1137 (abusing default Office features like templates, rules, or macros that need no special rights) untouched.
T1137.001prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to files, templates, registry keys, and macro-enabled locations) can stop an adversary from placing or activating a malicious Office template, but leaves open the post-compromise case where the adversary already has the rights needed to modify templates or registry entries on a running system.
T1137.002detects — A.5.18 mandates maintaining records of access rights and performing regular reviews of those rights (including after role changes or termination), which can surface anomalous or unauthorized Registry-based persistence like the Office Test key when it grants elevated or unexpected access; this is limited to a slice because the control is scoped to rights review rather than broad anomaly or Registry monitoring.
T1137.002prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to registry-controlled persistence mechanisms) can stop an adversary from adding the Office Test key under an authorized identity, but leaves the technique fully available to any already-compromised account or to direct registry writes that do not route through the approved provisioning process.
T1137.003prevents — A.5.18's provisioning, revocation, review and pre-termination adjustment of logical access rights (including to mailboxes and add-ins) can stop an adversary from installing or retaining a malicious Outlook form, but leaves the initial code-execution vector and many non-privilege-based installation paths untouched.
T1137.004prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to mailboxes and Outlook configurations) can stop an adversary from adding or activating a malicious Home Page URL, but leaves open the post-compromise abuse path where the adversary already has a foothold inside an authorized session or mailbox.
T1137.005prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to mailboxes and associated assets) can stop an adversary from adding or retaining malicious Outlook rules on a compromised account, but this is only a slice of the persistence technique which also includes post-compromise mailbox manipulation that survives revocation or occurs via other vectors.
T1137.006detects — A.5.18's mandated reviews of access rights (especially after role changes, for privileged rights, and before termination) can surface anomalous add-in registrations that grant unauthorized persistence, but this is limited to post-grant review of rights rather than directly detecting the technique's execution or the add-in itself.
T1137.006prevents — A.5.18's provisioning, review, and timely revocation of logical access rights (incl. to Office-suite components) can stop unauthorized add-in registration that would enable the persistence technique, but this is only a slice: the control does not reach add-in code execution itself, Office-level trust/allow lists, or non-identity-based abuse vectors.
T1176prevents — A.5.18's provisioning, authorization, segregation, timely revocation, and review of logical access rights (including after role changes or termination) directly constrain unauthorized or malicious extension installation that relies on inherited host permissions or post-compromise access, but leaves open social engineering, marketplace compromise, and abuse of already-approved benign extensions.
T1176.001prevents — A.5.18's provisioning/revocation process, approval, segregation, timely removal on role change/termination, and record-keeping can block unauthorized or persistent malicious browser extensions when they rely on legitimate user or admin identities, but leaves untouched adversary-controlled installation vectors (file replacement, social engineering, compromised-system sideloading, update-url manipulation) that do not route through authorized access-right assignment.
T1199prevents — A.5.18's provisioning, review, revocation, and least-privilege-like checks on third-party access rights (including temporary, role-change, and pre-termination adjustments) directly constrain the elevated/trusted access that T1199 abuses, but cannot guarantee every external relationship is scoped, monitored, or removed in time to stop all leverage paths.
T1207prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review requirements for logical access rights (including privileged ones) constrain the Administrator/KRBTGT-level privileges needed to register a rogue DC, but do not address the underlying schema manipulation, DC simulation, or bypass of monitoring that the technique relies on.
T1213prevents — A.5.18 directly governs the provisioning, review, adjustment and timely revocation of logical access rights to information repositories (and the assets they contain), which stops the overly-broad or public access that the technique exploits; the bounded remainder is that it cannot prevent an already-authenticated insider from abusing their legitimate rights or an external-sharing feature that was intentionally enabled.
T1213.001prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to SaaS repositories like Confluence) directly stops many unauthorized repository accesses that would enable the mining technique, but leaves open cases such as already-compromised credentials, insider threats with legitimate rights, or misconfigured public/anonymous access.
T1213.002prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to SharePoint repositories) directly stops unauthorized identities from reaching the information the technique mines, with a bounded remainder for already-compromised credentials or insider abuse that the control does not address.
T1213.004prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to SaaS/CRM systems per business rules, segregation, and owner approval) directly stops many unauthorized accesses that would let the technique run, but leaves open the initial foothold vectors, insider abuse, and post-compromise privilege escalation that the technique's 'once adversaries gain access' premise assumes.
T1213.005prevents — A.5.18's provisioning, revocation, review, and adjustment of logical access rights (including to SaaS messaging apps and the sensitive data they contain) directly stops many unauthorized extractions of credentials, proprietary data, and internal links, but leaves open adversary use of already-permitted accounts, insider threats, and data already posted in chats.
T1213.006prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of access rights (including to databases) stops many unauthorized database-mining paths at the authorization boundary, but leaves residual vectors such as stolen credentials, misconfigured cloud IAM, insider abuse after legitimate grant, and direct exploitation of vulnerable DB services.
T1218.005detects — A.5.18's mandated reviews of access rights (especially after role changes, privilege grants, or termination) can surface anomalous or unauthorized use of mshta.exe as a living-off-the-land binary when tied to a user ID, but this is only a narrow slice of post-facto detection and does not address the technique's core proxy-execution or bypass mechanics.
T1218.008detects — A.5.18 mandates maintaining central records of access rights plus regular reviews (especially for privilege changes, role changes, or terminations), which can surface anomalous or unauthorized use of signed binaries like odbcconf.exe for DLL proxying, but this is indirect governance/logging rather than specific behavioral detection of the technique.
T1218.008prevents — A.5.18's provisioning, revocation, review, and least-privilege-style rules for logical access rights (including segregation of duties and timely removal) can prevent an adversary from obtaining the authorized identity needed to run odbcconf.exe, but do not stop abuse of a legitimately authorized signed binary once that identity exists
T1218.012detects — A.5.18's mandated central record of granted access rights plus regular reviews (especially of privileged rights and post-role-change) can surface anomalous or unauthorized use of verclsid.exe as a living-off-the-land binary, but only for the subset of executions tied to identity or privilege anomalies rather than the technique's core proxy-execution mechanics.
T1218.014prevents — A.5.18's provisioning, revocation, review, and least-privilege-style checks on authorized access rights (including segregation of duties and timely removal) directly stop many unauthorized uses of mmc.exe/.msc for malicious execution, but leave open the remainder where an already-authorized administrative identity or snap-in is abused.
T1219prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of authorized access rights (including segregation of duties and least-privilege alignment) can block unauthorized installation/use of remote access tools by legitimate accounts or prevent persistence via inherited permissions, but leaves the post-compromise abuse of already-approved tools, EDR response features, and built-in modules (e.g. Chrome Remote Desktop) untouched.
T1219.002detects — A.5.18's reviews of access rights (post-change, privileged, pre-termination) can surface anomalous or unauthorized use of remote desktop tools by insiders or departing users, but this is governance-oriented and does not instrument or detect the technique's runtime execution on Linux/macOS/Windows.
T1219.002prevents — A.5.18's provisioning, review, revocation and approval of logical access rights (incl. to remote-desktop/RMM tools) can stop unauthorized use of such software for C2 on a per-identity basis, but leaves the technique available to any approved user or admin and does not constrain the software's presence or legitimate execution paths.
T1222prevents — A.5.18's provisioning, review, revocation, SoD, and pre-termination adjustment of access rights (including owner authorization and ACL consistency) directly constrain improper permission modifications by non-owners or unauthorized entities, but leave open adversary abuse of already-elevated/owned sessions or post-compromise changes that the control does not reach.
T1484detects — A.5.18 mandates regular reviews of access rights (especially privileged ones) and pre-change/termination reviews based on risk factors, which can surface unauthorized or anomalous policy modifications after they occur, but this is governance-oriented access-right auditing that does not instrument or detect the live technique itself.
T1484prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review processes for logical access rights directly constrain the 'sufficient permissions' prerequisite for an adversary to modify domain/tenant policy (GPOs, trusts, federation settings), but do not stop an already-authorized insider or compromised account from performing the modification.
T1484.001prevents — A.5.18's provisioning, revocation, review, and authorization of logical access rights (including to AD objects like GPOs) directly constrains who can obtain the delegated write permissions needed to modify them, preventing the technique for properly managed identities; it leaves the remainder of already-compromised accounts, misconfigurations, or un-reviewed privileged rights.
T1484.002detects — A.5.18 mandates regular reviews of access rights (especially privileged ones) and pre-change/termination reviews, which can surface anomalous trust modifications after they occur as unauthorized privilege or configuration changes.
T1485.001prevents — A.5.18 mandates authorization, segregation of duties, timely revocation on role/employment change, and verification of access rights per policy, which directly constrains the 'sufficient permissions' prerequisite for an adversary to call PutBucketLifecycle or equivalent; this prevents the technique for many insider and former-user vectors but leaves a bounded remainder (e.g., initial over-provisioning, compromised credentials, or external adversary paths not tied to lifecycle-triggered identity changes).
T1496.004prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to SaaS) directly stops many hijacking paths that rely on stolen credentials, over-provisioned accounts, dormant rights, or insider-enabled services, but leaves intact compromise vectors such as phishing, MFA bypass, or supply-chain credential theft that are outside its defined scope.
T1526prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of access rights (including to cloud resources and identities) directly stops many discovery-enabling permissions from being granted or retained, but cannot prevent all post-compromise enumeration that uses already-authorized identities or public APIs.
T1528prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (including tokens) directly stops many post-compromise or post-grant theft paths (e.g. lingering service-account tokens, OAuth grants, CI/CD tokens), but leaves the initial social-engineering OAuth consent, container compromise that steals an already-active token, and IMDS token-request vectors untouched.
T1530prevents — A.5.18's provisioning, revocation, review, and authorization of logical access rights (including to cloud storage objects via IAM) directly stops the misconfigured overly-broad/public/unauthenticated access and leaked-credential abuse vectors that enable T1530; the bounded remainder is post-compromise adversary-in-the-middle or insider abuse after rights are correctly granted.
T1537detects — A.5.18 mandates maintaining records of access rights and performing regular reviews (including of privileged rights and post-role-change), which can surface anomalous or unauthorized internal cloud account sharing/sync/backup transfers after they are authorized or used, but does not require monitoring of the transfers themselves or detection of adversary-controlled accounts.
T1537prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of access rights (including segregation of duties, owner authorization, and timely removal) directly stops many insider or post-compromise account abuses that enable T1537 transfers to adversary-controlled cloud accounts, but leaves the initial compromise vector, misconfigured public shares/SAS links, and external adversary-created accounts unaddressed.
T1538prevents — A.5.18's provisioning, timely revocation (esp. on role change/termination), approval, segregation, and review processes directly stop stolen or unneeded credentials from remaining usable to reach the dashboard, closing the dominant credential-abuse vector; the bounded remainder is post-compromise dashboard use while the credential is still authorized.
T1539detects — A.5.18's mandated reviews of access rights (especially after role changes, termination, or for privileged rights) and its central record of granted rights can surface anomalous or unauthorized session-cookie usage after the fact, but this is governance-focused access-right hygiene that does not instrument or observe the actual theft vectors (malware, JS injection, MitM, memory scraping) described in the T1539 prose.
T1539prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (including authentication tokens) directly stops many session-cookie reuse paths that rely on stale, transferred, or post-employment credentials, but leaves the dominant acquisition vectors (malware theft from browser memory/disk, JS injection, and AiTM phishing proxies) untouched.
T1543.002prevents — A.5.18 mandates authorization, segregation of duties, timely revocation, and review of access rights to service-related assets (files, directories, privileged accounts), which stops many unauthorized creations/modifications of systemd services but leaves gaps for unmonitored generators, symbolic links, or post-authorization tampering on Linux systems.
T1543.003prevents — A.5.18 mandates authorization, segregation of duties, timely revocation, and review of access rights (including privileged ones) before changes or termination, which constrains many service-creation paths that require elevated rights or registry changes but leaves attacker-controlled admin/SYSTEM sessions and direct API/registry abuse as a substantial unaddressed remainder.
T1543.004prevents — A.5.18's provisioning, authorization, segregation, timely revocation, and review of logical access rights (including to system assets like plist files and executables) directly blocks unauthorized creation/modification of Launch Daemons by non-privileged or improperly authorized entities, but leaves open the elevated-privilege installer path, poor configurations enabling write access, and masquerading that the control does not address.
T1543.005prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review of logical/physical access rights (especially for privileged roles and role changes) directly constrain the adversary's ability to obtain or retain the elevated access needed to create/modify container services, but leaves open vectors such as initial compromise via unmonitored service accounts, misconfigured defaults, or exploitation after legitimate access is granted.
T1546prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned access rights directly constrain who can create/modify event triggers or run them under elevated accounts, blocking many (but not all) abuse paths for persistence and privilege escalation.
T1546.002detects — A.5.18 mandates maintaining records of access rights and performing regular reviews of (especially privileged) access rights, which can surface anomalous registry changes or unexpected screensaver executables tied to user accounts, but does not require monitoring, anomaly detection, or real-time discovery of the persistence mechanism itself.
T1546.003detects — A.5.18 mandates maintaining records of granted access rights plus regular reviews (especially of privileged rights and post-role-change/termination), which can surface anomalous WMI subscriptions that abuse privileged access, but this is only a minority slice of the technique's full scope (stealthy event filters, MOF compilation, non-privileged persistence).
T1546.004prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (incl. to files like /etc/profile and ~/.bash_* that require elevated perms) directly stops many unauthorized insertions that establish the persistence, but leaves a bounded remainder where an already-authorized insider or un-reviewed privileged change still succeeds.
T1546.007detects — A.5.18's regular reviews of access rights (especially privileged ones) and pre-termination/change reviews can surface anomalous or unauthorized Netsh helper DLL registrations as a form of privileged persistence, but this is only a minority slice of the technique's possible abuse vectors and does not mandate detection mechanisms.
T1546.012detects — A.5.18 mandates maintaining records of access rights changes and regular reviews of (especially privileged) access rights, which can surface anomalous IFEO Registry modifications as unauthorized privilege or persistence changes; this is genuine but only a minority slice of the full technique surface (silent-exit monitors, login-screen backdoors, defense-impairment via invalid debuggers).
T1546.013prevents — A.5.18 mandates authorization, segregation of duties, timely revocation on role/employment change, and review of privileged access rights; this constrains the administrative modification of shared or elevated profiles that the technique relies on, but leaves unmodified user-level profiles, -NoProfile bypasses, and non-privileged persistence vectors as a large residual slice.
T1547.001prevents — A.5.18's provisioning, review, and timely revocation of logical access rights (including after role changes or termination) directly stops many unauthorized Registry-run-key or startup-folder entries that rely on an account's permissions, but leaves the technique possible via system-level keys, policy overrides, or pre-existing admin-equivalent access that the control does not reach.
T1547.004prevents — A.5.18 mandates authorized, reviewed, and timely revoked logical access rights (including to registry-controlled mechanisms like Winlogon keys), which constrains who can perform the malicious modifications needed for this persistence technique; however, it does not reach the technical enforcement of those keys, privilege boundaries, or code-level abuse once rights exist.
T1547.009prevents — A.5.18's provisioning, authorization, segregation, timely revocation, and review of logical/physical access rights (including before role changes or termination) directly constrain who may legitimately create or modify startup shortcuts on Windows, preventing the technique for authorized identities; it leaves the full remainder of post-compromise abuse by already-authorized malicious code or insiders.
T1547.010prevents — A.5.18's access-right provisioning, authorization, segregation-of-duties, timely revocation, and record-keeping requirements directly constrain the permission to write the Driver value or call AddMonitor, but do not reach the boot-time loading behavior itself or the SYSTEM-level execution once the monitor is registered.
T1547.012prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review of logical access rights (including privileged ones) directly constrain the SeLoadDriverPrivilege and registry/driver-install steps an adversary must perform, but cannot stop a sufficiently privileged insider or already-compromised account from completing the technique.
T1547.014detects — A.5.18's regular reviews of access rights (especially after role changes, privilege reviews, and pre-termination adjustments) can surface anomalous or unauthorized Registry modifications under Active Setup as part of access-right drift, but this is indirect governance review rather than technical detection of the persistence technique itself.
T1547.015prevents — A.5.18's provisioning/revocation process, authorization checks, segregation of duties, timely removal on role change/termination, and record maintenance directly stop unauthorized or malicious login items from being added or persisting at user login on macOS, but only for the subset of cases involving legitimate user or admin identities rather than pure adversary API/script abuse before any identity is granted.
T1548prevents — A.5.18's provisioning, authorization, segregation, timely revocation, role-change adjustments, and reviews directly close the improper-granting and stale-elevation slices of T1548; the bounded remainder is post-authorization circumvention techniques that abuse a correctly issued elevation path.
T1548.002prevents — A.5.18's provisioning, revocation, segregation-of-duties, timely removal on role/employment change, and record-keeping requirements constrain many privilege-escalation paths that rely on stale, over-provisioned, or improperly approved admin rights, but do not stop UAC bypass techniques that exploit auto-elevation, COM objects, or process injection without depending on mis-provisioned accounts.
T1548.003prevents — A.5.18's provisioning, review, revocation, least-privilege enforcement, and sudoers-aware rules directly stop most misconfigurations and stale sudo rights that enable T1548.003; residual risk remains from runtime sudo caching or admin-approved NOPASSWD entries that the control does not universally forbid.
T1548.004prevents — A.5.18's provisioning, review, and timely revocation of authorized access rights (including segregation of duties and pre-termination adjustments) constrain many privilege-escalation paths that rely on unauthorized or lingering rights, but the technique's core abuse of a deprecated macOS API that bypasses origin/integrity checks and prompts the user directly is not prevented by access-right governance alone.
T1548.005detects — A.5.18 mandates maintaining records of granted/changed access rights plus regular reviews of those rights (especially privileged and post-role-change ones), which can surface misconfigurations that enable temporary elevated access; this is genuine but limited to after-the-fact review of static assignments rather than runtime detection of technique execution.
T1548.005prevents — A.5.18's provisioning, review, temporary-rights, approval, segregation, timely revocation and pre-change/termination adjustment requirements directly constrain the misconfigurations and permission structures that enable just-in-time elevation, impersonation and role-passing abuses, leaving only a bounded remainder (e.g., zero-day misconfigs or insider-approved escalations that still require separate detection).
T1548.006prevents — A.5.18's provisioning, revocation, review, and approval rules for logical access rights (including segregation of duties and timely removal) directly constrain improper TCC permission grants and database manipulation on macOS, but leave open the bypass vectors when SIP is disabled, via injection into already-authorized processes, or via MDM overrides.
T1550prevents — A.5.18's provisioning, timely revocation, role-change reviews, and pre-termination adjustment of logical access rights (incl. to alternate auth material like tickets/tokens) directly stops many misuse cases after identity changes or departures, but leaves the initial theft of live material (via TA0006) and use by still-authorized entities unaddressed.
T1550.001prevents — A.5.18's provisioning, timely revocation, role-change review, SoD, and pre-termination adjustment of logical access rights directly stop many stolen-token abuse paths (esp. persistent OAuth/refresh tokens and post-credential-change sessions), but the control is silent on token theft itself, short-lived token issuance, misconfigured delegation that allows token requests, and detection of in-use stolen tokens.
T1550.002prevents — A.5.18's provisioning, revocation, timely removal on role/employment change, and review of access rights (especially privileged ones) constrain which accounts can be abused for PtH, but do not stop hash capture, hash-based auth bypass, or overpass-the-hash variants once a valid hash exists.
T1550.003prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of access rights (including privileged ones) directly stop many stolen-ticket PtT scenarios that rely on lingering or over-privileged valid accounts, but leave the initial credential-dump vector, golden/silver ticket forgery from KRBTGT hashes, and overpass-the-hash paths untouched.
T1550.004prevents — A.5.18's provisioning/revocation, timely removal on role change/termination, temporary rights, and reviews directly stop many session-cookie abuse paths that rely on stale, over-privileged, or ex-employee credentials, but cannot prevent theft or replay of a still-valid cookie obtained from an active authorized session.
T1552.004prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to keys/certificates) directly stops many insecure storage and export paths when followed, but leaves residual cases such as already-compromised systems, device-generated keys, network-device CLI export, and passphrase-protected keys that the control does not address.
T1552.005prevents — A.5.18's provisioning, revocation, review, and least-privilege-style adjustment of logical access rights (including to metadata APIs and credentials) can stop many authorized identities from reaching the Instance Metadata API or the credentials it returns, but does not address the SSRF vector that bypasses those rights or instances where the API remains broadly accessible by design to any process on the instance.
T1552.006prevents — A.5.18's provisioning, revocation, review, and least-privilege rules for logical access rights (including to SYSVOL and domain policies) can stop many users from reaching GPP XML files or the embedded credentials, but the technique's core (admins legitimately embedding creds in GPP, public AES key, and any authenticated domain user's default read access to SYSVOL) is not prevented by access-right controls.
T1552.007prevents — A.5.18's provisioning, revocation, review, and authorization of logical access rights (including segregation of duties and timely removal) directly constrains the 'sufficient permissions' and service-account vectors that enable T1552.007, but leaves the technique possible via misconfigurations, overly broad defaults, or non-identity-based exposures such as unsecured Docker daemons.
T1555prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of access rights (including to credential stores) directly stops many authorized accounts from remaining usable for T1555, but leaves the technique fully available against unrevoked accounts, shared/privileged credentials, and non-user-managed stores such as application or cloud vaults.
T1555.004prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (including to credential stores) can stop many authorized-user abuse paths and insider credential dumping, but leaves the dominant post-compromise/abuse-of-credential techniques (Mimikatz-style API/file access by malware) untouched.
T1555.006detects — A.5.18 mandates maintaining records of granted/revoked access rights plus regular reviews (especially for privilege changes and terminations), which can surface anomalous or excessive privileges that enable secret retrieval, but this is governance/review after the fact and does not instrument or detect the actual API-based technique in flight.
T1555.006prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of logical access rights (including to secrets managers) directly stops many privilege paths that would let an adversary request secrets, but cannot prevent all vectors such as initial cloud account compromise or service compromise that still satisfy the authorized-identity check.
T1556prevents — A.5.18's provisioning, review, and timely revocation of authorized access rights (including before role changes or termination) directly stops many T1556 sub-techniques that rely on abusing or persisting through legitimate accounts/credentials, but leaves untouched the core modification of low-level auth mechanisms like LSASS, SAM, or PAM that can bypass those controls entirely.
T1556.003prevents — A.5.18's provisioning, revocation, segregation-of-duties, and pre-termination review requirements constrain who may legitimately modify PAM components or grant the privileges needed to do so, thereby preventing many (but not all) paths to the backdoor or credential-harvesting modifications named by the technique.
T1556.005prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review requirements (especially before role/employment changes) constrain who can enable reversible encryption and detect/adjust it post-change, but do not stop an already-privileged adversary from setting the property via GPO, FGPP, or PowerShell as described.
T1556.006prevents — A.5.18's provisioning, revocation, review, and approval processes for access rights (including MFA mechanisms as part of logical access) constrain many abuse paths such as unauthorized registration of new MFA methods, exclusion from policies, or post-compromise changes, but do not stop all (e.g., patching binaries, hosts-file redirection, or fail-open bypasses after initial access).
T1556.008prevents — A.5.18's provisioning, authorization, segregation, timely revocation, and review of logical access rights (including privileged ones and before role/employment changes) directly constrain who may legitimately register or modify network provider DLLs in the Registry, preventing the technique for authorized identities; it leaves the post-compromise or insider-abuse slice untouched.
T1556.009prevents — A.5.18's provisioning, review, and revocation processes for access rights (including segregation of duties, timely removal on role change/termination, and verification against access policies) directly constrain an adversary's ability to modify conditional access policies as a persistence technique, but only for a minority slice (e.g., insider-driven or post-compromise role changes) while leaving the dominant technical modification path (e.g., via compromised privileged accounts in IAM/IdP) untouched.
T1558prevents — A.5.18's provisioning, revocation, review, and timely removal of access rights (including after role changes or termination) directly constrains the unauthorized credential use that T1558 enables via stolen or forged Kerberos tickets, but leaves the initial theft/forgery vector and many technical Kerberos abuses untouched.
T1558.001detects — A.5.18 mandates maintaining records of access rights and performing regular (including post-change/termination) reviews of those rights, which can surface anomalous or unauthorized privileged access patterns consistent with golden ticket use; this is limited to after-the-fact review of granted rights rather than real-time detection of forgery or KDC interaction.
T1558.001prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of access rights (including privileged ones) constrain how the KRBTGT hash can be obtained or abused, but do not stop an already-compromised hash from being used to forge golden tickets.
T1558.002prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of logical access rights (incl. to service accounts) can stop an adversary from legitimately obtaining or retaining the service-account hash needed to forge a silver ticket, but leaves the dominant acquisition paths (OS credential dumping, Kerberoasting) and post-compromise forgery untouched.
T1558.003prevents — A.5.18's provisioning, revocation, review, and least-privilege/segregation rules for logical access rights directly constrain service-account SPN assignments and overly permissive service logon accounts that make Kerberoasting feasible, but cannot eliminate the core protocol behavior (TGT requests for any SPN, RC4 etype 23 tickets) that remains available to any authenticated domain user.
T1558.004prevents — A.5.18's provisioning, revocation, review, and pre-change/termination adjustment of access rights (including for privileged accounts) can prevent accounts from being left with disabled preauthentication or other weak states that enable AS-REP roasting, but this is only a slice of the class (which also turns on insecure algorithms like RC4, enumeration via LDAP/PowerShell, and the existence of any such accounts at all).
T1558.005prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (including credentials and authentication artifacts) directly stops many ccache-file theft paths by ensuring stale or unneeded tickets are removed before an adversary can collect them; it leaves a bounded remainder for active-session tickets that an already-authenticated adversary can still read from /tmp or memory before revocation occurs.
T1563prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (incl. to remote services) directly stops many hijackable sessions from remaining available or being granted to the wrong entity, but leaves residual cases such as in-session hijacking after a legitimate user has an active authorized session or theft of active session tokens.
T1563.001detects — A.5.18 mandates maintaining records of access rights, changes to them, and regular reviews of (especially privileged) rights after role changes or termination; these can surface anomalous or unauthorized SSH agent/socket access or hijack-enabling trust relationships after the fact, but only as a minority slice of the technique's core (agent compromise or root-level socket access on an already-compromised host).
T1563.001prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (incl. SSH keys/sessions) directly stops many hijack paths that rely on stale or over-provisioned agent sockets and trust relationships, but leaves the root-compromise and active-session hijack vectors untouched.
T1563.002detects — A.5.18 mandates maintaining records of access rights, changes to them, and regular reviews (including after role changes or termination), which can surface anomalous RDP session hijacking or unauthorized session use after the fact, but this is governance/review activity that does not instrument or monitor for the live technique itself.
T1563.002prevents — A.5.18's provisioning, timely revocation, role-change review, and pre-termination adjustment of logical access rights (including to RDP sessions) directly stops many hijack paths that rely on stale, over-privileged, or improperly transferred sessions; it leaves open the remainder where an already-authorized active session is stolen via tscon.exe with System privileges.
T1564.002prevents — A.5.18 mandates defined/authorized provisioning, revocation on role/employment change, segregation of duties, and regular reviews of access rights (including privileged ones), which directly stops many unauthorized hidden-account creations or modifications; it leaves a remainder on adversary-controlled Display Managers, plist/registry edits, and post-compromise changes that bypass the approval process.
T1565prevents — A.5.18's access-right provisioning, revocation, segregation-of-duties checks, and pre-termination reviews directly stop many unauthorized identities from ever reaching the data or privileged tools needed to insert/delete/manipulate it, but the control is silent on runtime integrity enforcement, input validation, or authorized users who themselves become malicious.
T1567.001prevents — A.5.18's provisioning, revocation, review, and approval of logical access rights (incl. to external services via authenticated identities) can stop an insider or compromised account from gaining or retaining the rights needed to exfiltrate to a code repo API, but leaves the external service's own auth model, popular-service cover, and non-identity-based vectors (e.g. stolen tokens, public repos) untouched.
T1574.001prevents — A.5.18's provisioning, revocation, review, and least-privilege-like checks on authorized access rights (including segregation of duties and timely removal) constrain who may legitimately place or modify DLLs in privileged/search-order locations, blocking many sideloading/hijacking vectors at the authorization layer; it leaves technical planting/substitution methods available to already-authorized processes or insiders.
T1574.005prevents — A.5.18's provisioning, revocation, review, and authorization of logical/physical access rights (including segregation of duties and least-privilege alignment) directly constrains improper permission settings on installer binaries/directories that enable the hijack, but leaves residual cases such as third-party installers, TEMP subdir creation by unvetted software, and runtime permission weaknesses not caught by access-right reviews.
T1574.009prevents — A.5.18's provisioning, review, and revocation of authorized access rights (including segregation of duties, least-privilege checks, and timely removal on role change/termination) can block the elevated-privilege or persistence outcomes of this hijack when the vulnerable path is tied to a privileged process or service, but does not address the root cause of unquoted paths in configurations or prevent placement of the malicious executable itself.
T1574.010prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of logical access rights (including to service binaries and directories) directly stops improper permission settings that enable the hijack on the bulk of managed identities and assets, but leaves a bounded remainder for unmanaged services, legacy binaries, and post-provisioning filesystem changes outside the access-rights process.
T1574.011prevents — A.5.18 mandates proper provisioning, authorization, review, and timely revocation of logical access rights (including to Registry keys via ACLs), which directly prevents the improper permissions that enable this hijacking technique; however, it is only a process-level requirement that does not itself enforce specific ACL settings on HKLM\SYSTEM\CurrentControlSet\Services or its subkeys.
T1574.012prevents — A.5.18's provisioning, revocation, review, and least-privilege-style checks on authorized access rights (including segregation of duties and timely removal) constrain who can legitimately set or modify the registry/environment variables and DLL registrations that enable the technique, but do not stop in-memory process-scope abuse, developer-intended profiler loading, or post-compromise privilege elevation within an already-authorized .NET process.
T1578.003detects — A.5.18's mandated reviews of access rights (especially after role changes, termination, or for privileged rights) and its central record of granted rights can surface anomalous deletions or privilege abuse that precede or accompany T1578.003, but the control is scoped only to access-right hygiene and does not require monitoring of the deletion action or cloud-instance lifecycle events themselves.
T1580prevents — A.5.18's provisioning, revocation, review, and least-privilege-aligned authorization of access rights (including timely removal on role change/termination and segregation of duties) stops many unauthorized or over-privileged accounts from being able to call discovery APIs, but cannot prevent discovery performed with already-compromised valid credentials that remain authorized for the queried resources.
T1584.001prevents — A.5.18's provisioning/revocation process, authorization checks, timely removal on role/employment change, and segregation of duties directly block unauthorized domain registration or subdomain takeover via deprovisioned resources or renewal gaps, but leave social engineering of help desks, email compromise for password reset, and cloud service compromise (e.g. AWS Route53) largely unreached.
T1586prevents — A.5.18's provisioning/revocation, timely removal on role change/termination, segregation of duties, and reviews directly close many insider-enabled or poorly-managed account compromise vectors (e.g., purchased credentials from employees, lingering access after departure, over-privileged accounts), but leave the bulk of external methods (phishing for credentials, brute-force of third-party breaches, reconnaissance-driven compromise of unrelated personas) untouched.
T1586.003prevents — A.5.18's provisioning, authorization, review, timely revocation, and segregation requirements for logical access rights (including cloud accounts) stop many compromise paths that rely on weak, stale, over-privileged, or improperly approved credentials, but do not address upstream methods such as phishing-for-information, password spraying, token theft, or reconnaissance that occur before any access-right decision point.
T1602.001prevents — A.5.18's provisioning, revocation, review, and authorization of logical access rights (including to network devices) can block unauthorized SNMP queries that rely on valid credentials or excessive privileges, but does not address unauthenticated SNMP exposure, weak community strings, or misconfigured read-only access on the devices themselves.
T1602.002prevents — A.5.18's provisioning, revocation, review, and authorization of logical access rights (including to network devices and their configs via management protocols) directly stops many unauthorized accesses that would enable T1602.002, but leaves open slices such as initial foothold via other vectors, misconfigured defaults, or unmonitored SNMP/SMI that still allow the technique.
T1606.002prevents — A.5.18's provisioning, review, revocation, SoD, and pre-termination adjustment of logical access rights (including privileged ones) directly constrain who can legitimately obtain or retain a signing certificate or federation trust, blocking the prerequisite access that enables forging; this is a genuine but minority slice of the technique whose dominant vector is post-compromise key theft or permission abuse.
T1609prevents — A.5.18's provisioning, authorization, segregation-of-duties, timely revocation, and review processes for logical access rights directly stop adversaries from obtaining the permissions needed to abuse container admin services (Docker daemon, kube-apiserver, kubectl exec, etc.), with only a bounded remainder for misconfigurations or insider abuse after rights are granted.
T1611prevents — A.5.18's provisioning, revocation, segregation-of-duties, and pre-termination review of access rights (especially privileged rights) can stop many misconfigurations that enable container escapes (e.g., overly permissive bind mounts, privileged containers, or docker.sock exposure), but leaves untouched kernel exploits, unshare/keyctl abuse, and hypervisor vulnerabilities that do not rely on granted access rights.
T1619prevents — A.5.18's provisioning, revocation, review, and authorization of logical access rights (including to cloud assets per business/policy rules and segregation) stops unauthorized identities from calling discovery APIs like ListObjectsV2, but does not stop authorized/privileged users or misconfigured buckets from performing the technique.
T1621prevents — A.5.18's provisioning, timely revocation, role-change reviews, and pre-termination adjustment of access rights (including MFA factors) can block credentialed adversaries from generating MFA requests or exploiting fatigue on accounts that should no longer have active rights, but leaves the dominant social-engineering/fatigue slice and mis-provisioned accounts untouched.
T1649prevents — A.5.18's provisioning, review, revocation and segregation rules for access rights (including to certificate material and enrollment) constrain many certificate theft/forgery vectors that rely on improper rights or stale accounts, but do not reach root-CA key protection, enrollment misconfigurations, or all certificate-store/crypto-API theft paths.
T1651prevents — A.5.18's provisioning, revocation, segregation-of-duties, and pre-termination review requirements constrain who can legitimately obtain or retain the administrative cloud accounts needed to abuse management services, but do not stop an already-authorized admin (or a compromised delegated account) from issuing the command.
T1657prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of authorized access rights (especially for privileged accounts and role changes) directly stops many technical-theft and BEC vectors that rely on unauthorized or lingering access, but leaves social engineering, extortion/ransomware, and non-access-based financial fraud untouched.
T1666prevents — A.5.18 mandates authorization, segregation of duties, timely revocation on role/employment change, and review of privileged rights before hierarchy-altering actions can be performed with legitimate credentials; this stops many insider or compromised-account modifications but leaves the technique possible via stolen Global Administrator or equivalent high-privilege access that already satisfies those checks.
T1669prevents — A.5.18's provisioning, revocation, review, and authorization of logical/physical access rights (including for accounts used on secured Wi-Fi) directly stops the Valid Accounts path to T1669 but leaves the open-Wi-Fi, physical-proximity, and dual-homed-bridge vectors untouched.
T1671detects — A.5.18 mandates maintaining central records of granted access rights plus regular reviews (especially for privilege changes, role changes, and post-termination), which surfaces anomalous or malicious OAuth consents/integrations after the fact as part of access-right oversight.
T1671prevents — A.5.18 mandates authorization, segregation-of-duties, timely revocation on role/employment change, and review of privileged rights; these directly stop many consent-granting and persistence-via-integration paths (especially those tied to compromised or departing accounts), but leave open adversary-controlled high-priv accounts that can still authorize new malicious OAuth apps or service principals, which is a genuine unbounded remainder of the technique.
T1684prevents — A.5.18's provisioning, review, approval, segregation-of-duties, and timely revocation requirements directly constrain the 'user-authorized actions' (password resets, MFA changes, approvals) that T1684 elicits via social engineering, but do not stop the adversary from influencing the user or the initial deceptive interaction itself.
T1685.002prevents — A.5.18's provisioning, revocation, review, and pre-termination adjustment of access rights (including privileged ones) can block adversaries from obtaining the permissions needed to disable/modify logging, but leaves open paths such as initial over-provisioning, insider abuse of already-granted rights, or non-identity vectors like license downgrades.

Prevented OWASP Web Top 10 (2025) risks (7)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A06←P A07←P A09←M A10←P

Why these map — AI rationale (under review)

A01mitigates — A.5.18's provisioning, revocation, review and pre-termination adjustment of access rights directly bounds the blast radius and duration of many realized authorization failures (e.g. IDOR, missing function-level checks) by ensuring rights are timely removed or adjusted when they should not exist, but leaves the authorization-decision logic itself untouched and does not address path traversal or CSRF.
A01prevents — A.5.18 directly governs the provisioning, review, adjustment and revocation of logical access rights according to business rules, segregation of duties and policy, which squarely prevents the authorization-decision slice of A01 (missing checks, incorrect authorization, improper privilege assignment); it leaves untouched the non-authorization members of the category such as path traversal, CSRF and information exposure through sent data.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.