Cyber Resilience

← ISO 27001 Annex A

A.5.7 Organizational

Threat intelligence

AttributesPreventive Detective Corrective C·I·A Identify Detect Respond Threat and vulnerability management Defence Resilience

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (15)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

IR-4←P →P RA-10←M SI-4→P SI-5←M →M PM-16gov RA-3gov

Why these map — AI rationale (under review)

RA-10mostlyaligns with — Both controls establish a dedicated threat-hunting/intelligence capability that feeds risk decisions and defensive controls with timely, contextual adversary information.
RA-3mostlyaligns with — Threat-intelligence outputs are explicitly required as an input to the organization’s risk-assessment process, improving the accuracy and relevance of risk determinations.
SI-5mostlycovers — A.5.7's focus on gathering and using threat intelligence to drive mitigation actions accounts for the bulk of SI-5's receive/generate/disseminate/implement loop for security alerts and advisories, but leaves a residual slice (formal directives, mandatory time-bound implementation, and explicit notification of non-compliance) uncovered by the source.
IR-4partialaligns with — Threat-intelligence products are used to inform and improve incident-handling decisions and response actions.
PM-16partialaligns with — Both emphasize an enterprise-level program that gathers, analyzes, and disseminates threat information to raise organizational awareness and preparedness.
SI-4partialaligns with — Operational threat intelligence is consumed by monitoring and detection mechanisms to enhance situational awareness and response tuning.
SI-5partialaligns with — The control requires the collection and internal dissemination of threat-related alerts and directives, mirroring the ISO threat-intelligence sharing and communication activities.
PM-16implements — PM-16 operationalizes the threat-awareness and information-sharing outcomes that sit inside the broad threat-intelligence domain named by A.5.7; the link is by subject membership rather than explicit citation of a program.
RA-10covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (16)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

ID.RA-02←F →F DE.AE-03gov DE.AE-07gov GV.SC-03gov ID.RA-03gov ID.RA-05gov RS.CO-03gov

Why these map — AI rationale (under review)

ID.RA-02fullcovers — The ISO control's systematic collection, analysis, and integration of threat intelligence directly fulfills the CSF outcome of receiving cyber threat intelligence from external and internal sources.
DE.AE-07mostlyaligns with — By requiring threat intelligence to be contextualized and integrated into analysis, the control supports the CSF outcome of incorporating threat intelligence and contextual data into adverse-event analysis.
ID.RA-05mostlyaligns with — Feeding threat-intelligence insights into risk-management processes helps the organization understand inherent risk and prioritize responses, matching the CSF outcome.
GV.SC-03partialaligns with — Sharing threat intelligence with peer organizations and integrating it into risk processes aligns with the CSF outcome of embedding supply-chain risk management into broader enterprise risk activities.
ID.RA-03partialaligns with — The control's focus on external and internal threat information contributes to the identification and recording of threats, though it does not itself mandate the initial threat-identification step.
DE.AE-07implements — A.5.7's operational process of gathering and sharing threat intelligence directly gives effect to DE.AE-07's requirement that cyber threat intelligence be integrated into analysis; the link is within the shared domain but not by explicit citation of one in the other.
GV.SC-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.RA-03implements — A.5.7's operational collection and sharing of threat intelligence directly gives effect to the identification-and-recording outcome named in ID.RA-03 within the risk-assessment domain
ID.RA-05implements — A.5.7's operational collection and sharing of threat intelligence directly gives effect to the threat-portion of ID.RA-05's risk-understanding requirement within the shared risk-assessment domain

Related OWASP ASVS 5.0 requirements (10)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V13.2.4→P V15.1.2←P V15.2.1→P V16.3.1←P V16.3.3←P →P V2.4.1→P V6.2.12←M V6.2.4←P V6.3.1→P

Why these map — AI rationale (under review)

V13.2.4partialaligns with — Operational threat intelligence supplies the vetted external indicators used to maintain the allow-list of permitted external resources and systems.
V15.2.1partialaligns with — Threat intelligence on emerging vulnerabilities in third-party components is used to enforce documented remediation time-frames and keep the application within acceptable risk posture.
V16.3.3partialaligns with — Threat intelligence feeds provide the documented security events and bypass attempts that the application must log to maintain situational awareness of relevant threats.
V2.4.1partialaligns with — Tactical threat intelligence on attacker methodologies informs the design and tuning of anti-automation controls that protect against excessive or malicious calls.
V6.3.1partialaligns with — Strategic and tactical threat intelligence on credential-stuffing and brute-force campaigns drives the implementation of rate-limiting and adaptive authentication defenses.

Related weaknesses / CWE (7)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-1039→P CWE-200→P CWE-507→P CWE-509→P CWE-79→P CWE-89→P CWE-918→P

Why these map — AI rationale (under review)

CWE-1039mitigates — Threat intelligence can surface adversarial ML attack patterns but does not implement technical controls.
CWE-200mitigates — By feeding tactical and operational threat intelligence into firewalls, IDS and anti-malware, the control reduces the window during which sensitive data can be exfiltrated by known attacker TTPs.
CWE-507finds — Threat intelligence helps anticipate Trojan Horse threats but does not directly prevent them.
CWE-509prevents — Threat intelligence helps anticipate and prepare for virus/worm campaigns.
CWE-79prevents — Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
CWE-89prevents — Threat-intelligence feeds that surface new SQL-injection campaigns enable rapid updates to query-construction defenses and detection signatures before exploitation occurs.
CWE-918prevents — Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.

Mitigated MITRE ATT&CK techniques (1631)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M →P T1001.001←M →P T1001.002←M →P T1001.003←M →P T1003→P T1003.001→P T1003.002→P T1003.003→P T1003.004→P T1003.005→P T1003.006→P T1003.007→P T1003.008→P T1005→P T1006←M →P T1007→P T1008→P T1010→P T1011←P →P T1011.001←P →P T1012→P T1014←M →P T1016→P T1016.001→P T1016.002→P T1018→P T1020→P T1020.001→P T1021→P T1021.001→P T1021.002→P T1021.003→P T1021.004→P T1021.005→P T1021.006→P T1021.007→P T1021.008→P T1025→P T1027→P T1027.001←M →P T1027.002←M →P T1027.003←M →P T1027.004←M →P T1027.005←M →P T1027.006←M →P T1027.007←M →P T1027.008←M →P T1027.009←M →P T1027.010←M →P T1027.011←M →P T1027.012←M →P T1027.013←M →P T1027.014←M →P T1027.015←M →P T1027.016←M →P T1027.017←M →P T1027.018←M →P T1029→P T1030←M →P T1033→P T1036←M →P T1036.001←M →P T1036.002→P T1036.003←M →P T1036.004←M →P T1036.005←M →P T1036.006←M →P T1036.007←M →P T1036.008←M →P T1036.009←M →P T1036.010→P T1036.011←M →P T1036.012←M →P T1037→P T1037.001→P T1037.002→P T1037.003→P T1037.004→P T1037.005→P T1039→P T1040→P T1041→P T1046→P T1047→P T1048→P T1048.001→P T1048.002→P T1048.003→P T1049→P T1052→P T1052.001→P T1053→M T1053.002→P T1053.003→P T1053.005→P T1053.006→P T1053.007→P T1055→P T1055.001→P T1055.002→P T1055.003←M →P T1055.004←M →P T1055.005←M →P T1055.008←M →P T1055.009←M →P T1055.011←M →P T1055.012→P T1055.013←M →P T1055.014←M →P T1055.015←M →P T1056→P T1056.001→P T1056.002→P T1056.003→P T1056.004→P T1057→P T1059→P T1059.001→P T1059.002→P T1059.003→P T1059.004→P T1059.005→P T1059.006→P T1059.007→P T1059.008→P T1059.009→P T1059.010→P T1059.011→P T1059.012→P T1059.013→P T1068←M →P T1069→P T1069.001→P T1069.002→P T1069.003→P T1070←M →P T1070.003←M →P T1070.004→P T1070.005→P T1070.006←M →P T1070.007→P T1070.008→P T1070.009→P T1070.010←M →P T1071→P T1071.001←M →P T1071.002←M →P T1071.003←M →P T1071.004←M →P T1071.005←M →P T1072→P T1074→P T1074.001→P T1074.002←M →P T1078→P T1078.001→P T1078.002→P T1078.003→P T1078.004→P T1080→P T1082→P T1083→P T1087→P T1087.001→P T1087.002→P T1087.003→P T1087.004→P T1090←M →P T1090.001←M →P T1090.002←M →P T1090.003←M →P T1090.004←M →P T1091→P T1092→P T1095←M →P T1098→P T1098.001→P T1098.002←P →P T1098.003→P T1098.004→P T1098.005←M →P T1098.006→P T1098.007→P T1102→P T1102.001←M →P T1102.002→P T1102.003←M →P T1104←M →P T1105→P T1106→P T1110→P T1110.001→M T1110.002→P T1110.003→P T1110.004→P T1111→P T1112←M →P T1113→P T1114→P T1114.001→P T1114.002→P T1114.003→P T1115→P T1119→P T1120→P T1123→P T1124→P T1125→P T1127←M →P T1127.001←M →P T1127.002→P T1127.003←P →P T1129→P T1132←M →P T1132.001←M →P T1132.002←M →P T1133→P T1134←M →P T1134.001←M →P T1134.002←M →P T1134.003←M →P T1134.004←M →P T1134.005←M →P T1135→P T1136→P T1136.001→P T1136.002→P T1136.003→P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1140←M →P T1176→P T1176.001→P T1176.002→P T1185←M →P T1187→P T1189→P T1190←M →P T1195→P T1195.001→P T1195.002→P T1195.003→P T1197→P T1199→P T1200→P T1201→P T1202←M →P T1203→P T1204→P T1204.001→P T1204.002→P T1204.003→P T1204.004←M →P T1204.005→P T1205→P T1205.001→P T1205.002→P T1207←M →P T1210←M →P T1211→P T1212←M →P T1213→P T1213.001→P T1213.002→P T1213.003→P T1213.004→P T1213.005→P T1213.006→P T1216←M →P T1216.001←M →P T1216.002←M →P T1217→P T1218←M →P T1218.001→P T1218.002→P T1218.003←M →P T1218.004→P T1218.005→P T1218.007←M →P T1218.008←M →P T1218.009←M →P T1218.010←M →P T1218.011←M →P T1218.012←M →P T1218.013←M →P T1218.014→P T1218.015→P T1219→P T1219.001→P T1219.002→P T1219.003←M →P T1220←M →P T1221←M →P T1222←M →P T1222.001←M →P T1222.002←M →P T1480←M →P T1480.001←M →P T1480.002→P T1482→P T1484←M →P T1484.001→P T1484.002←M →P T1485→P T1485.001→P T1489→P T1490→P T1491→P T1491.001→P T1491.002→P T1495→P T1496→P T1496.001→P T1496.002→P T1496.003→P T1496.004→P T1497→P T1497.001←M →P T1497.002←M →P T1497.003→P T1498←P →P T1498.001→P T1498.002→P T1499→P T1499.001→P T1499.002→P T1499.003→P T1499.004→P T1505→P T1505.001→P T1505.002→P T1505.003→P T1505.004→P T1505.005→P T1505.006→P T1518→P T1518.001→P T1518.002→P T1525→P T1526→P T1528→P T1529→P T1530→P T1531→P T1534→P T1535←M →P T1537←M →P T1538→P T1539→P T1542←M →P T1542.001→P T1542.002←M →P T1542.003←M →P T1542.004→P T1542.005→P T1543→P T1543.001→P T1543.002→P T1543.003←M →P T1543.004→P T1543.005→P T1546→P T1546.001→P T1546.002→P T1546.003→P T1546.004→P T1546.005→P T1546.006→P T1546.007→P T1546.008→P T1546.009→P T1546.010→P T1546.011→P T1546.012←M →P T1546.013→P T1546.014→P T1546.015→P T1546.016→P T1546.017→P T1546.018→P T1547→P T1547.001→P T1547.002→M T1547.003→P T1547.004→P T1547.005→P T1547.006→P T1547.007→P T1547.008→P T1547.009→P T1547.010→P T1547.012→P T1547.013→P T1547.014→P T1547.015→P T1548→P T1548.001→P T1548.002←M →P T1548.003→P T1548.004→P T1548.005→P T1548.006←M →P T1550←M →P T1550.001←F →P T1550.002←F →P T1550.003←F →P T1550.004←F →P T1552→P T1552.001→P T1552.002→P T1552.003→P T1552.004→P T1552.005→P T1552.006→P T1552.007→P T1552.008→P T1553←M →P T1553.001←F →P T1553.002←M →P T1553.003←M →P T1553.004←M →P T1553.005←F →P T1553.006←M →P T1554→P T1555→P T1555.001→P T1555.002→P T1555.003→P T1555.004→P T1555.005→P T1555.006→P T1556←M →P T1556.001←M →P T1556.002→P T1556.003→P T1556.004→P T1556.005→P T1556.006←M →P T1556.007←M →P T1556.008→P T1556.009←M →P T1557→P T1557.001→P T1557.002→P T1557.003→P T1557.004←M →P T1558→P T1558.001→P T1558.002←M →P T1558.003→P T1558.004→P T1558.005→P T1559→P T1559.001→P T1559.002→P T1559.003→P T1560→P T1560.001→P T1560.002→P T1560.003→P T1561→P T1561.001→P T1561.002→M T1563→P T1563.001→P T1563.002→P T1564←M →P T1564.001←M →P T1564.002→P T1564.003→P T1564.004→P T1564.005→P T1564.006→P T1564.007→P T1564.008→P T1564.009→P T1564.010→P T1564.011→P T1564.012→P T1564.013→P T1564.014→P T1565→P T1565.001→P T1565.002→P T1565.003→P T1566→P T1566.001→P T1566.002→P T1566.003→P T1566.004→P T1567→P T1567.001→P T1567.002→P T1567.003→P T1567.004→P T1568←M →P T1568.001←M →P T1568.002→P T1568.003←M →P T1569→M T1569.001→P T1569.002→P T1569.003→P T1570→P T1571←M →P T1572→P T1573→P T1573.001→P T1573.002→P T1574→P T1574.001←M →P T1574.004←M →P T1574.005→P T1574.006←M →P T1574.007→P T1574.008→P T1574.009→P T1574.010→P T1574.011→P T1574.012←M →P T1574.013←M →P T1574.014→P T1578←M →P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005←M →P T1580→P T1583.001→P T1583.002→P T1583.003→P T1583.004→P T1583.005→P T1583.006→P T1583.007←M →P T1583.008←P →P T1584→P T1584.001→P T1584.002→P T1584.003→P T1584.004→P T1584.005→P T1584.006←M →P T1584.007←M →P T1584.008→P T1585→P T1585.001→P T1585.002→P T1586→P T1586.001→P T1586.002←M →P T1586.003→P T1587.001←M →P T1587.004→P T1588→P T1588.001→P T1588.002→P T1588.003→P T1588.004→P T1588.005→P T1588.006→P T1588.007→P T1589→P T1589.001→P T1589.002→P T1589.003→P T1590→P T1590.001→P T1590.002→P T1590.003→P T1590.004→P T1590.005→P T1590.006→P T1591→P T1591.001→P T1591.002→P T1591.003→P T1591.004→P T1592→P T1592.001→P T1592.002→P T1592.003→P T1592.004→P T1593→P T1593.001→P T1593.002→P T1593.003→P T1594→P T1595→P T1595.001→P T1595.002→P T1595.003→P T1596→P T1596.001→P T1596.002→P T1596.003→P T1596.004→P T1596.005→P T1597.002→P T1598→P T1598.001→P T1598.002→P T1598.003→P T1598.004→P T1599←M →P T1599.001←M →P T1600←P →P T1600.001←P →P T1600.002→P T1601←M →P T1601.001←M →P T1601.002←M →P T1602→P T1602.001→P T1602.002→P T1606←M →P T1606.001←M →P T1606.002←M →P T1608→P T1608.001←M →P T1608.002→P T1608.003→P T1608.004→P T1608.005→P T1608.006←M →P T1609→P T1610←P →P T1611←M →P T1612←P →P T1613→P T1614→P T1614.001→P T1615→P T1619→P T1620→P T1621←M →P T1622→P T1647←P →P T1648→P T1649→P T1650←M →P T1651→P T1652→P T1653←P →P T1654→P T1657→M T1659→P T1665←M →P T1666←M →P T1667→P T1669→P T1671→P T1673→P T1674→P T1675→P T1677←P →P T1678←M →P T1679←P →P T1680→P T1681→P T1682→P T1683→P T1683.001→P T1683.002→P T1684→M T1684.001→P T1684.002←M →P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M →P T1685.004←M →P T1685.005←M →P T1685.006←M →P T1686←F →P T1686.001←M →P T1686.002←M →P T1686.003←M →P T1687←M →P T1688←M →P T1689←M →P T1690←M →P

Why these map — AI rationale (under review)

T1001detects — A.5.7's operational layer, collection/analysis of technical indicators, and explicit use as input to detective controls (IDS, anti-malware) directly surfaces T1001 obfuscated C2 traffic
T1001prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to tune preventive technical controls (firewalls, IDS, anti-malware) that can block or flag the obfuscated C2 channels before they succeed.
T1001.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the anomalous traffic pattern, but the control is about producing and sharing intelligence rather than performing detection itself, leaving most of the actual detection to other mechanisms.
T1001.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface steganography-based C2, but the control is primarily about producing and sharing intelligence rather than performing detection itself, leaving most of the actual detection to other mechanisms.
T1001.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific IOCs (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware), which can block or flag steganographic C2 channels before they succeed; this is a genuine but bounded slice because the control is awareness-oriented, does not itself implement the blocking, and cannot stop novel/undetected stego techniques.
T1001.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface impersonated C2 traffic that deviates from expected protocol patterns, but the control's mechanism is upstream collection/analysis rather than direct observation and its scope is limited by relevance and implementation choices.
T1001.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and testing can block many impersonation techniques before they succeed, but does not stop all variants or novel impersonations.
T1003detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface T1003 activity or its indicators after the technique runs.
T1003prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and feeding it into preventive controls and risk processes can stop many instances of OS credential dumping from succeeding, but does not eliminate the class because some vectors remain unaddressed and intelligence is not a universal barrier.
T1003.001detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes surface LSASS dumping/SSP modification as a known technique, though not every in-memory variant is guaranteed to be caught in real time.
T1003.001prevents — Threat intelligence on attacker methodologies, tools (e.g. Mimikatz, procdump), techniques (LSASS dumping, SSP modification) and indicators can be fed into risk processes, preventive controls (e.g. anti-malware, firewalls) and testing to stop the technique from succeeding in many cases, but does not guarantee prevention of all instances or variants.
T1003.002detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls (IDS, anti-malware) and testing, which can surface SAM extraction attempts or related IOCs, but this is only one slice of the broad threat-intel process and does not guarantee detection of every instance.
T1003.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can block the techniques/tools (e.g. Mimikatz, registry access) before they succeed.
T1003.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of NTDS access/copy attempts, but this is limited to known IOCs from shared intelligence and does not broadly detect the technique's core methods like Volume Shadow Copy or ntdsutil.exe usage.
T1003.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) for NTDS dumping, when fed into risk processes and technical preventive controls, can stop the technique from succeeding in many cases, but does not guarantee prevention of all instances or variants.
T1003.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of LSA-secrets access attempts, but this is limited to chosen scope and does not guarantee detection of the technique itself.
T1003.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block SYSTEM-level credential access techniques like LSA dumping before they succeed.
T1003.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when indicators or anomalous access to credential caches appear, but this is scoped only to what the org ingests and tunes — not a broad or guaranteed detection of T1003.005 itself.
T1003.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. endpoint protection, credential guard), and testing to reduce the likelihood of successful cached-credential access, but does not stop the technique from being available on systems that still cache domain credentials by design.
T1003.006detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and feeding into detective controls (IDS, anti-malware) and risk processes directly surfaces DCSync attempts or related IOCs (e.g. anomalous replication API calls) in most cases, with a bounded remainder for stealthy or novel implementations.
T1003.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. firewalls/IDS/antimalware), and testing to block the DCSync technique before it runs, but this is only one slice of a broader awareness activity that does not itself enforce any prevention.
T1003.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of procfs credential scraping after the fact, but the control is primarily about upstream awareness production rather than real-time detection of the technique itself.
T1003.008detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface the technique when it matches known patterns or sources; this is limited to known threats and does not broadly instrument for the technique itself.
T1003.008prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (e.g. anti-malware, IDS) and risk processes that can block the /etc/passwd+shadow dump technique before it runs; this is not universal prevention because the control is awareness-oriented, not a direct enforcement mechanism, and many instances of the technique (e.g. via legitimate root or misconfigured permissions) remain reachable.
T1005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1005 activity via indicators or anomalies, but this is limited to known/observable cases and does not broadly instrument local file searches across all platforms or sub-techniques.
T1006detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface indicators of direct volume access attempts, but this is limited to known patterns from shared intelligence rather than reliably catching novel or low-and-slow bypasses.
T1007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific commands, tools, or anomalous service-enumeration behavior described in T1007, but this is scoped only to the fraction of instances that match known indicators rather than all occurrences of the technique.
T1007prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block the commands or discovery behaviors before they succeed.
T1008detects — A.5.7's operational layer (specific attacks and technical indicators) and its use as input to detective controls (IDS, anti-malware) and testing directly surfaces fallback-channel C2 techniques when indicators are present.
T1008prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block known primary C2 channels before fallback is needed, but does not stop adversaries from implementing or switching to alternate channels that remain unblocked.
T1010detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1010-like discovery activity when indicators or patterns are known, but this is scoped only to the fraction of instances that match collected/analyzed intelligence rather than broadly detecting the technique itself.
T1011detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of anomalous exfiltration over secondary media (Bluetooth, cellular, WiFi), but this is scoped by relevance/insight/actionability and does not guarantee detection of the technique itself.
T1011prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, etc.) to block or harden alternative exfiltration mediums before the technique runs.
T1011.001detects — A.5.7's operational layer and use as input to detective controls (e.g. IDS) and risk processes can surface the Bluetooth exfiltration technique when indicators or anomalous Bluetooth activity align with collected/analyzed threat intel, but this is scoped only to what the org's chosen sources and analysis happen to cover rather than systematic detection of the technique.
T1012detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface Registry-query activity when it matches known TTPs or indicators, but this is scoped to relevant/insightful intelligence only and does not broadly instrument or guarantee detection of the technique.
T1014detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and testing processes, which can surface rootkit presence or artifacts; this is limited to known indicators rather than unknown rootkits.
T1016detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when it produces observable indicators, but the control is primarily about upstream collection/analysis/sharing and does not mandate detection of this specific discovery behavior.
T1016.001detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface the technique when indicators match known patterns, but this is scoped only to known threats and does not broadly instrument for arbitrary discovery behavior.
T1016.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when it matches known indicators or anomalous behavior, but the control is scoped to relevant/insightful threat intel rather than mandating broad detection of all local Wi-Fi enumeration.
T1016.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls, and testing to reduce the likelihood this discovery technique is available or successful on the organization's systems.
T1018detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational indicators and attacker methodologies) that can feed detective controls like IDS to surface T1018 activity, but the control itself only produces awareness inputs and does not perform detection.
T1018prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes, firewalls, IDS, anti-malware and testing to block many discovery utilities, passive analysis paths and network reconnaissance, but cannot stop all legitimate admin or built-in OS/network commands on all platforms.
T1020detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS) and risk processes surfaces automated exfiltration when indicators match observed TTPs.
T1020prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block automated exfiltration paths before they succeed.
T1020.001detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS, which can surface T1020.001 traffic mirroring when known patterns or IOCs match; this is limited to known instances rather than all cases, and the control's core purpose is broader awareness rather than direct detection.
T1020.001prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block or disable traffic mirroring abuse before it succeeds.
T1021detects — A.5.7's operational and tactical layers plus explicit use as input to intrusion detection, anti-malware and other detective controls directly surface indicators and patterns of remote service abuse (e.g. anomalous RDP/SSH logins from valid accounts or unusual ARD usage)
T1021prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific indicators (operational) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes, testing) to block many but not all valid-account remote-service logons, especially those using legitimate protocols and admin tools.
T1021.001detects — A.5.7's operational layer, collection/analysis of specific attacks and technical indicators, plus feeding into detective controls (IDS) and risk processes, surfaces RDP logins by valid accounts when they match known adversary TTPs or indicators.
T1021.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and sharing with others can inform preventive controls (e.g. firewall/IDS rules, account restrictions, RDP disablement) to stop the technique from running, but this is indirect, depends on risk processes and other controls, and leaves many usage scenarios (e.g. valid RDP with stolen creds) unaddressed.
T1021.002detects — A.5.7 collects/analyzes operational threat intelligence (including technical indicators of specific attacks) and feeds it into detective controls like IDS and anti-malware as well as risk/test processes, which can surface SMB admin-share abuse when indicators match; this is a genuine but minority slice because the control's mechanism is upstream intelligence production and sharing, not direct observation of the technique itself, and most instances (especially those using only valid accounts without known IOCs) remain unseen.
T1021.002prevents — Threat intelligence on attacker methodologies, tools (SMB shares), and indicators can be fed into risk processes, preventive controls (e.g. firewalls, access rules), and testing to block use of admin shares with valid accounts, but this is indirect, depends on what intel is actionable/relevant, and does not guarantee the technique cannot run.
T1021.003detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including those leveraging DCOM as a lateral movement vector) and feeding them into detective controls such as IDS or anti-malware, which surfaces the technique when it matches known patterns.
T1021.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block DCOM-based lateral movement and insecure method abuse before it succeeds.
T1021.004detects — A.5.7 collects/analyzes operational threat intelligence (including technical indicators from specific attacks) and feeds it into detective controls like IDS and anti-malware as well as test processes, which can surface SSH logins by valid accounts when those match known adversary patterns or IOCs; partial because the clause sets requirements for intelligence production and sharing rather than mandating any specific detection mechanism or coverage depth, so what is actually detected is a slice determined by the chosen sources, analysis, and downstream controls.
T1021.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and sharing feeds directly into preventive controls (firewalls, IDS, anti-malware, risk processes, testing) that can block SSH abuse of valid accounts before it succeeds, but only for the informed slice of threats the org has visibility into and chooses to act on.
T1021.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface VNC-based remote access anomalies or known-bad indicators, but this is scoped only to the subset of T1021.005 that produces observable signals inside the chosen intelligence sources and monitoring scope.
T1021.005prevents — Threat intelligence on attacker methodologies, tools, specific VNC indicators, and brute-force/memory exploits can be fed into risk processes, preventive controls (e.g. firewalls, anti-malware), and testing to block many abuse paths before they execute.
T1021.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface WinRM-based remote access by valid accounts when tied to known indicators or anomalous patterns, but this is limited to selected, relevant, and analyzed intel rather than broad or guaranteed detection of the technique.
T1021.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block WinRM abuse via valid accounts before it succeeds, but this is only a slice of the technique's surface (e.g., does not stop all credentialed remote access or WinRM service exposure itself).
T1021.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cloud service logins by adversaries using valid/federated accounts, but this is scoped to relevant, actionable intel rather than broad or guaranteed detection of the technique.
T1021.007prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) can be fed into preventive controls, risk processes, and testing to block some vectors for valid-account cloud logins (e.g. via updated firewall/IDS rules, token validation, or access restrictions), but cannot prevent the core technique when the adversary already holds synchronized/federated valid credentials.
T1021.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of direct cloud VM logins, but this is limited to known TTPs/IoCs and does not broadly instrument for the technique across all cloud console methods.
T1021.008prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. IAM hardening, firewall/IDS rules), and testing to stop valid-account abuse of cloud VM connection methods before they succeed.
T1025detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of removable-media enumeration/collection after compromise, but this is scoped only to relevant/insightful intelligence that reaches the org's monitoring rather than broadly detecting the technique itself.
T1027detects — Threat intelligence activities include collecting/analyzing tactical and operational indicators (tools, techniques, specific IOCs) that can feed into detective controls like IDS or anti-malware, enabling detection of obfuscation artifacts, but this is only one of several possible uses and does not guarantee detection of all T1027 instances.
T1027prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block common obfuscation techniques before they succeed.
T1027.001detects — A.5.7's operational layer and use as input to IDS/anti-malware/firewalls can surface the padding artifact or its indicators once present, but the control is scoped to relevant/insightful threat intel sharing and does not mandate or guarantee detection of this specific evasion in all cases.
T1027.002detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools (incl. custom packers), and indicators, then feeds it into detective controls and testing to surface the technique; this is genuine but only a slice because the control itself performs no direct detection and depends on downstream mechanisms plus intel relevance/availability.
T1027.002prevents — Threat intelligence on attacker methodologies, tools (e.g. packers like UPX), custom evasion variants, and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block many common packing techniques before execution, but custom or novel packing evades known signatures and is not stopped outright.
T1027.003detects — Threat intelligence activities explicitly feed technical detective controls (IDS, anti-malware) and security testing processes that surface steganography use in the described TTPs.
T1027.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware), which can block steganography-based hiding or exfiltration before it succeeds; this is only a slice of the class because intelligence is not guaranteed to cover every possible stego technique or implementation.
T1027.004detects — A.5.7's operational layer and use as input to IDS/anti-malware/firewalls can surface specific IOCs or anomalous compilation of delivered source (e.g. via csc.exe), but the control is scoped to relevant threat intel rather than mandating broad detection of the technique itself
T1027.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block known compile-after-delivery patterns, but does not stop novel/unknown instances of the technique.
T1027.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing processes surfaces many indicators of compromise that adversaries later remove, but does not guarantee detection of every post-removal variant or all tool modifications.
T1027.005prevents — Threat intelligence on attacker methodologies, tools, and indicators (tactical/operational layers) is explicitly used as input to preventive controls like anti-malware and IDS, enabling signature/behavior updates that stop the modified-tool variant from succeeding on first use.
T1027.006detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and test processes can surface HTML smuggling indicators or anomalous delivery, but the control is scoped to relevant/insightful intelligence sharing and does not mandate broad detection coverage of this technique.
T1027.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, content filters, risk processes) to block HTML smuggling vectors before harm occurs, but the control only supplies awareness and does not itself enforce any block.
T1027.007detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware) and test processes, can surface indicators or patterns associated with dynamic API resolution techniques, but this is indirect, depends on specific intel sources, and does not guarantee detection of the technique itself.
T1027.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block common dynamic API resolution patterns before execution, but does not stop novel or custom implementations of the technique.
T1027.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface stripped-payload artifacts or anomalies, but the control is scoped to threat-intel collection/analysis rather than mandating payload-level detection mechanisms.
T1027.009detects — threat intelligence activities include collecting/analysing sources that feed technical detective controls (IDS, anti-malware) and security testing, which can surface embedded-payload techniques when indicators are known and relevant; this is limited to known patterns rather than novel embedding and does not mandate detection of every instance
T1027.009prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block or detect embedding techniques before harm occurs, but this is indirect, depends on implementation, and does not stop all instances or variants of the technique.
T1027.010detects — A.5.7 collects/analyzes operational threat intelligence (including specific TTPs, tools like Invoke-Obfuscation, and indicators) and feeds it into detective controls (IDS, anti-malware) and testing, which surfaces many command-obfuscation instances in flight or in testing; it does not instrument or observe the technique itself, leaving a large remainder of in-process or novel obfuscation unseen.
T1027.010prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block or signature-match many command-obfuscation patterns before execution succeeds.
T1027.011detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, and specific TTPs (including fileless storage as a concealment technique) and feeds it into detective controls and testing, surfacing the behavior when it matches known indicators, but does not itself perform detection.
T1027.011prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block common fileless storage techniques, but does not stop novel/undocumented variants or all bypasses of disk-based defenses.
T1027.012detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface LNK icon smuggling indicators or anomalous downloads, but this is scoped only to what the org ingests/analyzes and shares, leaving most instances undetected without specific IOCs or coverage of all vectors.
T1027.012prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block known LNK smuggling patterns before they succeed, but this does not stop novel or unknown variants of the technique.
T1027.013detects — A.5.7 collects/analyses threat intel on attacker methodologies/tools (tactical layer) and specific attacks (operational layer) and feeds it into detective controls and testing, which can surface some T1027.013 usage via IOCs or behavioral patterns, but does not itself perform detection and leaves the bulk of static/dynamic file-obfuscation instances unreached.
T1027.013prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block common encrypted/encoded file patterns before execution, but does not stop novel/custom/redundant obfuscation or the technique's core act of concealment.
T1027.014detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface polymorphic behavior via indicators or behavioral anomalies, but the control's core is awareness production rather than direct runtime detection of the technique.
T1027.014prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls like anti-malware, enabling signature/behavior updates that stop many (but not all) polymorphic variants from executing successfully.
T1027.015detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS or anti-malware can surface the use of compression/obfuscated archives when those indicators are known and ingested, but this is scoped only to known patterns and does not broadly detect novel or unseen uses of the technique.
T1027.015prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block known compression-based obfuscation techniques before they succeed, but this is inherently limited to recognized patterns and does not stop novel or undetected uses of compression.
T1027.016detects — Threat intelligence activities include collecting/analyzing tactical and operational indicators (methodologies, tools, specific attacks) and feeding them into detective controls like IDS or anti-malware, which can surface junk-code patterns post-insertion; this is limited to known indicators rather than all instances or novel variants.
T1027.017detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface SVG smuggling indicators or anomalous SVG content, but this is scoped only to what the org ingests/analyzes and feeds downstream, leaving most in-flight or novel instances undetected.
T1027.017prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, content filters, tests) to block SVG smuggling payloads before they reach users, but this is only a slice of the technique's surface (e.g., novel variants, user-side rendering, or non-signatured cases remain unblocked).
T1027.018detects — A.5.7 collects/analyses threat intel on attacker methodologies/tools (tactical layer) and feeds it into detective controls like IDS or anti-malware, which can surface the Unicode concealment technique when it matches known indicators or patterns, but this is limited to known cases and does not guarantee detection of novel variants.
T1027.018prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS rules), and testing to block Unicode-obfuscated payloads before execution, but this is only a slice of the broad technique that also supports phishing, prompt injection, and other vectors across platforms.
T1029detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface scheduled exfiltration timing anomalies when they match known TTPs or indicators, but this is scoped only to the subset of cases where intelligence is available, relevant, and integrated — not the technique in general.
T1030detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific TTP of chunked exfiltration below thresholds, but this is only one slice of the three-layer model and depends on the sources chosen.
T1030prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block or raise thresholds on the very size-based evasion patterns described, but this is only one slice of a broad, multi-purpose intelligence program that does not guarantee prevention of the technique itself.
T1033detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical) and specific attacks with indicators (operational), which can feed detective controls and risk processes to surface T1033-like discovery activity; however, it is governance-oriented awareness production rather than direct detection instrumentation, leaving most of the technique unobserved.
T1036detects — Threat intelligence collection/analysis of tactical/operational layers (attacker methodologies, tools, specific IOCs) and its use as input to detective controls (IDS, anti-malware) and testing directly surfaces masquerading artifacts post-deployment.
T1036prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware), which can block masquerading artifacts before execution; this is a genuine but minority slice of the broad technique class that also includes non-technical user-trickery and post-compromise evasion not reached by intel-driven prevention.
T1036.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the anomalous/invalid signature pattern, but the control is primarily about producing and sharing intelligence rather than performing detection itself, leaving most of the actual detection to other mechanisms.
T1036.002detects — A.5.7's operational layer, collection/analysis of specific technical indicators, and feeding into detective controls (IDS, anti-malware) and testing processes can surface RTLO-based disguises as anomalous indicators, but this is scoped only to what the org elects to ingest/monitor and does not mandate coverage of all RTLO uses (e.g. registry, non-monitored platforms).
T1036.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS rules), and testing to block or detect RTLO-based disguises before execution, but this is awareness-driven and does not guarantee prevention of the technique itself.
T1036.003detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware, which can surface renamed-utility evasion when those IOCs or behavioral patterns are known and relevant; this is only a slice of the class because many rename events have no prior intelligence and the control itself does not mandate instrumentation or monitoring.
T1036.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block renamed-utility execution paths before they succeed, but this is only one slice of the class (many renaming variants remain undetected or unblocked in practice).
T1036.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface masquerading via indicators or anomalies, but this is scoped to what the org ingests/analyzes rather than a dedicated detection mechanism, leaving most instances undetected without additional controls.
T1036.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to reduce the chance this masquerading technique is successfully used, but does not stop adversaries from attempting name/description manipulation.
T1036.005detects — Threat intelligence activities include collecting/analyzing tactical and operational indicators (tools, techniques, specific attacks) and feeding them into detective controls like IDS or anti-malware, which can surface T1036.005 masquerading after the fact; this is limited to cases where indicators are known and relevant rather than a general detection mechanism.
T1036.005prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of this naming-based evasion succeeding, but does not stop adversaries from performing the technique itself.
T1036.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific TTP or related indicators, but the control is scoped to threat-intel collection/analysis rather than mandating detection of every instance of the technique.
T1036.007detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware and security testing, which can surface double-extension masquerading when it matches known patterns, but this is scoped only to known threats and does not broadly instrument for the technique.
T1036.007prevents — Threat intelligence on attacker methodologies (tactical layer) and specific indicators (operational layer) can be fed into risk processes, email attachment scanning, and user awareness to stop double-extension lures before they reach users, but the control itself only supplies information and does not mandate or enforce any blocking action.
T1036.008detects — A.5.7's operational and tactical layers plus explicit use as input to IDS, anti-malware, and security testing directly surface masquerading artifacts (wrong signatures, polyglots, anomalous extensions) in the monitored environment.
T1036.008prevents — Threat intelligence on attacker methodologies, tools, file-signature evasion, and polyglot techniques (tactical/operational layers) is explicitly used as input to preventive controls (e.g. anti-malware, input sanitization, file-validation rules), which stops many instances of the technique from succeeding.
T1036.009detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and testing controls can surface the PPID-fork/daemon technique when indicators or anomalous process-tree patterns are among the collected/analysed sources, but the control itself only gathers/analyses/shares intelligence and does not mandate instrumentation that guarantees detection of every instance.
T1036.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to preventive technical controls such as anti-malware and intrusion detection, which can block or flag PPID-spoofing/double-fork behaviors before they succeed.
T1036.010detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical) and specific attacks (operational) including indicators, then feeds it into detective controls and risk processes, which can surface masquerade-account creation when it matches known TTPs or IOCs; it does not itself instrument or observe the creation/renaming events.
T1036.010prevents — Threat intelligence on attacker methodologies, tools, naming patterns, and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes, which can stop the masquerading technique from succeeding in many environments, but it is not a direct barrier and leaves residual cases where intelligence is incomplete, untimely, or not actioned.
T1036.011detects — Threat intelligence activities include collecting/analysing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls (IDS, anti-malware) and testing processes, which can surface this Linux in-memory argv spoofing when matching known TTPs or IOC patterns; however, the control is scoped to known/relevant threats and does not mandate broad, always-on detection of novel or unshared variants.
T1036.012detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific TTP and indicators of browser fingerprint spoofing, but this is scoped to what the org ingests and tunes rather than a universal detection mechanism.
T1036.012prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block or detect spoofed fingerprinting traffic before it succeeds, but this is indirect, depends on timely actionable intel, and leaves many evasion variants unaddressed.
T1037detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface T1037's anomalous boot/logon scripts when indicators or methodologies are known and monitored.
T1037prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS rules), and testing to block common initialization-script abuse techniques before they execute, but this is inherently incomplete as it depends on timely, relevant intel and does not stop novel or undetected variants.
T1037.001detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, which may surface this logon-script persistence when matching known indicators or patterns, but the control itself performs no detection and many instances (custom/unadvertised scripts) remain unseen.
T1037.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific TTP or indicators of a login-hook modification, but the control is scoped to relevant/insightful intelligence sharing and does not mandate detection of this deprecated technique on every system.
T1037.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to block this macOS persistence technique before it is used, but the control only supplies awareness and does not itself enforce any block.
T1037.003detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, which may surface this persistence technique when it matches known patterns, but the control itself performs no detection and many instances (custom/unreported scripts) remain unseen.
T1037.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. GPO hardening, script whitelisting), and testing to stop the logon-script persistence technique from being available or succeeding; this is genuine but only a slice because the control is awareness-oriented, does not itself enforce any technical prohibition, and many implementations will leave residual exposure.
T1037.004detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and testing controls surface indicators of RC-script modification or anomalous startup behavior on supported platforms, but the control's scope is limited to relevant/insightful intelligence sharing and does not mandate detection coverage for every legacy Unix-like system or deprecated RC mechanism.
T1037.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of RC script abuse for persistence, but does not stop the root-privileged modification technique itself.
T1037.005detects — A.5.7 collects/analyzes/shares threat intel (including operational IOCs and attacker TTPs) that can feed technical detective controls and risk processes, which may surface this persistence technique when observed; it does not itself perform detection.
T1037.005prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (including deprecated-but-still-present macOS persistence like StartupItems) feeds risk management, preventive controls, and testing to reduce the chance the technique is introduced or left available, but does not itself stop the adversary action.
T1039detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of network-share enumeration or related TTPs, but this is scoped to relevant, insightful, and actionable intel rather than broad or guaranteed detection of the technique itself.
T1040detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface network sniffing when it produces observable indicators or anomalous traffic patterns; the remainder is purely passive sniffing that leaves no detectable artifact until exfiltration or later use.
T1040prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block sniffing vectors such as unencrypted protocols, promiscuous mode, span ports or traffic mirroring before the technique succeeds.
T1041detects — A.5.7's operational and tactical layers plus its mandated use as input to detective controls (IDS, anti-malware) and risk processes surface the C2-based exfiltration technique when indicators or patterns are present in collected intelligence.
T1041prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies and indicators can be fed into preventive controls (firewalls/IDS) to block the specific C2 channels or encodings used for exfiltration, but this is only a slice of the technique's surface rather than stopping the underlying data theft method outright.
T1046detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS) and risk processes surfaces the T1046 technique when indicators or patterns match observed network scans.
T1046prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block or reduce the feasibility of network service discovery scans before they succeed.
T1047detects — A.5.7 collects/analyzes/shares threat intelligence (including operational IOCs and attacker TTPs) that can feed detection rules in technical controls, but the control itself performs no detection and only supplies input that other mechanisms may use
T1047prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls and risk-management processes that can block or disable WMI abuse vectors before they succeed.
T1048detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware, etc.) surface indicators and anomalous exfiltration over alternate protocols (DNS, SMTP, FTP, etc.) once underway; the remainder is pre-compromise acquisition of the alternate channel itself.
T1048prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block the listed exfiltration protocols, utilities and cloud-console patterns before they succeed; it does not guarantee universal prevention of every alternate-channel variant.
T1048.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of symmetric-exfiltration techniques, but this is scoped only to relevant, actionable intelligence the org ingests rather than broad detection of the technique itself.
T1048.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of asymmetric exfil over non-C2 protocols, but this is scoped to relevant/insightful intel only and does not mandate broad detection coverage.
T1048.002prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block known exfiltration patterns over asymmetric protocols, but does not stop novel or unknown variants of the technique.
T1048.003detects — A.5.7's operational layer, collection/analysis of technical indicators, and feeding into detective controls (IDS, firewalls) and test processes directly surfaces the unencrypted non-C2 exfil technique or its indicators in flight or in testing.
T1048.003prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. firewalls, IDS), and testing to block unencrypted exfiltration paths before they are used.
T1049detects — Threat intelligence activities explicitly include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls such as intrusion detection systems, which surfaces T1049 execution via known discovery commands, tools, and patterns.
T1049prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block the commands/utilities and discovery paths before they succeed, but this is only a slice of the broad technique that also covers post-compromise local queries on diverse platforms where intel may not reach every vector.
T1052detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of physical-medium exfiltration after it occurs, but the control is silent on physical/air-gapped vectors and most of its emphasis is strategic/tactical awareness rather than real-time detection of this technique.
T1052.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of USB exfiltration activity, but this is limited to known/analyzable TTPs and does not broadly instrument or guarantee detection of the physical/air-gapped technique itself.
T1052.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes, preventive controls and testing to block USB exfiltration paths in many (but not all) cases, especially non-air-gapped ones; air-gapped physical USB hops remain a bounded residual.
T1053detects — A.5.7's operational layer, collection/analysis of indicators, and explicit use as input to detective controls (IDS, anti-malware) and test processes directly surface T1053's scheduled-task artifacts and anomalous scheduling behavior.
T1053.002detects — A.5.7 collects/analyzes tactical+operational threat intel (including attacker tools, TTPs, and IOCs) that can feed detection rules in IDS, anti-malware, and monitoring, but the control itself only produces awareness and does not perform or guarantee detection of T1053.002
T1053.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface cron-based scheduling as an anomalous or known-bad indicator, but this is scoped by relevance/insight/actionability and does not guarantee detection of all instances across Linux/macOS/ESXi.
T1053.005detects — A.5.7 collects/analyzes tactical+operational threat intel (including attacker tools, TTPs, and IOCs) that can feed into detective controls and risk processes, which surfaces some scheduled-task abuse; it does not itself instrument or observe the technique.
T1053.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific IOCs (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block known scheduled-task abuse patterns before execution, but does not stop novel or custom variants of the technique.
T1053.006detects — A.5.7 collects/analyzes tactical+operational threat intel (including attacker tools/techniques like systemd timers for persistence) and feeds it into detective controls (IDS, anti-malware) and testing, surfacing the technique when it matches known indicators or patterns; partial because scope is limited to intel sources that cover this niche Linux technique and does not mandate broad runtime detection of all timer abuse.
T1053.006prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to block known systemd-timer abuse patterns before they execute, but this is inherently knowledge-driven and does not stop novel or unknown variants.
T1053.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of scheduled container orchestration abuse, but this is scoped by relevance/insight/actionability chosen by the implementer and does not mandate coverage of this specific technique.
T1053.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes and preventive controls (firewalls/IDS/antimalware) to block abuse of container orchestration scheduling, but this is indirect, depends on accurate sharing/analysis/action, and leaves gaps for novel/undetected techniques in unmonitored clusters.
T1055detects — A.5.7's operational and tactical layers plus explicit use as input to intrusion detection, anti-malware and other detective controls surface process injection when indicators or anomalous behaviors are present in collected/analyzed intelligence.
T1055prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block many process-injection techniques before they succeed.
T1055.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and test processes surface in-process DLL injection anomalies and indicators when the described collection/analysis/sharing activities are performed.
T1055.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block common DLL-injection vectors before they succeed.
T1055.002detects — A.5.7's operational and tactical layers plus its mandated use as input to detective controls (IDS, anti-malware) and risk processes surface PE injection indicators and anomalous process behavior in monitored environments.
T1055.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block PE injection techniques before they succeed.
T1055.003detects — A.5.7's operational and tactical layers plus its mandated use as input to intrusion detection, anti-malware and test processes surface Thread Execution Hijacking via indicators, anomalous process behavior and memory anomalies; the remainder is detections that require host telemetry outside the chosen scope of the intelligence program.
T1055.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block common Thread Execution Hijacking vectors before they succeed, but this is indirect, depends on accurate actionable intel, and leaves many implementation-specific or novel variants unaddressed.
T1055.003responds — A.5.7 feeds threat intel into detective controls (IDS, anti-malware) and incident processes that can contain/eradicate an in-flight thread-hijacking technique once underway, but the control itself only supplies awareness and does not perform the response action.
T1055.004detects — A.5.7 requires collection, analysis and sharing of operational threat intelligence (specific attacks, technical indicators) that is then fed as input into detective controls such as intrusion detection systems and anti-malware solutions, which surfaces APC injection in flight on monitored Windows systems; the remainder is unmonitored processes or intelligence that never reaches detection tooling.
T1055.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware), which can block APC injection techniques before they succeed.
T1055.005detects — A.5.7 collects/analyzes/shares threat intelligence (including operational IOCs and attacker TTPs) that can feed technical detective controls and risk processes, which may surface TLS callback injection when known indicators are present; it does not itself perform detection.
T1055.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block or detect this Windows-specific PE/TLS injection technique before it succeeds, but the control only supplies awareness and does not itself enforce any prevention.
T1055.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface ptrace-based injection indicators or anomalous debugging behavior, but this is scoped by relevance/insight/actionability requirements and does not guarantee detection of the technique itself.
T1055.008prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block ptrace-based injection before it succeeds, but this is only a slice of the Linux-specific technique that still depends on other unaddressed factors like process permissions and runtime defenses.
T1055.009detects — A.5.7 collects/analyzes threat intel on attacker methodologies/tools (tactical layer) and specific attacks (operational layer) to feed detective controls like IDS/anti-malware and risk processes, which can surface proc memory injection when it matches known indicators, but this is scoped only to known threats and does not guarantee detection of novel variants.
T1055.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, IDS), and testing to block this Linux-specific procfs-based injection technique before it runs, but the control only supplies awareness and does not itself enforce any blocking action.
T1055.011detects — A.5.7 collects/analyzes threat intel (incl. operational indicators and attacker TTPs) that can feed detective controls and tests, which may surface EWM injection post-facto or in testing, but the control itself performs no detection.
T1055.011prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. anti-malware, firewalls), and testing to block this Windows-specific injection technique in many cases, but does not itself stop the underlying API/abuse of EWM or guarantee prevention.
T1055.012detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed into detective controls like IDS or anti-malware, enabling detection of process hollowing; however, the control itself performs no detection and its scope is limited to intel production and risk-process integration rather than direct or comprehensive coverage of this technique.
T1055.012prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block common process-hollowing indicators or behaviors before they execute, but this does not stop novel or custom implementations of the technique.
T1055.013detects — A.5.7 collects/analyses/shares threat intel (including tactical/operational IOCs and attacker TTPs) that can feed technical detective controls and risk processes, which may surface Process Doppelgänging post-facto; it does not itself perform detection and its coverage of this specific, low-prevalence technique is a narrow slice.
T1055.013prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block or surface this Windows-specific TxF-based injection technique before it succeeds, but the control only supplies awareness and does not itself stop the technique.
T1055.014detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface VDSO hijacking indicators or anomalous behavior, but this is scoped by what the org chooses to collect/analyze and does not guarantee detection of the technique itself.
T1055.015detects — A.5.7 collects/analyzes tactical+operational threat intel (incl. attacker methodologies, tools, TTPs and indicators) and feeds it into detective controls like IDS and anti-malware as well as security testing, which can surface ListPlanting when known; it does not itself perform detection and many novel or unshared ListPlanting variants remain unseen.
T1055.015prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block ListPlanting vectors before execution, but the control itself only supplies awareness and does not directly prevent the technique.
T1056detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and test processes surface many input-capture techniques after they run, though some transparent or novel variants remain outside routine collection/analysis scope.
T1056prevents — Threat intelligence activities explicitly feed into risk management, technical preventive controls (firewalls/IDS/antimalware), and testing processes that can block many input-capture techniques before they execute, but the control stops at awareness-sharing and does not itself enforce any specific preventive mechanism.
T1056.001detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and explicit use as input to detective controls (IDS, anti-malware) directly surfaces keylogging techniques in flight or in artifacts.
T1056.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and testing can block many keylogging implementations before they run, but not all methods (e.g. custom drivers, hardware buffer reads, or Modify System Image on network devices) are guaranteed to be stopped.
T1056.002detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface GUI Input Capture attempts; this is limited to known patterns shared via intel rather than reliably catching novel or mimicked prompts.
T1056.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (e.g. anti-malware, IDS), which can block the credential-prompting technique before it succeeds.
T1056.003detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface this technique after it is deployed on a portal, but the control is scoped to awareness production and sharing rather than mandating instrumentation that reliably catches the installation or credential capture itself.
T1056.003prevents — A.5.7's strategic/tactical/operational threat intel, when fed into risk management and technical preventive controls (firewalls/IDS/antimalware), can block many installation vectors or credential-capture payloads for T1056.003, but leaves a bounded remainder (e.g., zero-days, insider admin abuse post-compromise, or novel web-portal exploits not yet in intel feeds).
T1056.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface specific hooking TTPs or IOCs, but the control is primarily about producing and sharing intelligence rather than performing detection itself, leaving most in-flight technique instances outside its direct scope.
T1056.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (e.g. anti-malware, IDS), which can block the hooking mechanisms or known malicious implementations before they succeed.
T1057detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical details) and feeding them into detective controls like IDS/anti-malware, which can surface T1057 execution in monitored environments, but this is scoped to relevant/insightful sources only and does not guarantee detection of all process-discovery methods across all platforms.
T1057prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block common process-discovery commands and techniques before they succeed, but this does not stop all instances or novel variants of the technique.
T1059detects — A.5.7's operational and tactical layers plus explicit use as input to detective controls (IDS, anti-malware) and risk processes surface command/script interpreter abuse when it occurs, with the bounded remainder being purely internal/stealthy interpreter activity outside monitored or shared intel sources.
T1059prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can block interpreter abuse before it runs, but this is only one slice of the broad technique that also covers legitimate built-in interpreters required by the platform.
T1059.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface PowerShell abuse (anomalous commands, known malicious indicators, Empire/PowerSploit patterns) when it occurs on the organization's estate; the remainder is pre-compromise adversary tooling development or use outside monitored scope.
T1059.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls and risk management, which can block many PowerShell abuse paths (e.g. via updated signatures, blocked download paths, or policy enforcement), but cannot stop all variants such as in-memory .NET assembly use or novel unlisted techniques.
T1059.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of AppleScript abuse on macOS, but the control is scoped to relevant/insightful intelligence sharing and does not mandate or guarantee detection of this specific technique.
T1059.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block AppleScript abuse vectors on macOS.
T1059.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cmd.exe abuse (e.g. anomalous command execution or batch activity), but this is scoped only to relevant, actionable intelligence rather than broad or guaranteed detection of the technique.
T1059.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block common cmd.exe abuse paths, but the control does not remove or prohibit the built-in Windows shell itself.
T1059.004detects — A.5.7 collects/analyzes operational threat intelligence (including technical indicators of specific attacks) and feeds it into detective controls like IDS and anti-malware, which can surface Unix shell abuse when indicators match; this is limited to known patterns and does not broadly instrument all shell activity.
T1059.004prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies/tools (including Unix shell abuse) feeds risk management, preventive controls (e.g. anti-malware, firewalls), and testing to reduce likelihood of the technique being used successfully; this is genuine but bounded by the control's indirect, awareness-based nature rather than a direct prohibition.
T1059.005detects — A.5.7 collects/analyses threat intel (incl. tactical/operational indicators and attacker methodologies) that can feed detective controls and risk processes, thereby surfacing VB abuse when it matches known patterns, but does not itself perform detection.
T1059.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls and risk management, which can block common VB/VBA/VBScript abuse vectors such as macro execution or script interpreters before they run.
T1059.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface Python-based execution when tied to known TTPs or indicators, but the control is scoped to relevant/threat-intel-driven detection rather than broad or universal coverage of all Python abuse.
T1059.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls, which can block Python-based execution paths in many but not all cases (e.g., custom or novel abuse).
T1059.007detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and feeding into detective controls (IDS, anti-malware) and testing directly surface JS abuse (e.g. malicious scripts, obfuscated payloads, JXA/osascript) in flight or in artifacts.
T1059.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block JS abuse vectors before execution.
T1059.008detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and test processes surface indicators of CLI abuse on network devices, but this is scoped by relevance and does not mandate broad detection coverage of the technique.
T1059.008prevents — Threat intelligence activities include feeding insights into preventive controls (firewalls, IDS, anti-malware, risk management, testing) and sharing to improve overall prevention, which can stop the T1059.008 technique from succeeding in some cases (e.g. blocking known malicious CLI patterns or device configs), but this is only a minority slice as the control is fundamentally about awareness rather than direct enforcement or removal of CLI abuse vectors.
T1059.009detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cloud API abuse, but the control is primarily about producing and sharing intelligence rather than performing detection itself, leaving most of the actual detection to other mechanisms.
T1059.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can block some abuse paths (e.g. known malicious tokens, anomalous API calls), but leaves open-ended legitimate API usage by compromised credentials or novel techniques.
T1059.010detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of AHK/AutoIT abuse (e.g. known malicious scripts or compiled payloads), but this is scoped to relevant, actionable intelligence rather than broad or guaranteed detection of the technique.
T1059.010prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls, which can block known AHK/AutoIT abuse vectors before execution.
T1059.011detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, surfacing Lua abuse when it matches known patterns, but does not itself perform detection.
T1059.012detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of hypervisor CLI abuse on monitored platforms, but this is scoped only to what the org elects to ingest/monitor and does not inherently instrument hypervisor CLIs themselves.
T1059.012prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls (e.g. firewalls, anti-malware), and testing to block hypervisor CLI abuse on ESXi before it runs, but this is only a slice of the full technique surface given the control's broad, non-specific scope.
T1059.013detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational IOCs and attacker tooling) and feeds it into detective controls like IDS or anti-malware, which can surface T1059.013 usage; this is a genuine but minority slice because the control itself performs no direct detection and many executions (e.g. benign-looking kubectl or docker CLI) leave no signature the intel-augmented detectors reliably catch.
T1059.013prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block the CLI/API abuse paths described in T1059.013, but this is only one slice of a broader awareness activity that does not itself stop the technique.
T1068detects — A.5.7 collects/analyzes threat intel (incl. operational indicators and attacker TTPs) that can feed detective controls and risk processes, surfacing some T1068 activity after the fact; it does not itself perform detection and leaves many exploitation cases outside its scoped sources.
T1068prevents — Threat intelligence on attacker methodologies, tools (incl. BYOVD), vulnerabilities, and indicators feeds risk processes, preventive controls (firewalls/IDS/antimalware), and testing that can block many exploitation paths before they succeed, but cannot stop every unknown or zero-day vulnerability in the class.
T1069detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1069 activity when it produces observable indicators, but the control is primarily about upstream collection/analysis/sharing rather than mandating detection mechanisms and leaves most execution paths of this discovery technique unreached.
T1069.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the reconnaissance technique when indicators or anomalous group-enumeration behavior are present in collected/analyzed intelligence, but this is scoped only to what the org's chosen sources and analysis happen to cover rather than broadly detecting the technique itself.
T1069.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the reconnaissance technique when indicators or anomalous queries appear, but this is scoped only to the subset of T1069.002 that produces detectable signals rather than the technique's core (silent local commands like net group /domain).
T1069.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface the T1069.003 technique when it matches known patterns, but this is scoped only to relevant/insightful intel that the org has chosen to ingest and does not broadly instrument or guarantee detection of arbitrary cloud group enumeration.
T1069.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, IAM rules) and risk processes to block or constrain the discovery/enumeration techniques described.
T1070detects — Threat intelligence activities include collecting/analyzing indicators of specific attacks (operational layer) and feeding them into detective controls (IDS, anti-malware) and testing processes, which can surface T1070's selective artifact modifications when they match known patterns, but this is limited to known TTPs and does not broadly detect novel or platform-specific variants.
T1070.003detects — Threat intelligence collection/analysis of attacker methodologies, tools, TTPs and IOCs (including file deletions or command-clearing patterns) can surface this technique when it matches known patterns, but the control is scoped to awareness/risk-input rather than real-time or comprehensive detection of every instance.
T1070.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface file-deletion activity when it matches known TTPs or IOCs, but the control is silent on detection depth or coverage of this specific post-intrusion cleanup technique.
T1070.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific TTP or related IOCs from share-removal activity, but this is only a slice of what the control requires and does not guarantee detection of the technique itself.
T1070.006detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, indicators) and feeds it into detective controls and testing, which can surface timestomping when known patterns or IOCs are present, but does not itself perform detection and leaves many novel or non-indicated instances unreached.
T1070.006prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of timestomping being used successfully, but the control itself only informs and does not enforce any blocking mechanism.
T1070.007detects — threat intelligence collection/analysis of attacker TTPs and IOCs (including log tampering and artifact removal patterns) can surface this technique when it matches known behaviors, but the control is scoped to awareness feeding risk processes and other controls rather than mandating direct detection of the act
T1070.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1070.008 mailbox-clearing activity when it matches known indicators or anomalous patterns, but this is limited to cases where intelligence is available and integrated — not inherent detection of the technique itself.
T1070.008prevents — Threat intelligence on attacker methodologies, tools (e.g. ExchangePowerShell, mail utility), TTPs for evidence removal, and suspicious email patterns feeds risk processes, updates to preventive controls (firewalls/IDS/antimalware), and testing — enabling informed actions that stop the technique from running in many cases, but leaves a bounded remainder where adversaries still succeed via unaddressed vectors or novel variants.
T1070.009detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface the cleanup technique when indicators are known and relevant, but this is scoped only to the subset of instances matching shared intel rather than broadly detecting the class.
T1070.010detects — threat intelligence activities include collecting/analyzing operational indicators (specific attacks, IOCs) that can feed detective controls and risk processes, which may surface T1070.010 relocation activity in some cases, but the control's core purpose is upstream awareness rather than direct detection of the technique
T1071detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and other detective controls surface T1071's protocol abuse when it occurs on the monitored estate, with the bounded remainder being pre-compromise acquisition of the technique itself or use on unmonitored external infrastructure.
T1071prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to tune preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block or filter the specific application-layer protocol abuse before it succeeds.
T1071.001detects — A.5.7's operational and tactical layers plus its explicit use as input to IDS, firewalls, and anti-malware directly surface T1071.001's protocol-abuse indicators in context; the remainder is that purely novel or encrypted variants may evade signature-based detection until new intel arrives.
T1071.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific IOCs (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) that can block or filter the web-protocol C2 blending, but this is only one slice of a broader risk-management and sharing process that does not itself stop the technique.
T1071.002detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the specific protocol-abuse indicators and anomalous file-transfer traffic described in T1071.002; the remainder is purely internal stealth that blends with expected traffic and is never observed.
T1071.002prevents — Threat intelligence on attacker methodologies, tools, TTPs and IOCs (tactical/operational layers) is explicitly used as input to tune preventive controls (firewalls, IDS, anti-malware) that can block or filter the abused file-transfer protocols and embedded C2, preventing the technique from succeeding in many but not all cases.
T1071.003detects — A.5.7's operational and tactical layers plus its explicit use as input to IDS, anti-malware and other detective controls surface the anomalous use of mail protocols for C2 by blending with legitimate traffic.
T1071.003prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive technical controls such as firewalls and intrusion detection systems, which can block or filter the abuse of mail protocols for C2.
T1071.004detects — A.5.7's operational layer, collection/analysis of technical indicators, and explicit use as input to detective controls (IDS, anti-malware) and testing directly surface DNS tunneling/beaconing techniques.
T1071.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can block many common DNS tunneling/beaconing patterns, but cannot prevent all novel or low-and-slow variants that blend with legitimate traffic.
T1071.004responds — Threat intelligence (including operational indicators and analysis) feeds into detective controls and incident processes that can contain/eradicate an in-progress DNS tunneling C2 channel once underway, but the control's core purpose is preemptive awareness rather than active response actions.
T1071.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface pub/sub C2 blending with normal traffic, but this is only a slice of the technique's possible implementations and the control's primary purpose is broader awareness rather than direct detection.
T1071.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) to block known pub/sub abuse patterns, but does not stop novel or blended uses that mimic normal traffic.
T1072detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface indicators of abuse of deployment tools, but the control is primarily about awareness production rather than mandating specific detection mechanisms for this technique.
T1072prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and integration into preventive controls/risk processes can inform actions that block or harden against abuse of deployment tools, but does not stop the technique outright as it is a post-compromise lateral movement method relying on existing legitimate access.
T1074detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface staging activity or related indicators, but the control is primarily about awareness production rather than direct detection mechanisms and leaves most technical detection to other controls.
T1074.001detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, TTPs) and feeding them into detective controls like IDS/anti-malware, which can surface local staging activity when it matches known patterns, but this is scoped to known threats only and does not broadly detect novel or non-indicated staging.
T1074.002detects — A.5.7's operational and tactical layers plus sharing into preventive/detective controls (IDS, anti-malware) and risk processes can surface indicators of staging activity, but this is limited to known patterns from external sources and does not guarantee detection of novel or internal staging.
T1074.002prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block staging behaviors before they run, but this is only one slice of a broad awareness activity that does not itself stop the technique.
T1078detects — A.5.7's operational and tactical layers plus explicit use as input to detective controls (IDS, anti-malware) and risk processes surface indicators of valid-account abuse (e.g. anomalous use of inactive/over-permissioned accounts) after the technique has begun.
T1078prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware, risk processes, testing) and can stop credential abuse techniques from succeeding in many cases, but it does not remove the underlying account-credential weakness or block all paths (e.g., inactive accounts, pivoting, or undetected compromise).
T1078.001detects — Threat intelligence activities explicitly include collecting/analyzing operational indicators of specific attacks (including default-account abuse) and feeding them into detective controls such as IDS, anti-malware, and security testing, which surfaces the technique when it occurs.
T1078.001prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. IAM hardening, credential monitoring), and testing to stop default-account abuse before it succeeds; this is genuine but only a slice because the control is awareness-oriented, does not mandate any specific technical change, and leaves many default-account vectors (e.g. unpatched appliances, post-setup creation) untouched.
T1078.002detects — A.5.7's operational layer, collection/analysis of specific attacks and technical indicators, plus feeding into detective controls (IDS, anti-malware) and risk processes, surfaces domain-account abuse indicators in most cases, with a bounded remainder for stealthy or non-indicated compromises.
T1078.002prevents — Threat intelligence activities explicitly feed into risk management, technical preventive controls (firewalls/IDS/antimalware), and testing to facilitate informed actions that can stop the technique from succeeding, but this is indirect, depends on what the org actually implements from the intel, and leaves many acquisition vectors (e.g. dumping, reuse) untouched.
T1078.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of local-account abuse, but this is scoped to relevant/insightful intelligence the org elects to ingest and does not mandate detection of the technique itself
T1078.003prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block local-account abuse paths before they succeed.
T1078.004detects — Threat intelligence collection, analysis, and sharing (including operational indicators and tactical TTPs) directly feeds detection in preventive/detective controls, risk processes, and testing, surfacing cloud account abuse patterns and IOCs.
T1078.004prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block the initial compromise paths (brute force, phishing, credential abuse) described for T1078.004; it is not a direct barrier and leaves many account-misconfiguration and privilege-assumption vectors untouched.
T1080detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including those that taint shared content) and feeding them into detective controls such as IDS or anti-malware, which can surface the technique when it matches known patterns; this is limited to known, shared indicators rather than novel or internal-only instances of the technique.
T1080prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) and risk processes to block tainting of shared content or its execution, but this is indirect, depends on accurate actionable intel and control updates, and leaves many execution paths (e.g. novel binaries, user-opened files) unaddressed.
T1082detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1082 activity when it matches known indicators or anomalous patterns, but this is scoped only to the fraction of instances where intelligence is available, relevant, and integrated — not the technique in general.
T1082prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes, preventive controls and testing to block or raise the bar on this reconnaissance technique in relevant environments, but the control itself only supplies awareness and does not directly prevent the discovery action.
T1083detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1083 activity via indicators or anomalies, but this is scoped only to known/relevant threats and does not broadly instrument for all file-enumeration behaviors across platforms.
T1083prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware) and testing to block common discovery utilities or paths before the technique runs, but this is inherently selective, not universal, across all platforms and custom methods.
T1087detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1087 activity via indicators or anomalies, but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of all enumeration methods across the technique's platforms.
T1087prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware) and testing to block common discovery paths, but many enumeration methods (built-in commands, cloud APIs, file searches, misconfigs) remain unblocked.
T1087.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific technique when indicators or anomalous enumeration behaviors are present in collected/analyzed intelligence, but this is scoped only to what the org ingests and deems relevant rather than broad detection of the technique itself.
T1087.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when it produces observable indicators, but the control is primarily about upstream collection/analysis/sharing rather than mandating detection of the enumeration itself.
T1087.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of account-enumeration attempts, but the control is primarily about upstream collection/analysis rather than direct runtime detection of the technique itself.
T1087.003prevents — Threat intelligence (strategic/tactical layers, analysis into risk processes and preventive controls like anti-malware/firewalls/IDS) can inform actions that block or raise barriers to account enumeration techniques, but does not stop the technique from running when an authenticated session or directory access is already available.
T1087.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific technique of authenticated cloud account enumeration after it occurs, but this is only one slice of the control's broader strategic/tactical focus and does not mandate detection of the technique itself.
T1087.004prevents — Threat intelligence on attacker methodologies, tools (e.g. AWS CLI enumeration commands), and indicators feeds risk processes, preventive controls (firewalls/IDS/antimalware), and testing that can block or detect authenticated enumeration before it succeeds.
T1090detects — A.5.7's operational layer, collection/analysis of technical indicators, and feeding into detective controls (IDS, anti-malware) and test processes directly surfaces proxy-based C2 and traffic-redirection TTPs once present.
T1090prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block proxy-based C2 paths before they succeed.
T1090.001detects — A.5.7's operational and tactical layers plus explicit use as input to IDS, firewalls, and anti-malware directly surface internal proxy C2 redirection and anomalous internal traffic patterns.
T1090.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block or disallow internal proxy usage and C2 redirection before it succeeds.
T1090.002detects — A.5.7's operational and tactical layers plus its explicit use as input to IDS, firewalls, and anti-malware directly surface the proxy-based C2 technique when indicators or anomalous patterns match collected threat intel.
T1090.002prevents — A.5.7's threat-intelligence cycle (collect/analyse/share) feeds risk management, preventive controls (firewalls/IDS), and testing to enable informed actions that can block proxy-based C2 before it succeeds; this reaches only a slice of the technique because intelligence is not itself a blocking mechanism and many external-proxy choices (e.g. low-profile VPS) remain hard to pre-empt universally.
T1090.003detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, firewalls, anti-malware) and test processes, surface indicators and patterns of multi-hop proxy chains (Tor, ORB, custom onion routing on compromised devices) as they occur.
T1090.003prevents — Threat intelligence on attacker methodologies, tools (e.g. Tor, ORB networks, onion routing), and TTPs can be fed into risk processes, firewalls, IDS, and tests to block or detect multi-hop proxy chains before they succeed, but this is indirect, depends on implementation quality, and leaves many execution paths (especially novel or internal) unblocked.
T1090.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface domain fronting indicators (e.g. anomalous SNI/Host mismatches or CDN patterns), but this is scoped by relevance and not a dedicated detection mechanism for the technique itself.
T1090.004prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS), and testing to block known domain-fronting patterns, but cannot stop novel or zero-day variants of the technique.
T1091detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of removable-media replication techniques, but this is limited to known IOCs in monitored environments and does not broadly detect air-gapped, manual, or firmware-based instances.
T1091prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and sharing feeds directly into preventive controls (firewalls, IDS, anti-malware, testing) and risk processes that can disable Autorun, block removable-media execution vectors, or detect/prevent the malware payload before insertion/use.
T1092detects — A.5.7's operational threat intelligence layer (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and risk processes can surface T1092 indicators on removable media, but this is limited to known patterns and does not broadly detect novel or unshared instances of the technique.
T1095detects — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker tools, methodologies, and indicators) plus its explicit use as input to detective controls like IDS can surface non-application-layer C2 (e.g. ICMP, VMCI) when those indicators are known and relevant, but the control is silent on monitoring depth, does not itself instrument detection, and leaves many obscure or novel protocol uses undetected.
T1095prevents — Threat intelligence on attacker methodologies, tools, specific TTPs (including non-application-layer C2 channels like ICMP/VMCI) and sharing with peers directly enables informed preventive actions (firewalls, IDS signatures, risk processes) that can block many but not all instances of the technique.
T1098detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface specific T1098 indicators or anomalous account changes, but the control is primarily about awareness production rather than mandating detection mechanisms and leaves most in-host manipulation techniques outside its direct observational scope.
T1098prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into risk processes/firewalls/IDS/antimalware/testing can inform actions that block common account manipulation paths before they succeed, but many sub-techniques (e.g., post-compromise permission changes on diverse platforms) remain unaddressed by awareness alone.
T1098.001detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls like IDS can surface T1098.001 activity after it occurs, but the control is primarily about awareness feeding risk processes rather than mandating detection mechanisms, leaving most of the technique's variants (e.g., API calls, SSH key adds) outside routine coverage.
T1098.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and sharing feeds directly into preventive controls (firewalls, IDS, anti-malware, IAM rules) and risk processes that can block credential-addition APIs/permissions before the technique runs.
T1098.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of permission-granting activity, but the control is primarily about ingesting/analyzing broad threat intel rather than directly detecting this specific post-compromise technique in flight.
T1098.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls and risk processes to block the permission-granting actions, but the control only supplies awareness and does not itself stop the technique.
T1098.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface specific TTPs or indicators tied to role/permission additions, but the control is primarily about awareness production rather than mandating detection mechanisms for this technique.
T1098.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs/indicators (operational layer), and integration into risk processes plus preventive controls (e.g. IAM policy enforcement, identity monitoring) can inform actions that stop the technique from succeeding in many cloud/IaaS/SaaS scenarios, but does not prevent the adversary action itself when they already hold sufficient permissions on a compromised account.
T1098.004detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) that can feed detective controls and risk processes, but does not itself perform detection of the technique.
T1098.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes, testing) to block the modification techniques before they succeed, but this is only a slice of the broad persistence vector across platforms and does not guarantee prevention.
T1098.005detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface T1098.005 activity or related IOCs, but this is scoped only to the subset of known/analyzable instances rather than broadly detecting the technique itself.
T1098.005prevents — Threat intelligence on attacker methodologies for device registration (tactical layer) and specific indicators (operational layer) feeds risk processes, preventive controls (e.g. MFA/conditional access hardening), and testing to stop the technique from succeeding in many cases, but does not eliminate the root enrollment paths or guarantee prevention when credentials are already compromised.
T1098.006detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including on container orchestration) and feeding them into detective controls like IDS or anti-malware, which can surface T1098.006 activity; this is limited to a slice because the control is not itself a detector, does not mandate coverage of this technique, and many instances (especially post-compromise ABAC/RBAC changes using valid accounts) remain undetected without specific contextual indicators.
T1098.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block the permission-addition step, but the control only supplies awareness and does not itself stop the technique.
T1098.007detects — Threat intelligence collection/analysis (esp. operational layer and sharing) can surface T1098.007 patterns or IOCs as input to detective controls and risk processes, but the control's core purpose is awareness/prevention rather than direct detection of the technique.
T1098.007prevents — Threat intelligence on attacker methodologies, tools (net localgroup, usermod), and persistence patterns can inform preventive controls and risk processes that stop the technique from being executed, but the control only supplies awareness and does not itself enforce any prevention.
T1102detects — A.5.7's operational and tactical layers plus its mandated use as input to detective controls (IDS, anti-malware) and testing can surface T1102's web-service C2 patterns when indicators are known and ingested, but the control's scope is limited to relevant, insightful, and actionable intelligence the organization has chosen to collect and does not guarantee detection of every instance or variant.
T1102prevents — Threat intelligence on attacker methodologies, tools, TTPs and specific indicators (tactical/operational layers) is explicitly used to update preventive controls (firewalls, IDS, anti-malware) and risk processes, which can block many common web-service C2 channels before they succeed; it does not stop every possible legitimate web service from ever being abused.
T1102.001detects — A.5.7's operational and tactical layers plus its use as input to detective controls (IDS, anti-malware) and testing can surface indicators of dead-drop resolver usage, but this is scoped only to what the org ingests and analyzes from chosen sources rather than a broad guarantee of detection.
T1102.001prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block known dead-drop patterns or domains before the technique succeeds, but this is inherently limited to observed instances and does not stop novel or obfuscated uses of legitimate web services.
T1102.002detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, etc.) and risk processes, surface the specific TTP of legitimate web services used for bidirectional C2
T1102.002prevents — Threat intelligence on attacker methodologies, tools, C2 techniques and indicators (tactical/operational layers) is explicitly used to feed preventive controls (firewalls, IDS, anti-malware) and risk processes that can block this exact bidirectional Web-service C2 channel before it succeeds.
T1102.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of one-way Web-service C2, but the clause's mechanism is collection/analysis/sharing rather than direct observation and its scope is set by relevance and objectives, leaving many in-band uses on popular services undetected.
T1102.003prevents — Threat intelligence on attacker methodologies, tools, C2 techniques and indicators (tactical/operational layers) is explicitly used to feed preventive controls (firewalls, IDS, anti-malware) and risk processes that can block this exact one-way Web-service C2 channel before it succeeds.
T1104detects — A.5.7's operational and tactical layers plus explicit use as input to IDS, anti-malware, and testing processes surface indicators and patterns of multi-stage C2 channels (e.g., staged callbacks, loaders, fallback infrastructure) after they appear.
T1104prevents — Threat intelligence on attacker methodologies, tools, C2 infrastructure patterns and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block first-stage callbacks or known multi-stage patterns before they succeed, but does not stop novel or custom staging that evades existing signatures and configurations.
T1105detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface many T1105 indicators and behaviors, but the control is silent on real-time detection mechanisms and does not reach every platform/variant (e.g. living-off-the-land binaries or cloud-sync abuse).
T1105prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block the specific ingress mechanisms and utilities named in T1105.
T1106detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and test processes can surface native API abuse indicators, but the control is primarily about awareness production and sharing rather than mandating or performing detection itself.
T1110detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS directly surfaces brute-force attempts in flight or in indicators.
T1110prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational), and integration into preventive controls/risk processes can inform actions that stop many brute-force attempts before they succeed, but does not block the technique outright (e.g., offline attacks, adaptive adversaries, or unaddressed weak passwords remain possible).
T1110.001detects — Threat intelligence collection, analysis, and sharing (including operational indicators and tactical attacker methodologies) directly feeds technical detective controls (IDS, anti-malware, etc.) and risk processes that surface password-guessing attempts in flight.
T1110.001prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used to update preventive controls (firewalls, IDS, anti-malware, account policies, test processes) that stop password guessing before it succeeds, per the control's own guidance; the remainder is that some guessing variants (e.g. against exempted legacy protocols or MFA-bypassing accounts) stay reachable.
T1110.002detects — Threat intelligence collection/analysis of tactical/operational layers (attacker tools, methodologies, specific IOCs) and its use as input to detective controls (e.g. IDS, anti-malware) surfaces password-cracking attempts or related artifacts in many cases, but the core cracking activity occurs offline on adversary systems outside the target network where organizational detection has no view.
T1110.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators, and integration into preventive controls (firewalls, IDS, anti-malware) and risk processes can inform actions that stop many password-cracking attempts from succeeding, but leaves residual cases (e.g., offline cracking on adversary systems, unmonitored vectors, or non-technical exposures) unaddressed.
T1110.003detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, monitoring) and risk processes, surface password spraying attempts via indicators, anomalous auth patterns, and shared intel on the technique.
T1110.003prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, auth policy tuning, test processes) to block common spraying vectors before they succeed, but this is only a slice of the technique (e.g., does not stop all low-and-slow attempts or novel variants).
T1110.004detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface credential-stuffing attempts and related indicators (breach dumps, anomalous auth failures) for most of the technique's surface.
T1110.004prevents — Threat intelligence on attacker methodologies, tools, indicators and breach-dump sources (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, account lockout tuning, credential monitoring) to stop many credential-stuffing attempts before they succeed; it does not eliminate the root technique when users still reuse passwords or when indicators are absent.
T1111detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and risk processes surfaces T1111 techniques such as keyloggers, token interception, and SMS compromise before or during execution.
T1111prevents — Threat intelligence on attacker methodologies/tools for MFA interception (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls and risk processes, enabling informed actions that stop the technique from succeeding in many cases, but it does not remove the underlying attack surface or guarantee prevention for all vectors (e.g., unaddressed smart-card keylogging or provider compromises).
T1112detects — Threat intelligence collection/analysis (esp. operational/tactical layers and sharing) can surface specific TTPs, IOCs, and patterns of Registry abuse for evasion/persistence, feeding into detective controls and tests, but does not itself perform detection and leaves many local or novel uses unreached.
T1112prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. blocking common registry-modifying tools or indicators), and testing to stop many instances of T1112 from occurring, but does not block the technique outright as it is a permitted admin-level OS function with many legitimate uses.
T1113detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface screen-capture techniques when indicators or anomalous behavior are present in collected/analyzed intelligence, but this is scoped only to known or shared TTPs rather than reliably detecting novel or in-progress instances across all platforms.
T1114detects — A.5.7's operational layer, collection/analysis of specific attacks and technical indicators, plus feeding into detective controls (IDS, anti-malware) and risk processes, surfaces T1114 email collection activity when indicators are present.
T1114prevents — Threat intelligence activities explicitly feed into risk management, technical preventive controls (firewalls/IDS/antimalware), and testing processes that can block or reduce the feasibility of email collection techniques before they succeed.
T1114.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of local email collection attempts, but this is limited to known TTPs or IOCs and does not broadly detect the technique itself.
T1114.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block the local collection technique in many cases, but this is indirect, depends on implementation, and leaves residual paths (e.g. legitimate user processes or unmonitored endpoints).
T1114.002detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the specific Exchange/Office 365 collection activity via indicators, anomalous access, and tooling patterns.
T1114.002prevents — Threat intelligence on attacker methodologies, tools (e.g. MailSniper), and indicators can be fed into preventive controls and risk processes to block credential abuse paths or known collection TTPs before they succeed, but this is indirect, depends on accurate/actionable intel, and leaves many credential-theft or misconfig vectors untouched.
T1114.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of rule creation or anomalous forwarding, but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of hidden/MAPI-based or transport-rule abuse across all platforms.
T1114.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to preventive controls and risk processes that can block rule creation or forwarding abuse before it occurs.
T1115detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface clipboard-collection activity when known IOCs or TTPs match observed behavior, but this is scoped only to recognized threats and does not broadly instrument or guarantee detection of the technique itself.
T1119detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface automated collection activity when indicators or patterns are known, but this is scoped to known threats only and does not broadly instrument for the technique itself.
T1119prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can stop some automated collection paths before execution, but leaves many others (custom scripts, built-in remote tool features, discovery sub-techniques, cloud ETL) untouched.
T1120detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of peripheral device discovery activity, but this is only a slice of the broad, low-and-slow reconnaissance technique across platforms with no dedicated detection mandate.
T1123detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of audio-capture techniques after they run, but this is limited to known IOCs in selected sources rather than reliably detecting the broad class across all platforms and API uses.
T1123prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block the malware/scripts that perform audio capture, but this does not stop all instances such as those using legitimate APIs or built-in apps without detectable indicators.
T1124detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1124 when it matches known threat actor patterns or indicators, but the control is scoped to relevant/insightful threat intel rather than mandating detection of this low-level discovery technique itself.
T1125detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) can surface indicators of video-capture malware or anomalous device access, but the control is primarily about producing and sharing intelligence rather than mandating detection mechanisms and leaves many execution paths (API abuse without known IoCs, non-malware scripts) unreached.
T1125prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block the malware/scripts that perform T1125, but this does not stop all instances such as those using legitimate APIs or non-malware vectors.
T1127detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and test processes can surface T1127's use of signed developer utilities as anomalous or malicious, but this is scoped by relevance/insight/actionability and does not guarantee detection of all instances or variants.
T1127prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. app allowlisting, anti-malware), and testing to block or detect use of these signed developer utilities before the technique runs.
T1127.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface MSBuild abuse via indicators or anomalous build activity, but this is scoped by relevance/insight/actionability and does not guarantee detection of all instances or variants.
T1127.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of ClickOnce abuse (e.g. specific IOCs or anomalous .appref-ms/.application behavior), but this is scoped to relevant, actionable intel rather than broad or guaranteed detection of the technique.
T1127.002prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. app whitelisting, web filtering), and testing to block known ClickOnce abuse paths before execution.
T1127.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface JamPlus abuse via indicators or anomalous build-tool behavior, but this is scoped only to what the org ingests/analyzes and feeds downstream rather than a dedicated, broad detection mechanism for the technique.
T1127.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls (e.g. app control rules), and testing to block JamPlus abuse before it runs, but this is only a slice of the class as the control does not itself enforce any blocking mechanism.
T1129detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1129 indicators or anomalous module loads, but this is scoped only to the subset of intelligence the org ingests and operationalizes rather than a dedicated detection mechanism.
T1129prevents — Threat intelligence on attacker use of shared module loading (tactical/operational indicators, tooling, and IOCs) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block many instances of the technique, but does not stop all variants or unknown uses of legitimate loaders like LoadLibrary/dlopen.
T1132detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface encoded C2 traffic that matches known indicators or anomalous patterns, but this is scoped only to relevant/insightful intelligence the org ingests and does not guarantee detection of novel encodings.
T1132prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls/IDS/antimalware) to block or detect common encodings in C2 traffic, but this does not stop adversaries from using encoding in general.
T1132.001detects — A.5.7's operational layer, collection/analysis of technical indicators, and explicit use as input to detective controls (IDS, anti-malware) directly surfaces standard encoding in C2 traffic
T1132.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) to block or detect standard C2 encodings before harm occurs, but this is only a slice of the technique's surface and does not stop all instances or variants.
T1132.002detects — A.5.7's operational layer, collection/analysis of technical indicators, and explicit use as input to detective controls (IDS, anti-malware) directly surfaces non-standard encoding in C2 traffic; mostly because strategic/tactical layers and non-technical sharing add coverage breadth without deepening detection of this specific technique.
T1132.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls/IDS/antimalware) and risk processes to block known non-standard encoding patterns in C2, but does not stop novel or unknown variants.
T1133detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1133 indicators or anomalous external remote service use, but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of the technique across all its forms (e.g. unauthenticated exposed services, Tor hidden services).
T1133prevents — Threat intelligence activities (collect/analyze/share strategic/tactical/operational info on attackers, methodologies, tools, and indicators) feed risk management, preventive controls (e.g. firewalls, IDS, anti-malware), and testing to enable informed actions that stop T1133 techniques like exposed services, weak auth on VPN/RDP, or Tor hidden services from being leveraged.
T1134detects — A.5.7 collects/analyses/shares threat intel (including operational IOCs and attacker TTPs) that can feed detective controls and risk processes, surfacing T1134-like token manipulation when indicators are known; it does not itself perform detection.
T1134prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block common token-stealing paths, but the control does not stop the technique itself and leaves many variants (e.g. standard-user runas or AD-field manipulation) unaddressed.
T1134.001detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, but does not itself perform detection of the technique.
T1134.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of token-related process creation, but this is scoped only to what the org's selected sources and analysis choose to cover rather than mandating broad detection of the technique.
T1134.002prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. privilege restrictions, token protections), and testing to stop this Windows token technique from being used, but it is indirect, depends on accurate actionable intel, and leaves many residual cases unaddressed.
T1134.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface specific TTPs or indicators of token creation/impersonation after the fact, but this is only a slice of the broad threat-intelligence pipeline whose primary purpose is awareness rather than guaranteed detection of the technique.
T1134.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes, testing) to block the technique before it runs, but this is only a slice of the class because many instances rely on already-compromised credentials or native APIs that intelligence rarely stops outright.
T1134.004detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware and security testing, which can surface PPID-spoofing artifacts when observed in the wild; this is limited to known patterns shared via intel sources rather than reliably catching novel or in-memory spoofing.
T1134.005detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls like IDS or anti-malware as well as security testing, which can surface SID-History Injection post-compromise or in testing; this is only a slice because the control is primarily about awareness production rather than mandating specific detection coverage of the technique.
T1135detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when it produces observable indicators, but the control is primarily about awareness production rather than mandating detection coverage of network-share queries.
T1135prevents — Threat intelligence on attacker methodologies, tools (e.g. net view, sharing -l), and TTPs for discovery can be fed into risk processes, preventive controls (firewalls/IDS), and testing to block or reduce the feasibility of this technique in the organization's environment.
T1136detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of account creation activity, but this is scoped only to relevant/insightful intelligence that the org has chosen to ingest and does not broadly detect the technique across all platforms or instances.
T1136prevents — Threat intelligence on attacker methodologies, tools, specific TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block or raise barriers to account creation, but the control itself only supplies awareness and does not directly enforce any prevention.
T1136.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the creation of local accounts when tied to known TTPs or IOCs, but this is scoped only to the subset of instances that match collected/analyzed threat intel rather than all creations.
T1136.001prevents — Threat intelligence on attacker methodologies for creating/maintaining local accounts (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to reduce the likelihood the technique is successfully used, but does not stop an already-privileged adversary from executing account-creation commands.
T1136.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface domain account creation as an anomalous or suspicious event, but this is indirect, depends on implementation, and leaves the bulk of the technique (especially post-creation use for persistence) outside its direct detection mandate.
T1136.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cloud account creation, but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of the technique across all platforms and stealthy low-privilege creations.
T1136.003prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block or raise barriers to cloud account creation and related persistence techniques.
T1137detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1137 indicators or anomalous Office startup behaviors, but this is scoped by relevance/insight/actionability and does not guarantee detection of all Office persistence mechanisms.
T1137prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, firewalls), and testing to block the Office persistence mechanisms before they are deployed, but this is only a slice of the class because the control is awareness-oriented, does not itself implement the blocks, and many organizations will not action every relevant indicator.
T1137.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of this Office-template persistence technique, but the control is scoped to relevant threat intel only and does not mandate broad detection coverage of the method.
T1137.001prevents — A.5.7's strategic/tactical threat intel layers, when fed into risk management and preventive controls (firewalls/IDS/antimalware), can inform policy and configuration changes that block macro-enabled templates or Office startup abuse for many common cases, but does not stop the technique outright (e.g. local template modification, registry hijacks, or trusted-location bypasses remain possible).
T1137.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the anomalous Registry key or DLL load, but this is scoped by relevance/insight/actionability chosen by the organization and does not guarantee detection of this specific persistence technique.
T1137.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, app whitelisting), and testing to stop the Registry abuse from being introduced or succeeding, but this is only one slice of the persistence technique's surface and depends on timely, actionable intel reaching the right controls.
T1137.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific TTP (malicious Outlook form loading/execution on crafted email), but this is only a slice of the control's broader strategic/tactical focus and does not mandate detection of this technique.
T1137.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to block the form-abuse vector before it is deployed, but the control only supplies awareness and does not itself enforce any blocking action.
T1137.004detects — A.5.7's operational layer and use as input to detective controls (e.g. IDS, anti-malware) and testing can surface the specific TTP and indicators of this persistence technique post-compromise, but the control's primary focus is strategic/tactical awareness feeding risk processes rather than direct detection of the technique in flight.
T1137.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, email security), and testing to block the setup or loading of malicious Outlook Home Pages before persistence is achieved; this is a genuine but minority slice of the class, as the control does not itself enforce any technical block and most instances arise from unaddressed legacy features or unmonitored mailbox changes.
T1137.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific TTP and crafted-email trigger after compromise, but the control's core purpose is upstream awareness and risk-process integration rather than direct runtime detection of the rule-abuse technique itself.
T1137.005prevents — A.5.7's threat-intelligence loop (collect/analyse/share into risk processes, preventive controls, and testing) can surface Outlook-rule abuse patterns in time for organizations to tune email filters, disable dangerous rule actions, or block the technique before it is deployed, but the control itself only supplies awareness and does not mandate or enforce any specific preventive barrier.
T1137.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of add-in based persistence after the fact, but this is only a slice of the broad threat-intelligence process whose primary purpose is awareness rather than direct detection of the technique.
T1137.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, app whitelisting), and testing to block add-in abuse before it establishes persistence; this is a genuine but minority slice of the class, as the control does not itself stop the Office add-in mechanism.
T1140detects — Threat intelligence activities include collecting/analyzing tactical and operational indicators (tools, techniques, specific attacks) that can surface deobfuscation methods like certutil or copy commands when observed in the environment, but this is limited to known patterns fed into detective controls and does not broadly detect novel or in-process instances.
T1176detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of malicious extensions post-installation, but the control is primarily about awareness production rather than direct detection and leaves most of the technique's installation and blending undetected.
T1176prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and marketplace weaknesses directly feeds preventive controls, risk processes, and testing to stop malicious extension installation and abuse before persistence is established, but does not guarantee prevention of all social-engineering, already-compromised, or benign-abuse vectors.
T1176.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and security testing can surface indicators of malicious browser-extension installation or behavior, but this is only a slice of the technique's full surface (silent file manipulation, social engineering, app-store evasion, RAT C2).
T1176.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and sharing with others directly feeds risk processes, preventive controls (e.g. anti-malware, firewalls), and testing to block extension installation vectors and persistence before they can run.
T1176.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of malicious/sideloaded IDE extensions or anomalous extension behavior, but this is limited to known IOCs or post-install anomalies rather than reliably detecting all abuse of benign extensions or the persistence mechanism itself.
T1176.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and marketplace compromises directly feeds preventive controls, risk processes, and testing that can block malicious/sideloaded IDE extensions and some benign-abuse vectors before persistence is established.
T1185detects — Threat intelligence activities explicitly include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and security testing, which surfaces T1185's injection, proxying, and pivoting behaviors when they match known patterns.
T1185prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and testing can block many session-hijacking vectors before execution, but leaves residual cases such as zero-days, insider-enabled injection, or non-network pivots unaddressed.
T1187detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware, which can surface T1187 attempts (e.g. anomalous SMB/WebDAV to external hosts), but this is only one slice of the control's broader strategic/tactical focus and does not guarantee detection of all variants.
T1187prevents — Threat intelligence on attacker methodologies, tools (e.g. SMB/WebDAV forcing, .LNK/.SCF, EFSRPC), and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block the technique in many enterprise scenarios, but does not stop all delivery vectors such as spearphishing or internal shares.
T1189detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface drive-by indicators, watering-hole patterns, and anomalous browser behavior; the remainder is purely pre-compromise adversary infrastructure work that never reaches monitored organizational sensors.
T1189prevents — Threat intelligence on attacker methodologies, tools, watering-hole patterns, and indicators directly feeds risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop many (but not all) drive-by compromise vectors before they succeed.
T1190prevents — Operational threat intelligence on public-facing application exploits enables timely patching and WAF rule updates, limiting the adversary's success in exploiting those applications for initial access.
T1190detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface indicators, methodologies and specific attacks matching T1190's exploitation of public-facing apps; the remainder is novel/zero-day exploits without prior indicators.
T1195detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and testing processes can surface supply-chain TTPs or IOCs after the fact, but this is limited to known/post-compromise indicators rather than reliably detecting novel/pre-delivery manipulations across the full supply chain described.
T1195prevents — Threat intelligence on attacker methodologies, tools, supply-chain TTPs, and specific IOCs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to stop many (but not all) supply-chain manipulation vectors before they succeed.
T1195.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of dependency/CI-CD compromise after it occurs, but this is a minority slice of the broad pre-receipt supply-chain technique whose dominant vectors (e.g. typosquatting, abandoned-package revival) sit outside routine detection scopes.
T1195.001prevents — Threat intelligence on attacker methodologies, tools, specific attacks, and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes, which can stop the supply-chain manipulation technique from succeeding in many cases, but it is not a direct barrier and leaves residual exposure (e.g., unknown or zero-day compromises).
T1195.002detects — A.5.7's operational layer and use as input to IDS/anti-malware/firewalls can surface post-delivery indicators of a supply-chain compromise (e.g. anomalous behavior or known malicious signatures), but does not detect the pre-delivery manipulation itself and leaves broad undetected slices such as custom targeting or novel implants.
T1195.002prevents — Threat intelligence on attacker methodologies, tools, supply-chain TTPs and specific IOCs (tactical/operational layers) is explicitly used as input to preventive controls, risk processes and testing that can stop the manipulation from succeeding against the organization.
T1195.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface supply-chain hardware backdoors via indicators or anomalies post-deployment, but this is a minority slice given the technique's pre-receipt stealth and the control's primary focus on awareness rather than direct detection mechanisms.
T1195.003prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies and indicators can feed risk processes and technical preventive controls (firewalls/IDS/antimalware) to block some supply-chain compromise paths, but cannot stop pre-delivery hardware/firmware manipulation itself.
T1197detects — A.5.7 collects/analyzes/shares threat intelligence (including operational IOCs and attacker TTPs) that can feed detection rules in IDS, anti-malware, and monitoring tools, but the control itself performs no detection and only indirectly enables it for a subset of BITS abuse indicators.
T1197prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls (firewalls/IDS/antimalware), and testing to block BITS abuse in many cases, but does not remove or universally stop the built-in Windows mechanism itself.
T1199detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of third-party compromise or anomalous trusted-access activity, but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of the technique itself.
T1199prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) that feed risk management, preventive controls (e.g. firewalls, IDS, anti-malware), and testing can identify and block common third-party trust abuse paths before they succeed.
T1200detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of introduced hardware (e.g. new devices, anomalous traffic from taps or rogue APs), but this is limited to post-introduction observables and does not broadly cover physical insertion or all listed capabilities like DMA or keystroke injection.
T1201detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls can surface T1201 activity when it matches known adversary methodologies or indicators, but this is scoped only to relevant/insightful intelligence that the org has chosen to ingest and is not a general detection mechanism for the technique.
T1202detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and security testing, which can surface T1202's use of living-off-the-land binaries and stealthy proxy/local command abuse; however, the control's scope is limited to relevant, insightful, and actionable intel from vetted sources, leaving many novel or organizationally-irrelevant instances undetected.
T1202prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. Group Policy, firewalls, anti-malware), and testing to block many abuse vectors for indirect execution, but cannot stop novel or unknown utilities and leaves a genuine residual slice of the technique.
T1203detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and testing controls directly surface T1203 exploitation attempts or indicators before or during execution.
T1203prevents — Threat intelligence on attacker methodologies, tools, exploit research targets, and specific indicators directly feeds preventive controls, risk processes, and testing to stop many (but not all) client-application exploitations before they succeed.
T1204detects — Threat intelligence collection/analysis of tactical/operational layers (attacker methodologies, specific attacks, indicators) plus feeding into detective controls and test processes surfaces T1204 user-execution patterns (e.g. post-phishing behaviors, social engineering lures) before or during occurrence.
T1204prevents — Threat intelligence on attacker methodologies, tools, social engineering lures, and specific indicators (tactical/operational layers) is explicitly used to feed preventive controls, risk processes, and testing that can stop users from executing the malicious payloads or following the deceptive steps in T1204.
T1204.001detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and use as input to detective controls (IDS, anti-malware) directly surfaces the malicious link and its indicators before or during the click event.
T1204.001prevents — Threat intelligence (strategic/tactical/operational) is explicitly used to facilitate informed preventive actions, feed risk management, and tune technical preventive controls that can block the social-engineering vector or its follow-on execution techniques before the user click occurs.
T1204.002detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware) and risk processes, surface indicators and patterns of malicious-file lures before or during user execution
T1204.002prevents — Threat intelligence on attacker methodologies, tools, file types, masquerading and social engineering (tactical/operational layers) is explicitly used to feed preventive controls, risk processes and testing that can stop the technique from succeeding, but this is only one slice of a user-action/social-engineering vector that also depends on training, email filtering and endpoint execution controls outside A.5.7's scope.
T1204.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of malicious/backdoored images in repositories or during deployment, but this is scoped to selected relevant sources and does not broadly instrument image scanning or runtime detection across IaaS/containers.
T1204.003prevents — Threat intelligence on attacker methodologies, tools, backdoored images in public repos, naming tricks, and cloud/container TTPs (tactical/operational layers) is explicitly used as input to preventive technical controls and risk processes, enabling informed actions that stop the technique from succeeding in many cases, but it is not a direct barrier and leaves residual exposure where intel is incomplete, untimely, or unapplied.
T1204.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of ClickFix-style social engineering and the resulting execution, but this is only a slice of the technique's pre-execution social engineering vectors across web, email, and user action.
T1204.004prevents — Threat intelligence on attacker methodologies (tactical layer), social engineering lures like ClickFix, and specific indicators enables informed preventive actions (e.g. updating filters, IDS rules, user training, or test processes) that stop the technique from succeeding in many cases, but does not eliminate user error or all delivery vectors.
T1204.005detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and testing controls directly surface malicious libraries, supply-chain compromises and related indicators; the strategic layer and non-technical sharing aspects form a bounded remainder.
T1204.005prevents — Threat intelligence on attacker methodologies, tools, malicious package trends, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to stop users from installing malicious libraries before execution occurs.
T1205detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface traffic-signaling patterns or indicators, but the control is about producing and sharing intelligence rather than mandating specific detection mechanisms, leaving most implementations of the technique (custom sequences, raw sockets, WoL) outside its direct reach.
T1205prevents — Threat intelligence on attacker methodologies, tools, specific indicators and attack types (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block the signaling sequences or magic values before they succeed.
T1205.001detects — A.5.7's operational layer, collection/analysis of specific-attack details and technical indicators, and use as input to detective controls (e.g. IDS) and testing directly surfaces port-knocking signals or the triggered port behavior.
T1205.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block port-knocking sequences or the resulting port-opening behavior before they succeed.
T1205.002detects — A.5.7 collects/analyzes threat intel (including tactical/operational IOCs and attacker methodologies) that can feed detective controls and risk processes, which may surface this low-visibility technique when matching known filters, implants or crafted packets are observed; it does not itself perform detection and many instances remain invisible.
T1205.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block the known socket-filter patterns or the elevated-privilege installation step on monitored platforms, but the control does not stop novel/undiscovered variants or the underlying raw-socket capability itself.
T1207detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed SIEM, IDS, and monitoring to surface rogue DC registration or replication anomalies, but the technique's explicit design to bypass logging/SIEM and delete metadata leaves a large detection gap that the control does not close.
T1207prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and integration into risk management/preventive controls can inform actions that stop registration of a rogue DC (e.g. via stricter admin/KRBTGT protections or schema monitoring), but this is indirect, depends on accurate/actionable intel, and leaves many execution paths (e.g. insider abuse, novel variants) unaddressed.
T1210detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (IDS, anti-malware) and testing directly surfaces T1210 exploitation attempts or related indicators post-compromise.
T1210prevents — Threat intelligence on attacker methodologies, tools, specific attacks, indicators, and known vulnerabilities (e.g. in SMB/RDP/MySQL/VMware) is explicitly used as input to preventive controls and risk processes that can block exploitation paths before they succeed.
T1211detects — Threat intelligence collection/analysis of attacker methodologies, tools, TTPs and specific IOCs (tactical/operational layers) feeds directly into detective controls and test processes, surfacing some exploitation-for-stealth attempts; it does not instrument or surface the class in real time or exhaustively.
T1211prevents — Threat intelligence on attacker methodologies, tools, vulnerabilities in logging/security tools/cloud infra, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive controls, risk management, and testing, which can block the vulnerabilities or configurations that T1211 relies on before exploitation occurs.
T1212detects — A.5.7's operational layer, collection/analysis of specific attacks and technical indicators, plus feeding into detective controls (IDS, anti-malware) and test processes, surfaces T1212 exploitation attempts or indicators in most cases, with a bounded remainder for novel/undisclosed vulnerabilities.
T1212prevents — Threat intelligence on attacker methodologies/tools (tactical), specific indicators (operational), and the changing landscape enables informed preventive actions (e.g. patching, updating filters in preventive controls, hardening auth mechanisms) that stop many but not all exploitation paths for credential access, especially unknown/zero-day vulnerabilities.
T1213detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of repository mining or related TTPs, but the control is primarily about ingesting and sharing external threat intel rather than directly detecting the technique in an environment.
T1213prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk management, which can block the reconnaissance, access, or abuse steps that enable T1213; this is only a slice of the technique (e.g., does not stop all misconfigurations or insider abuse).
T1213.001detects — A.5.7's operational layer and analysis/sharing steps surface specific attack details and IOCs that can feed detective controls (IDS, anti-malware, testing) to flag Confluence mining attempts or related TTPs, but this is scoped to a minority slice of the broad SaaS repository-access technique itself.
T1213.001prevents — Threat intelligence activities explicitly include feeding into risk management, preventive technical controls (firewalls/IDS/antimalware), and security testing processes, which can block or reduce the likelihood of successful Confluence data mining by informed configuration, monitoring, or credential handling.
T1213.002detects — A.5.7's operational and tactical layers plus sharing into IDS/firewalls/antimalware and test processes can surface indicators of SharePoint mining (e.g. anomalous access patterns or IOCs), but the control is primarily about upstream awareness and risk-process integration rather than real-time detection of the technique itself.
T1213.002prevents — A.5.7's strategic/tactical threat intel layers, when fed into risk management and preventive controls (firewalls/IDS/antimalware), can drive actions that block SharePoint data mining (e.g. by hardening access or removing exposed diagrams/credentials), but this is indirect, depends on follow-on implementation, and leaves many collection vectors untouched.
T1213.003detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, etc.) and risk processes, can surface indicators of repository access or exfiltration attempts, but this is indirect, depends on downstream implementation, and leaves large slices (e.g., initial access to private repos or credential harvesting from source) unreached by the intelligence activity itself.
T1213.003prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to stop the access or collection step of this post-compromise technique in many cases, but does not guarantee prevention once valid access to a private repo is already obtained.
T1213.004detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface the T1213.004 technique when it matches known patterns or indicators, but this is limited to cases where prior intel exists and does not broadly detect novel or unshared CRM mining.
T1213.004prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. IAM, monitoring on CRM access), and testing to stop the technique from succeeding in many cases, but does not prevent initial access to the victim org or all mining once inside.
T1213.005detects — A.5.7's operational and tactical layers plus sharing into detective controls (IDS, anti-malware) and risk processes can surface indicators of messaging-app data mining, but this is only a slice of the broad technique (which spans exfil, credential mining, and targeting improvement across varied platforms).
T1213.005prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, specific TTPs) and its use as input to preventive controls and risk processes can inform actions that block or reduce the likelihood of adversaries successfully leveraging messaging apps for data mining, but does not stop the technique from running in all cases (e.g., via already-compromised accounts or unmonitored channels).
T1213.006detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, etc.) and risk processes, surface indicators of database mining attempts; this is limited to known/observable patterns rather than all instances of the technique.
T1213.006prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls and risk processes that can block database access paths or queries before the mining technique runs.
T1216detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1216's use of signed proxy scripts as anomalous or malicious behavior, but this is limited to cases where indicators are known and integrated rather than a broad guarantee of detection.
T1216prevents — A.5.7's threat-intelligence cycle (collect/analyse/share) feeds risk management, preventive controls (firewalls/IDS/antimalware) and testing, which can block known proxy-script techniques before they run; this is only a slice of T1216 because the class is a broad class of signed LOLBIN abuse, not every instance is known or detectable in advance, and the control itself performs no blocking.
T1216.001detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS or anti-malware can surface PubPrn abuse when indicators are known and ingested, but this is limited to post-collection analysis of already-observed instances rather than broad or guaranteed detection of the technique.
T1216.002detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls like IDS/anti-malware and security testing, which can surface this signed LOLBin proxy technique when indicators are known; it does not itself instrument or monitor for the abuse.
T1217detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface browser-enumeration activity or related indicators, but the control is primarily about upstream collection/analysis/sharing of threat intel rather than direct runtime detection of the T1217 technique itself.
T1218detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1218 proxying via indicators or anomalies, but the control's core purpose is upstream awareness feeding other processes rather than direct detection of the technique in flight.
T1218prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to block known proxy binaries or update signatures/firewalls, but this does not stop novel or unprofiled abuse of trusted binaries.
T1218.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and test processes surface indicators and methodologies for .chm abuse after collection/analysis.
T1218.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, app control updates), and testing to block .chm abuse vectors before they succeed, but this is only a slice of the technique's delivery/execution surface rather than a direct barrier.
T1218.002detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed into detective controls like IDS or anti-malware, providing awareness that surfaces this technique when it matches known indicators or patterns, but does not itself perform detection.
T1218.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, allow-lists, anti-malware, testing) to block abuse of control.exe / .cpl proxying before it succeeds, but this is only one slice of a delivery/execution technique that can still be introduced via phishing or other unblocked vectors.
T1218.003detects — Threat intelligence activities explicitly include collecting/analyzing operational indicators of specific attacks (including technical IOCs) and feeding them into detective controls such as IDS and anti-malware, which surfaces CMSTP abuse when observed in the environment.
T1218.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, application control, UAC hardening) to block known CMSTP abuse patterns before execution, but does not stop novel or zero-day variants of the technique.
T1218.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of InstallUtil abuse, but this is scoped by relevance/insight/actionability and does not guarantee detection of the technique itself.
T1218.005detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and testing controls directly surface mshta.exe abuse (a known, cited technique with observable indicators) in most cases, with the bounded remainder being novel/undocumented instances before they are added to sources.
T1218.005prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools like mshta.exe, specific TTPs) is explicitly fed into preventive controls and risk processes that can block this technique before it runs, but the control itself only informs and does not directly enforce prevention.
T1218.007detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, indicators) and feeds it into detective controls like IDS or anti-malware, which can surface msiexec abuse when known indicators are present; it does not itself perform detection and many instances lack prior indicators.
T1218.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, app control, AMSI, etc.) to block known msiexec.exe abuse patterns, but does not stop novel or unmodeled abuse of a signed native binary.
T1218.008detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls like IDS or anti-malware, which can surface odbcconf.exe abuse as anomalous or known-bad behavior; it is not a dedicated detection mechanism and reaches only the slice of this technique that produces observable indicators matching ingested intelligence.
T1218.008prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block this signed-binary abuse technique before it runs, but the control only supplies awareness and does not itself enforce any block.
T1218.009detects — A.5.7's operational layer, collection/analysis of technical indicators, and feeding into detective controls (IDS, anti-malware) and test processes directly surfaces this signed-binary proxy technique when indicators or anomalous Regsvcs/Regasm usage appear.
T1218.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls (e.g. application control, AMSI, or endpoint rules), and testing to block known Regsvcs/Regasm abuse patterns, but does not stop novel or zero-day variants of the technique.
T1218.010detects — A.5.7's operational and tactical layers plus explicit use as input to IDS/anti-malware and test processes surface indicators and behaviors of Regsvr32 abuse (Squiblydoo, COM scriptlet loading, anomalous network use of a signed binary) after they occur.
T1218.010prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware, app control) and risk processes that can block Regsvr32 abuse paths such as Squiblydoo or COM hijacking before execution.
T1218.011detects — A.5.7 collects/analyzes tactical+operational threat intel (including specific TTPs, indicators and attacker methodologies) and feeds it into detective controls and security testing, which can surface rundll32 abuse when it matches known patterns; it does not itself perform detection and many variants remain unseen.
T1218.011prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block rundll32.exe abuse before it succeeds.
T1218.012detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface verclsid.exe abuse when known indicators are present, but this is scoped by relevance/insight/actionability and does not guarantee detection of novel or unshared instances.
T1218.012prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block known verclsid.exe abuse patterns, but does not stop novel or unshared variants of the technique.
T1218.013detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls like IDS or anti-malware, which can surface mavinject.exe abuse as anomalous; this is limited to known indicators rather than all instances or novel variants.
T1218.013prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block known mavinject.exe abuse patterns before execution, but does not stop novel or undetected uses of a signed LOLBin.
T1218.014detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls (IDS, anti-malware) and test processes, which surfaces MMC abuse when indicators or anomalous patterns match known T1218.014 tradecraft; the remainder is novel/undocumented instances before intel exists.
T1218.014prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to block known MMC abuse patterns before they execute, but this is only a slice of the broad technique class (which includes novel/undiscovered variants).
T1218.015detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of Electron abuse (e.g. anomalous child processes or planted JS), but this is scoped to relevant, actionable intel rather than broad or guaranteed detection of the technique.
T1218.015prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, app allowlisting), and testing to block known Electron abuse patterns before execution, but this is inherently reactive to observed threats and leaves novel/undiscovered variants unaddressed.
T1219detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware, etc.) surface indicators and patterns of legitimate RAT abuse for C2, though it does not guarantee detection of every in-band or EDR-feature-abusing instance.
T1219prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware), which can block or flag legitimate-but-abused remote access tools before they establish C2, but this is only one slice of the technique's surface (e.g., does not stop post-compromise installation via other vectors or built-in modules like Chrome Remote Desktop).
T1219responds — A.5.7 produces and shares threat intelligence on attacker methodologies/tools (tactical layer) and specific attacks (operational layer) that is fed into incident response processes, EDR/remote-access features in defensive tools, and technical detective controls, enabling containment/eradication once a RAT technique is underway; this is only a slice of full incident response because the control stops at intelligence production and does not itself perform the response actions.
T1219.001detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational IOCs and attacker tooling) that can feed detection rules in IDS, anti-malware, and testing processes, but does not itself perform detection and leaves many IDE-tunneling artifacts (e.g. proprietary protocols, dev-workflow blending, auto-reconnect) outside routine intel coverage.
T1219.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to block common IDE tunneling setups, but cannot stop novel or custom IDE abuse that blends with legitimate developer workflows.
T1219.002detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the specific tools, indicators and anomalous remote-desktop behaviours of T1219.002; the remainder is non-actionable or pre-compromise strategic intelligence that does not detect the technique in flight.
T1219.002prevents — Threat intelligence on attacker methodologies, tools (e.g. specific RMM like TeamViewer/AnyDesk), and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block or disallow many legitimate-but-abusable desktop support tools, but cannot prevent all (e.g. built-in OS remote features, allowed-by-policy RMM, or novel variants).
T1219.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of hardware-based C2 post-installation, but the control is silent on hardware telemetry and the technique's physical-install/post-compromise nature leaves most instances outside its view.
T1220detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed detection rules in IDS, anti-malware, and testing processes, surfacing XSL script abuse when it matches known indicators or patterns; it does not itself instrument or observe the event.
T1220prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block XSL script abuse vectors such as msxsl.exe or WMI /FORMAT usage before execution.
T1221detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1221 indicators (e.g. anomalous template URLs or post-fetch behavior), but this is scoped to what the org elects to ingest/monitor and does not guarantee detection of the technique's static or RTF variants.
T1221prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs/indicators (operational layer), and sharing with others can inform preventive controls (e.g. updated IDS rules, anti-malware signatures, test processes) to block template injection before it succeeds, but does not itself stop the technique from being available or used.
T1222detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1222 activity via indicators or anomalies, but this is indirect, not the control's core function, and limited by relevance/scope of sources.
T1222.001detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware and security testing, which can surface T1222.001 usage; this is limited to known indicators rather than all instances.
T1222.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. ACL hardening, monitoring of icacls/takeown), and testing to stop the technique from being usable, but this is indirect, depends on what the org actually implements from the intel, and leaves many execution paths untouched.
T1222.002detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed detective controls and risk processes, which may surface some T1222.002 instances post-facto; it does not itself perform detection.
T1480detects — Threat intelligence collection/analysis of attacker methodologies, tools, TTPs and indicators (including environment-specific conditions or user-agent patterns used in guardrails) can surface the technique when observed in the wild or in testing, but does not systematically detect its use in every deployment or custom implementation.
T1480.001detects — A.5.7's operational layer and use as input to IDS, anti-malware, and testing processes can surface environmental keying indicators (e.g. anomalous decryption, specific environmental checks, or related TTPs) in monitored environments, but this is limited to cases where indicators are known/shared and does not broadly detect the core cryptographic guardrail technique itself.
T1480.002detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface mutex-based execution checks when those indicators are known and relevant.
T1482detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface domain-trust enumeration activity when it matches known indicators or anomalous patterns, but the control is silent on specific detection mechanisms and most T1482 instances (quiet LDAP/Nltest calls) remain outside routine threat-intel feeds.
T1482prevents — Threat intelligence on attacker methodologies, tools (e.g. nltest), and specific TTPs can be used to inform preventive controls that block or constrain domain trust enumeration, but the control itself only supplies awareness and does not directly prevent the technique.
T1484detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of domain/tenant policy changes, but this is limited to known IOCs or anomalies within scoped monitoring rather than reliably catching stealthy or reverted modifications across all cases.
T1484prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware, testing) to block the reconnaissance, permission abuse, or GPO/trust modification steps of T1484 before they succeed.
T1484.001detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls (e.g. IDS) and risk/test processes can surface GPO modification TTPs or IOCs after the fact, but this is only a slice of the technique's possible executions and the control's primary purpose is awareness rather than direct detection.
T1484.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to stop GPO modification before it occurs, but this is only one slice of a broad class that also includes misconfigurations and delegated permissions that intelligence alone does not block.
T1484.002detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational layers on attacker methodologies and specific TTPs) and feeds it into detective controls and risk processes, which can surface trust modifications when they match known patterns or indicators, but this is indirect, depends on prior intel about the technique, and does not guarantee detection of novel or stealthy instances.
T1484.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and integration into risk management/preventive controls can inform actions that block trust manipulation paths before they are exercised, but the control only supplies awareness and does not itself enforce any preventive barrier.
T1485detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, specific attacks and indicators, then feeds it into detective controls (IDS, anti-malware) and testing, which can surface T1485 activity or its precursors; this is a genuine but indirect and scoped slice rather than broad detection of the technique itself.
T1485prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can stop T1485 execution before it runs, but this is only one slice of the full technique (e.g. does not reach all propagation vectors, insider actions, or zero-days).
T1485responds — A.5.7 produces and shares threat intelligence on attacker methodologies/tools (tactical) and specific attacks (operational) that is fed into risk management, preventive/detective controls, and testing; this can inform an active response once a data-destruction campaign is detected in flight, but the control itself performs no containment or eradication.
T1485.001detects — A.5.7's operational and tactical layers plus its mandated use as input to detective controls (IDS, anti-malware) and risk processes can surface the anomalous lifecycle-policy change or the resulting mass-deletion behavior, but the control is silent on instrumentation depth or coverage of cloud-provider audit logs, leaving a large unscoped remainder.
T1486detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, indicators) and feeds it into detective controls (IDS, anti-malware) and risk processes, which surfaces T1486 ransomware behavior in flight or in indicators; mostly because strategic/tactical layers and non-indicator ransomware variants sit outside the direct detection surface.
T1486prevents — A.5.7's threat-intelligence cycle (collect/analyze/share) feeds risk management, preventive controls (firewalls/IDS/antimalware), and testing to enable informed actions that stop many T1486 ransomware campaigns before encryption occurs; it does not guarantee prevention of every instance (e.g., novel/zero-day or insider-driven encryption).
T1486recovers — A.5.7 threat intelligence is explicitly used as input to risk management, preventive/detective controls, and testing processes that enable backup/recovery capabilities and reduce realized impact of encryption events (e.g., by informing resilient backup strategies against ransomware).
T1486responds — A.5.7 produces and shares threat intelligence on ransomware/encryption attacks (tactical/operational layers) that is fed into risk processes, preventive/detective controls, and testing; this directly supports containment/eradication once ransomware is underway, matching the `responds` verb, with a named remainder that realized encryption (data already lost) is not undone by intelligence-driven response.
T1489detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface indicators of service-stop activity, but this is limited to known patterns shared via intelligence sources and does not broadly detect novel or internal service manipulation.
T1489prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk management, which can block the service-stop technique in many cases, but this is only a slice since the control is awareness-oriented and does not itself enforce any preventive mechanism.
T1490detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface T1490 indicators or related activity in flight or post-execution, but the control is primarily oriented toward strategic awareness and prevention rather than mandating detection of this specific technique.
T1490prevents — Threat intelligence on attacker TTPs, tools, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to stop T1490 techniques from being used, but this is indirect, depends on downstream implementation, and leaves many execution paths (e.g. novel or insider actions) unaddressed.
T1491detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1491 indicators or post-defacement anomalies, but the control is scoped to threat-intel collection/analysis rather than mandating broad detection coverage of the technique itself.
T1491prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block the delivery or execution paths for defacement, but this does not stop all instances (e.g. post-compromise internal web content changes or social-engineering vectors).
T1491.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of an internal defacement that has already occurred, but the control is primarily about upstream threat awareness rather than real-time detection of the post-intrusion technique itself.
T1491.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can stop the technique from executing; this is a genuine but minority slice of the full technique surface because many post-compromise internal-defacement vectors (authenticated local modification of web content, desktop wallpaper, login banners) sit downstream of the initial breach that intelligence helps block.
T1491.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of an impending or realized external defacement, but the control is primarily about upstream awareness and risk-process integration rather than direct detection of the technique itself.
T1491.002prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block the external defacement technique before it runs; this is a genuine but minority slice because the control's dominant focus is awareness/insight sharing rather than direct prevention mechanisms, and many defacement vectors (e.g. unpatched web apps, weak auth on external sites) sit outside what intel-driven prevention reliably closes.
T1495detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of firmware-targeting threats or activity, but this is limited to known patterns and does not broadly detect the low-level firmware overwrite itself.
T1495prevents — Threat intelligence on attacker methodologies, tools, specific indicators, and the changing landscape (including firmware-targeting malware like CIH) can be fed into risk management, preventive controls (e.g. anti-malware), and testing to stop the T1495 technique from executing in many cases, but this is inherently indirect, incomplete, and does not guarantee prevention of all instances or vectors.
T1496detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface resource hijacking indicators (e.g. anomalous compute, network bandwidth, SMS/spam volume) after the technique begins.
T1496prevents — Threat intelligence activities (strategic/tactical/operational layers, analysis, and integration into risk management, preventive controls like firewalls/IDS/antimalware, and testing) enable informed actions that can block many hijacking vectors before they run, but this is not universal prevention as some forms (e.g., insider abuse of authorized cloud resources) remain outside its direct reach.
T1496responds — A.5.7 produces and shares threat intelligence that feeds into incident response processes and technical detective controls, enabling containment/eradication once resource hijacking (e.g. cryptomining) is underway, but only for known/observable TTPs and without mandating the response act itself.
T1496.001detects — A.5.7's operational and tactical layers plus explicit use as input to detective controls (IDS, anti-malware) and risk processes surface indicators and anomalous resource consumption of compute hijacking after it begins.
T1496.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can block common infection vectors for cryptomining malware, but does not stop all hijacking paths such as exposed APIs, misconfigurations, or post-compromise resource abuse.
T1496.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface bandwidth anomalies or known hijacking IOCs from internal/external sources, but the control's mechanism is human-driven collection/analysis/sharing rather than direct instrumentation, leaving most in-host or IaaS bandwidth abuse undetected without other tools.
T1496.002prevents — Threat intelligence (strategic/tactical/operational) that is relevant, insightful, contextual and actionable directly feeds risk management, preventive controls (firewalls/IDS/antimalware) and testing to stop bandwidth-hijacking techniques from being employed or succeeding, but only for the subset of instances where indicators or TTPs are known in advance; unknown or zero-day hijacking cannot be prevented this way.
T1496.003detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and use as input to detective controls (e.g. intrusion detection) can surface SMS-pumping anomalies after they begin, but the control is silent on instrumentation depth or real-time telemetry and the technique's SaaS/web-form vector sits outside many orgs' monitored boundaries.
T1496.003prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, indicators) plus its explicit use as input to preventive technical controls (firewalls, IDS, anti-malware, test processes) can block the web-form abuse patterns that enable SMS pumping before the technique runs, but this is only a slice because the control is governance-oriented awareness rather than a universal mechanism and many SMS-pumping vectors sit outside monitored/preventable entry points.
T1496.004detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of SaaS hijacking (e.g. anomalous service enablement, quota spikes, or unusual email/SMS volumes), but the control is scoped to relevant/insightful intelligence sharing rather than mandating comprehensive real-time detection coverage of all hijacking vectors.
T1496.004prevents — A.5.7's threat-intelligence cycle (collect/analyze/share) feeds risk management, preventive controls (firewalls/IDS/antimalware), and testing to enable informed actions that stop the technique from running; this reaches the SaaS-abuse slice when intel on attacker methodologies, indicators, or emerging LLMJacking/spam patterns is actionable, but leaves the bulk of initial compromise vectors, service-enablement, and credential abuse untouched.
T1497detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical layer) and specific attacks (operational layer) including indicators, feeding it into risk management, preventive/detective controls, and testing processes; this surfaces knowledge of T1497-style evasion techniques but does not itself perform detection of in-flight instances.
T1497prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes, preventive controls and testing to block many common VME/sandbox detection artifacts and behaviors before they succeed.
T1497.001detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical layer) and specific attacks (operational layer) including TTPs like sandbox evasion checks, then feeds it into detective controls and test processes, surfacing the technique when observed in the threat environment or during testing; it does not instrument runtime detection of the checks themselves.
T1497.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls and risk processes to block common VME/sandbox checks or the behaviors that follow them, but does not stop an adversary from performing the discovery technique itself.
T1497.002detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical) and specific attacks (operational) including TTPs and indicators, which can feed into detection controls and risk processes to surface this sandbox-evasion technique when observed in the wild; it does not itself instrument or surface instances.
T1497.003detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical layer) and specific attacks (operational layer) to feed detective controls and risk processes, which can surface time-based sandbox evasion when observed in the wild, but does not itself perform detection.
T1498detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes surfaces Network DoS techniques in flight or in advance; mostly because strategic/tactical layers and non-indicator-based volumetric attacks sit outside full coverage.
T1498prevents — Threat intelligence on attacker methodologies, tools (botnets), spoofing, and DDoS patterns is collected/analysed and fed into risk management plus preventive controls (firewalls, IDS, anti-malware) to enable informed actions that stop many Network DoS techniques from succeeding; it does not eliminate the possibility of all bandwidth-exhaustion attacks.
T1498responds — A.5.7 produces and shares threat intelligence on attacker methodologies, tools, specific attacks and indicators (tactical/operational layers) that can feed into incident response processes once a Network DoS is underway, but the control itself performs no containment or eradication.
T1498.001detects — A.5.7's operational and tactical layers plus explicit use as input to IDS, firewalls and anti-malware directly surface indicators of direct network flooding (botnet patterns, anomalous high-volume traffic, specific protocols) in a way that matches the technique's observable artifacts, with only a bounded remainder for novel/zero-day floods lacking prior indicators.
T1498.001prevents — A.5.7's threat-intelligence loop (collect/analyze/share into risk processes, preventive controls, and testing) can inform blocking rules, rate limits, or upstream filtering that stops many direct-network-flood techniques from succeeding, but cannot prevent the class because the adversary still chooses the vector, timing, and scale.
T1498.001responds — A.5.7 produces and shares actionable threat intelligence on attacker methodologies, tools, botnets and specific flood indicators that is fed into incident response, technical detective controls and risk processes once an attack is underway, enabling containment/eradication with a named remainder for already-saturated bandwidth before response begins.
T1498.002detects — A.5.7's operational and tactical layers plus explicit use as input to intrusion detection, firewalls and anti-malware directly surface indicators of reflection/amplification traffic (spoofed sources, anomalous UDP/TCP amplification patterns from known reflectors like DNS/NTP/memcache) in most cases, with a bounded remainder for novel or encrypted variants outside monitored scope.
T1498.002prevents — Threat intelligence on attacker methodologies, tools, protocols (DNS/NTP/memcache), and indicators directly feeds risk management, preventive controls (firewalls/IDS), and testing to block reflection/amplification vectors before they can be used.
T1498.002responds — Threat intelligence is explicitly used as input to detective controls (IDS, anti-malware) and incident processes that contain/eradicate an ongoing amplified reflection flood once underway, but the control's core purpose and activities are upstream awareness and prevention rather than direct response actions.
T1499detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes surface Endpoint DoS indicators, botnets, and anomalies; partial remainder exists for novel/zero-day endpoint resource exhaustion not captured in shared intelligence.
T1499prevents — Threat intelligence on attacker methodologies, tools, botnets, spoofing, and specific DoS TTPs (tactical/operational layers) is explicitly used to inform preventive controls and risk processes that can stop the technique from executing.
T1499.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the anomalous traffic patterns, resource spikes, or TCP state-table anomalies that are the observable signatures of an OS exhaustion flood.
T1499.001prevents — Threat intelligence on attacker methodologies, tools (e.g. SYN/ACK floods), and indicators can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block the technique before it runs, but this is only one slice of a broader control whose primary purpose is awareness rather than direct prevention.
T1499.001responds — A.5.7 produces and shares threat intelligence (including operational indicators of specific attacks like SYN/ACK floods) that is explicitly used as input to detective controls and incident processes, enabling response once the OS-exhaustion technique is underway; this is a genuine but minority slice of the control's overall purpose and activities.
T1499.002detects — A.5.7's operational and tactical layers plus explicit use as input to intrusion detection, anti-malware and other detective controls directly surface indicators and patterns of service-exhaustion floods (HTTP floods, SSL renegotiation volume, anomalous resource consumption) once they occur.
T1499.002prevents — Threat intelligence on attacker methodologies, tools, specific indicators and the threat landscape enables informed preventive actions (e.g. tuning preventive controls, updating test processes, or adjusting configurations) that can stop many instances of service exhaustion floods from succeeding, but does not itself block the technique.
T1499.002responds — Threat intelligence is explicitly used as input to detective controls (IDS) and incident processes that respond to an in-flight service exhaustion flood once underway, but the control's core purpose is pre-harm awareness and prevention rather than active containment/eradication.
T1499.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of resource-exhaustion floods, but the control is silent on detection depth or coverage for this specific application-layer technique.
T1499.003prevents — Threat intelligence on attacker methodologies, tools, specific attacks and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block the resource-exhaustion requests before they succeed, but this is only a slice of the class because many application-level exhaustion vectors arise from design/implementation flaws that intelligence alone does not stop.
T1499.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of known exploitation attempts, but it does not guarantee detection of zero-days or all crash-based DoS techniques.
T1499.004prevents — Threat intelligence on attacker methodologies, tools, known exploits, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls and risk management, which can block exploitation of many (but not all, esp. zero-days) vulnerabilities in this technique.
T1505detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of malicious server components post-installation, but this is scoped to selected relevant sources and does not broadly instrument for the technique itself.
T1505prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block installation of malicious server components before persistence is achieved.
T1505.001detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, specific attacks and indicators, then feeds it into detective controls (IDS, anti-malware) and security testing, which can surface this persistence technique when it matches known patterns or indicators.
T1505.001prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of malicious stored-procedure creation or activation, but does not stop the technique outright.
T1505.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of a malicious transport agent (e.g. anomalous registration or email-triggered behavior), but this is limited to known/observable TTPs within chosen sources and does not broadly detect the technique itself.
T1505.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls and risk processes to block registration or malicious configuration of transport agents, but the control only supplies awareness and does not itself enforce any blocking action.
T1505.003detects — A.5.7's operational layer, collection/analysis of indicators, and use as input to detective controls (IDS, anti-malware) and testing directly surface web shell presence or activity on the organization's estate.
T1505.003prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, indicators) and its explicit use as input to preventive controls (firewalls, IDS, anti-malware) and testing can block many web-shell deployment paths before they succeed, but leaves a genuine remainder of novel/undetected webshells and insider/misconfiguration vectors that the control does not address.
T1505.004detects — Threat intelligence collection/analysis (esp. operational layer with technical indicators) and its use as input to detective controls like IDS can surface the presence of malicious IIS components after installation, but the control is silent on automated detection mechanisms or coverage of this specific persistence technique.
T1505.004prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into preventive controls and risk processes to block installation of malicious IIS components before they establish persistence.
T1505.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific DLL modification or anomalous RDP behavior, but the control's primary focus is strategic/tactical awareness feeding risk processes rather than direct, broad detection of this low-level persistence technique.
T1505.006detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, security testing), can surface indicators of malicious VIB installation or anomalous ESXi boot persistence, but this is scoped only to known or shared TIs and does not broadly instrument or guarantee detection of novel VIB abuse.
T1505.006prevents — A.5.7's collection/analysis of relevant/insightful/actionable threat intelligence (including tactical/operational details on attacker tools like malicious VIBs) is explicitly used as input to preventive technical controls and risk management to stop the technique from being introduced or succeeding, but this is an indirect awareness process that does not itself block the abuse.
T1518detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when it produces observable indicators, but the control is primarily about upstream collection/analysis/sharing rather than mandating detection of the discovery act itself.
T1518prevents — Threat intelligence on attacker methodologies, tools, prevalent software-vulnerability patterns and TTPs (tactical/operational layers) can be fed into risk processes, preventive controls and testing to reduce the likelihood the discovery technique is attempted or succeeds, but does not stop the enumeration itself once the adversary is already executing on a compromised host.
T1518.001detects — A.5.7 collects/analyzes threat intel on attacker methodologies/tools (tactical layer) and feeds it into detective controls like IDS/anti-malware, which can surface the discovery technique when it matches known indicators, but this is indirect, depends on downstream implementation, and does not inherently detect the technique itself.
T1518.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block the discovery technique before it succeeds, but this is only a slice of the class as many discovery commands are native and not universally blockable.
T1518.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific discovery commands or indicators of backup-software enumeration once they occur, but the control is scoped to relevant/insightful threat intel rather than mandating broad, real-time detection of every T1518.002 instance across all environments.
T1525detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of implanted images in registries or running instances, but this is limited to known IOCs and does not broadly detect the initial implanting act itself.
T1525prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. image scanning, registry access restrictions, IaC validation), and testing to stop the implant technique from succeeding in many cases, but does not guarantee prevention of all instances or address the initial access prerequisite.
T1526detects — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker methodologies, tools, TTPs and indicators) plus feeding it into detective controls and test processes surfaces knowledge of cloud-service-discovery behaviors after they occur, but the control itself performs no detection and its scope is bounded to threat-intel-derived insights rather than general anomaly or technique detection.
T1526prevents — Threat intelligence (strategic/tactical layers) informs risk processes, preventive controls (e.g. firewalls, IDS, anti-malware), and testing to block discovery/enumeration paths and follow-on evasion, but does not stop the post-access technique itself in all cases or environments.
T1528detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of token-theft TTPs or related activity, but the control is primarily about producing and sharing intelligence rather than performing detection itself, leaving most of the technique unobserved.
T1528prevents — Threat intelligence on attacker methodologies, tools, specific IOCs, and social-engineering patterns (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop many T1528 vectors before they succeed; it does not stop all paths such as novel compromises of containers, CI/CD pipelines, or managed-identity token requests.
T1529detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of impending or in-progress shutdown/reboot attempts (e.g. privilege use, specific commands), but this is scoped only to relevant, insightful, actionable intel rather than broad or guaranteed detection of the technique.
T1529prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware) and testing to block many shutdown/reboot vectors (privilege escalation, specific commands, known post-wipe patterns); it does not stop all legitimate OS APIs, hypervisor actions or novel/zero-day uses on every platform.
T1530detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cloud storage access attempts or related misconfigs, but this is scoped only to selected relevant threats and does not broadly detect the technique itself.
T1530prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware, IAM tuning, config checks) and risk processes that can stop the T1530 technique from succeeding, but this is only one slice of the many misconfiguration and credential-leak vectors described.
T1531detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including account manipulation) and feeding them into detective controls like IDS/anti-malware as well as security testing, which surfaces the technique when observed; this is limited to known patterns shared with other orgs rather than all instances.
T1531prevents — Threat intelligence on attacker methodologies, tools, TTPs and specific IOCs (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block the account manipulation techniques before they succeed.
T1531responds — A.5.7 produces and shares threat intelligence on attacker methodologies (tactical layer) and specific attacks (operational layer) that is fed into risk management, preventive/detective controls, and testing; this can inform an incident response function once T1531 is underway (e.g., recognizing ransomware patterns that combine account removal with encryption), but the control itself performs no containment or eradication actions.
T1534detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators, attacker TTPs) and its use as input to detective controls (IDS, anti-malware) and testing directly surfaces internal spearphishing campaigns and their indicators once present in the environment.
T1534prevents — Threat intelligence activities include collecting/analyzing attacker methodologies, tools, and specific indicators (tactical/operational layers) then feeding them into preventive controls (firewalls, IDS, anti-malware, risk processes, and testing), which can block many internal spearphishing vectors such as malicious attachments, links, or chat payloads before they succeed.
T1535detects — A.5.7's operational layer, collection/analysis of technical indicators, and feeding into detective controls (IDS, anti-malware) and testing can surface the creation or presence of instances in unused regions as anomalous activity, but this is only one slice of the technique (not all indicators are covered, and it depends on existing monitoring scope).
T1535prevents — Threat intelligence on attacker methodologies, tools, regions used for evasion, and detection gaps (tactical/operational layers) is explicitly used as input to preventive controls and risk processes, which can block creation of instances in unused regions or enforce monitoring everywhere; it is not a direct mechanism that stops the technique in all cases.
T1537detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1537 indicators or anomalous internal cloud transfers, but the control is primarily about producing and sharing intelligence rather than performing detection itself, leaving most of the actual detection to other mechanisms.
T1537prevents — A.5.7's threat-intelligence cycle (collect/analyze/share) feeds risk management, preventive controls (firewalls/IDS/antimalware), and testing, enabling informed actions that can block many T1537 vectors such as anomalous internal transfers or suspicious SAS/backup ops; it does not guarantee prevention of every instance because the control stops at producing and disseminating intelligence rather than mandating specific blocking mechanisms.
T1538detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls like IDS can surface the technique when indicators match known TTPs, but this is scoped only to known threats and does not broadly instrument or detect novel dashboard use with stolen credentials.
T1538prevents — Threat intelligence (strategic/tactical/operational) that is relevant, insightful, contextual and actionable directly feeds risk management, preventive controls (e.g. firewall/IDS rules) and testing to stop the credential theft or dashboard access that enables T1538.
T1539detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface indicators, malware, phishing proxies, and anomalous cookie use for this technique.
T1539prevents — Threat intelligence on attacker methodologies, tools (e.g. Evilginx2, malware stealing cookies), phishing campaigns, and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop many T1539 vectors before execution, but cannot block all local theft, JS injection, or post-auth cookie use.
T1542detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface some Pre-OS Boot indicators from external sources or anomalies, but the control's scope is awareness-sharing rather than direct detection and the technique's firmware layer is explicitly difficult for host-based mechanisms to observe.
T1542prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of successful Pre-OS Boot firmware/bootkit attacks, but does not stop the technique from being attempted or succeeding in all cases.
T1542.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface specific firmware-modification TTPs or IOCs, but the control's core purpose is awareness feeding risk processes rather than direct detection of in-progress technique execution.
T1542.001prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of successful firmware modification, but does not stop the technique outright.
T1542.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface specific T1542.002 indicators or anomalies, but the control's primary focus is strategic/tactical awareness feeding risk processes rather than direct detection of firmware modification.
T1542.002prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block the delivery or exploitation paths that lead to component firmware modification, but it does not stop sophisticated supply-chain, physical, or pre-compromise attacks on firmware itself.
T1542.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface bootkit indicators (e.g. anomalous MBR/VBR/ESP changes), but this is limited to known/suspect cases with a large remainder of stealthy pre-OS modifications that evade standard detection sources and processes.
T1542.003prevents — Threat intelligence on attacker methodologies, tools, boot-sector techniques and indicators enables informed preventive actions (e.g. hardening boot process, updating firmware, configuring secure boot, feeding signatures into preventive controls) that stop many bootkit attempts before they succeed, but cannot block every raw-access or supply-chain vector and leaves a named remainder of unknown or zero-day bootkits.
T1542.004detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks and technical indicators) and feeds it into detective controls and testing, which can surface ROMMONkit-like firmware anomalies post-deployment; it does not itself instrument or guarantee detection of the low-level boot firmware overwrite.
T1542.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls/risk processes can inform actions that block ROMMON abuse before it occurs, but does not guarantee prevention of all such firmware attacks on network devices.
T1542.005detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface TFTP-boot anomalies or known malicious indicators after the technique runs, but this is scoped only to the subset of indicators the org has collected/analyzed and integrated, leaving most instances undetected.
T1542.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block TFTP server manipulation or unauthorized netboot images before they succeed, but this is only one slice of the boot-sequence technique and does not stop all instances or variants.
T1543detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed detection rules in IDS, anti-malware, etc., but does not itself perform detection and leaves many T1543 instances (e.g., novel or non-public modifications) unreached.
T1543prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. firewalls, anti-malware), and testing to block many common service-creation/modification vectors before they succeed, but does not stop novel or custom techniques and is not a direct barrier.
T1543.001detects — A.5.7 collects/analyzes/shares threat intel (including tactical/operational IOCs and attacker TTPs) that can feed into detective controls and risk processes, surfacing this persistence technique when matching indicators or patterns appear; it does not itself perform detection.
T1543.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block common Launch Agent persistence paths before they succeed, but this is only a slice of the technique's surface (e.g., does not stop novel or custom .plist abuse).
T1543.002detects — A.5.7 collects/analyzes threat intel on attacker methodologies/tools (tactical) and specific attacks/indicators (operational) to feed detective controls and risk processes, which can surface this persistence technique when known indicators are present, but does not itself perform detection and leaves many novel or internal variants unreached.
T1543.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, firewalls, IDS), and testing to block creation/modification of malicious systemd services before they achieve persistence.
T1543.003detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and test processes surface the service creation/modification, registry changes, driver loading and masquerading artifacts of T1543.003; the remainder is purely internal pre-compromise activity that never reaches monitored sources.
T1543.003prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk management, which can block common service creation/modification patterns before they succeed; it does not stop novel or custom variants.
T1543.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of Launch Daemon creation/modification or anomalous startup behavior, but this is scoped to known threats and does not broadly detect novel or disguised instances.
T1543.004prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can inform preventive actions such as hardening LaunchDaemon configurations, monitoring plist directories, or tightening privileges, but does not itself stop the technique from being executed.
T1543.005detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including on container services) and feeding them into detective controls like IDS or anti-malware, which surfaces the technique when observed.
T1543.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. firewalls, IDS, anti-malware), and testing to block creation/modification of container services for persistence/escalation, but does not guarantee prevention of all such techniques especially in custom or novel container environments.
T1546detects — A.5.7 collects/analyzes threat intel (including operational IOCs and attacker TTPs) that can feed detective controls and risk processes to surface T1546-like activity, but the control itself only produces awareness inputs and does not perform detection.
T1546prevents — Threat intelligence activities (collect/analyze/share strategic/tactical/operational info on attacker methodologies, tools, TTPs and indicators) feed risk management, preventive controls (e.g. firewalls, anti-malware) and testing to reduce the likelihood of adversaries creating/modifying event triggers for persistence/escalation, but do not stop the technique itself from being available or used.
T1546.001detects — A.5.7's operational layer and use as input to intrusion detection, anti-malware, and testing processes can surface indicators of registry changes or anomalous file-association behavior after the fact, but the control is scoped to relevant threat intel rather than mandating broad detection of this specific persistence technique.
T1546.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to block this persistence technique before it is deployed, but the control only supplies awareness and does not itself enforce any blocking action.
T1546.002detects — A.5.7 collects/analyzes threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, which may surface this persistence technique when it matches known indicators or patterns, but the control itself performs no detection and many instances (custom/unreported malware, no matching intel) remain unseen.
T1546.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware), and testing to block this registry-based persistence technique before it is deployed.
T1546.003detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and test processes surface the specific WMI event subscription technique when it is present or executing.
T1546.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. firewalls, anti-malware), and testing to block WMI event subscription setup or execution in many cases, but does not stop all instances of the technique.
T1546.004detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, specific attacks and indicators, then feeds it into detective controls and testing processes, which can surface this persistence technique when it matches known patterns or IOCs; it does not itself instrument or observe the modification of shell config files.
T1546.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to stop this persistence technique from being introduced or succeeding, but the control only supplies awareness and does not itself enforce any prevention.
T1546.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface trap-based persistence when indicators or anomalous trap registrations appear in collected/analyzed sources, but this is scoped only to what the org ingests and shares rather than broad, always-on detection of the technique.
T1546.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface this macOS-specific binary-modification technique when relevant indicators or anomalies are collected/analyzed, but the control is scoped only to what the organization selects as relevant/insightful and does not mandate broad detection of this low-level persistence method.
T1546.007detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detection rules in IDS, anti-malware, and monitoring tools, but the control itself performs no detection and stops at producing actionable intel for others to consume.
T1546.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes and preventive controls (firewalls/IDS/antimalware) to block Netsh Helper DLL registration or execution paths, but this is not a direct or universal barrier to the technique itself.
T1546.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of the binary/registry tampering or anomalous pre-login execution, but the control is not scoped to guarantee detection of this specific technique.
T1546.008prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. app whitelisting, binary integrity enforcement), and testing to stop the binary replacement or registry pointer abuse before it occurs.
T1546.009detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of AppCert DLL abuse after it occurs, but this is only a slice of the broad threat-intelligence process whose primary purpose is awareness rather than direct detection of the technique.
T1546.009prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and technical preventive controls (firewalls, IDS, anti-malware) to block the AppCertDLLs Registry abuse before it succeeds, but this is only a slice of possible preventions and does not guarantee the technique is stopped in all cases.
T1546.010detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of AppInit DLL abuse after it occurs, but this is limited to known IOCs within scoped monitoring rather than reliably detecting the technique itself.
T1546.010prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, firewalls), and testing to block AppInit DLL abuse before it occurs, but this is indirect, depends on accurate actionable intel, and leaves gaps for novel/undetected variants or misconfigurations.
T1546.011detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of shim abuse (e.g. anomalous .sdb files, registry changes, or hooking), but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of the technique itself.
T1546.011prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to block known shim abuse vectors before they succeed, but this does not stop novel/unknown shim techniques or the underlying Windows compatibility feature itself.
T1546.012detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface IFEO Registry anomalies, debugger attachments, and silent-exit monitors as indicators when they match known threat patterns.
T1546.012prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of IFEO abuse for persistence/privilege-escalation, but does not stop the underlying registry-based technique from being available or executed.
T1546.013detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of profile modification or anomalous PowerShell execution, but this is scoped by relevance and does not broadly instrument or guarantee detection of the technique across all profiles or privilege-escalation paths.
T1546.013prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of profile modification succeeding, but does not stop the technique outright.
T1546.014detects — A.5.7 collects/analyzes threat intel on attacker methodologies/tools (tactical) and specific attacks/indicators (operational) and feeds it into detective controls like IDS or anti-malware, which can surface emond rule abuse as anomalous behavior or known TTPs, but only for the subset of intel that matches the org's configured sources and monitoring scope.
T1546.014prevents — A.5.7's threat-intelligence collection/analysis feeds risk management, technical preventive controls (firewalls/IDS/antimalware), and security testing, which can block emond rule abuse before it runs; this is a genuine but minority slice of the class because the control itself only produces awareness and does not mandate any specific preventive action.
T1546.015detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls (IDS, anti-malware) and testing processes, which surfaces COM hijacking Registry changes or anomalous COM behavior when those indicators are known.
T1546.015prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and feeding it into preventive controls and risk processes can inform actions that block common COM hijacking paths (e.g. via updated detection rules, registry monitoring, or hardening), but does not stop the Registry-modification technique itself from being available or used.
T1546.016detects — A.5.7 collects/analyzes/shares threat intel (including operational IOCs and attacker TTPs) that can feed technical detective controls and risk processes, which may surface this technique post-execution; it does not itself perform detection.
T1546.016prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block known installer-script abuse patterns before they execute, but this does not stop novel or zero-day variants of the technique.
T1546.017detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface udev rule anomalies or the triggered malicious execution, but the control is primarily about awareness production rather than direct, broad detection of this Linux-specific persistence technique.
T1546.017prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls, and testing to reduce the likelihood of udev rule abuse for persistence, but does not stop a privileged actor from adding/modifying rules.
T1546.018detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific indicators or anomalous Python startup behavior, but the control is primarily about awareness production rather than mandating detection mechanisms and leaves many deployment-specific cases (e.g. non-monitored paths, non-malware persistence) unreached.
T1546.018prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of this persistence technique being introduced or succeeding, but it does not stop the underlying Python startup mechanisms from existing or being abused.
T1547detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and test processes, which can surface T1547 indicators after the fact; this is limited to known patterns shared with other orgs and does not broadly instrument for novel autostart abuse.
T1547prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block common autostart/persistence techniques before they execute.
T1547.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface Registry Run Keys / Startup Folder persistence when the indicators or anomalous startup behavior match collected/analyzed threat intel.
T1547.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and IOCs (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block Registry run-key or startup-folder persistence before it executes.
T1547.002detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the registry modification, LSA loading, and related anomalous boot behavior for this Windows persistence technique.
T1547.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific TTP (rogue time-provider DLL registration at boot), but this is only one of three intelligence layers and depends on sources, analysis, and sharing that do not guarantee detection of this Windows-specific persistence technique.
T1547.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes and technical preventive controls (e.g. endpoint protection, registry monitoring) to block the registration/execution path before it succeeds, but this is indirect, depends on the intel being actionable and applied, and does not guarantee prevention of the technique.
T1547.004detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, TTPs and IOCs (tactical/operational layers) and feeds it into detective controls and testing, which can surface this persistence TTP when it matches known patterns, but does not itself perform detection and leaves many novel or internal-only abuses unseen.
T1547.004prevents — Threat intelligence on attacker methodologies, tools, TTPs and IOCs (tactical/operational layers) can be fed into risk processes, preventive controls and testing to block the specific registry modifications or Winlogon abuse before they succeed.
T1547.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface SSP registry modifications or anomalous LSA DLL loads when those map to known threat intel, but this is scoped only to the fraction of instances covered by collected/analyzed intel rather than all possible abuse.
T1547.005prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of SSP abuse, but does not itself stop the Registry modification or boot-time loading.
T1547.006detects — A.5.7 collects/analyzes threat intel (incl. operational IOCs and attacker TTPs) that can feed technical detective controls and risk processes, which may surface some LKM/kext-based rootkit activity; it does not itself perform detection and leaves large platform-specific slices (e.g. custom unsigned modules, non-shared IOCs) unreached.
T1547.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can inform actions that block many LKM/kext loading paths, but cannot prevent all kernel-level persistence/escalation techniques on Linux/macOS.
T1547.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the plist modification or anomalous login behavior, but this is scoped by relevance/insight/actionability choices and does not guarantee detection of the macOS-specific technique.
T1547.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of LSASS driver tampering after the fact, but this is only a slice of the broad, multi-layer intelligence production process that is not required to instrument or monitor the specific technique.
T1547.008prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to block common LSASS driver addition/replacement vectors before they succeed.
T1547.009detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, TTPs) and feeding them into detective controls like IDS or anti-malware, which can surface shortcut-modification artifacts when they match known patterns, but this is scoped only to the subset of instances that match gathered intelligence rather than broadly detecting the technique.
T1547.010detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the port-monitor DLL load or registry change as anomalous boot-time behavior on Windows.
T1547.010prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, firewalls), and testing to block the registry/API abuse and DLL loading before it succeeds.
T1547.012detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the specific Registry, API, file-placement and spoolsv-loading artifacts of this Windows boot-time technique
T1547.012prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, firewalls), and testing to block the registry/API abuse and DLL loading before it succeeds.
T1547.013detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific TTP (malicious .desktop in autostart dirs), but the control is primarily about awareness production rather than mandating detection mechanisms, leaving most implementations without guaranteed coverage of this Linux-specific persistence.
T1547.014detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface Active Setup abuse post-execution; this is limited to known patterns shared with other orgs rather than reliably catching novel or masqueraded instances.
T1547.014prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of this persistence technique being introduced or succeeding, but it does not stop the underlying Active Setup mechanism or guarantee the technique is never executed.
T1547.015detects — A.5.7 collects/analyzes/shares threat intel (including operational IOCs and attacker TTPs) that can feed detection rules in technical controls, but the control itself performs no detection and stops at producing actionable intelligence for others to use.
T1547.015prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block the addition or execution of malicious login items, but this is indirect, depends on accurate sharing/analysis/action, and leaves many implementation-specific vectors (e.g., pre-10.5 AppleScript, hidden Service Management Framework items) unaddressed.
T1548detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1548 indicators or anomalous elevation attempts, but this is scoped to selected relevant sources and does not mandate broad detection of the technique itself.
T1548prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive controls, enabling informed actions that stop many elevation-abuse techniques from succeeding; it is not a direct barrier and leaves residual cases (e.g., novel/undiscovered methods).
T1548.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of setuid/setgid abuse or related discovery, but this is only a slice of the technique's execution surface and does not mandate detection of the core privilege-escalation mechanism itself.
T1548.002detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (e.g. IDS, anti-malware) and security testing, which can surface some UAC-bypass TTPs or IOCs but leaves the majority of technique variants, in-process injection, and non-indicator lateral-movement cases undetected by this control alone.
T1548.002prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk management, which can stop many (but not all) UAC bypass techniques from succeeding.
T1548.003detects — Threat intelligence activities include collecting/analysing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and security testing, which can surface sudo/sudoers abuse when it matches known TTPs or IOCs, but this is limited to known patterns and does not broadly detect novel or misconfiguration-based instances of the technique.
T1548.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk management, preventive controls, and testing to block common sudo/sudoers abuse patterns before they succeed, but this is only a slice of the class since many configurations remain unaddressed without specific hardening.
T1548.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of this macOS-specific API abuse after it occurs, but the control is not scoped to guarantee detection of this technique.
T1548.004prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood this macOS-specific privilege-escalation technique is introduced or left exploitable, but it does not stop the deprecated API from functioning or block its abuse when called.
T1548.005detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware, etc.), which can surface misuse of temporary elevation paths when those leave observable artifacts, but the control is not scoped to systematic detection of the technique itself.
T1548.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and misconfigurations enables informed preventive actions and feeds into risk management, preventive controls, and testing that can stop the technique from succeeding, but only for a slice of cases (e.g., known patterns) rather than eliminating the underlying permission-abuse root cause.
T1548.006detects — A.5.7 collects/analyses/shares threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) and feeds it into detective controls and testing; this surfaces knowledge of TCC manipulation techniques after they exist in the threat environment but does not guarantee detection of every in-progress instance.
T1548.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block TCC database manipulation paths (e.g. via injection, SIP bypass, or launchctl), but does not stop the technique outright as it is not a direct preventive mechanism.
T1550detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (e.g. stolen hashes/tickets) and feeding them into detective controls like IDS or anti-malware, which surfaces T1550 use in some cases, but the control is not scoped to detection itself and leaves many platforms/variants unreached.
T1550prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. enhanced credential protection, monitoring for pass-the-hash/ticket), and testing to reduce the likelihood of successful theft and use of alternate auth material.
T1550.001detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed detective controls and risk processes, but the control itself only produces awareness and does not perform detection
T1550.001prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block token theft or use before the technique runs.
T1550.002detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware and risk processes, which can surface PtH attempts or related anomalous hash-based lateral movement; however, the control is scoped to relevant/insightful intelligence rather than mandating comprehensive detection coverage of all PtH variants or instances.
T1550.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block common PtH vectors or hashes, but does not stop all instances of hash capture or use.
T1550.003detects — A.5.7 collects/analyzes threat intel (incl. operational indicators and attacker TTPs) that can feed detective controls like IDS/anti-malware and risk processes, but does not itself perform detection of PtT execution.
T1550.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS), and testing to reduce likelihood of credential dumping or PtT execution, but does not stop the technique from being available or succeeding when executed.
T1550.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of stolen-cookie use or related malware after the fact, but this is scoped only to what the org elects to ingest and monitor rather than a mandated, broad detection mechanism.
T1550.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, auth/session protections) and risk processes to stop cookie theft or replay before the technique runs, but this is only one slice of a multi-vector technique that also relies on initial compromise vectors outside intelligence-driven prevention.
T1552detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of unsecured credential artifacts or related adversary behavior, but this is limited to known IOCs and does not broadly detect the core technique of searching for insecurely stored credentials across diverse platforms and locations.
T1552.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the presence of credential files or related IOCs in most platform scenarios, with a bounded remainder for purely static/local file-system searches that produce no observable events.
T1552.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific IOCs (operational layer), and integration into preventive controls (firewalls, IDS, anti-malware) and risk processes can block common search patterns or insecure credential storage practices before the technique executes, but leaves many file-based credential exposures (e.g., custom configs, source-embedded secrets, backups) unaddressed.
T1552.002detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of Registry credential searches, but this is scoped only to the subset of cases where observable artifacts or patterns match collected/analyzed intelligence rather than broadly detecting the technique itself.
T1552.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when indicators or anomalous history-file access appear in collected/analysed sources, but this is scoped only to what the org ingests and deems relevant rather than broad or guaranteed detection of all instances.
T1552.004detects — Threat intelligence activities include collecting/analyzing sources that can feed technical detective controls (e.g. IDS, anti-malware) and risk processes, which can surface the T1552.004 search technique or its indicators when they match known threats, but this is indirect, depends on implementation, and leaves large residual coverage gaps for the technique itself.
T1552.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can inform actions that stop the search/exfiltration technique from succeeding in many cases, but does not guarantee removal of all insecurely stored keys or block every possible discovery vector.
T1552.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of metadata API access attempts or related SSRF, but this is only a minority slice of the technique's surface (instance presence or proxy exploitation) rather than broad detection of credential access via the API.
T1552.005prevents — Threat intelligence on attacker methodologies, tools, specific TTPs (including metadata API abuse and SSRF), and sharing with peers directly informs preventive actions, risk processes, and tuning of technical controls like firewalls/IDS to block the technique before it succeeds.
T1552.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when indicators or anomalous access to SYSVOL/GPP XML appear in collected/analyzed intelligence, but this is indirect, scope-limited by relevance and sources chosen, and does not guarantee detection of the credential-gathering act itself.
T1552.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. ACL hardening on SYSVOL), and testing to stop the technique from being viable, but this is only one slice of a broader awareness activity that does not itself enforce any prevention.
T1552.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of API credential-gathering in containers, but the control is primarily about producing and sharing intelligence rather than mandating specific detection mechanisms, leaving most technical detection to other controls.
T1552.007prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware, testing) to block the API-access paths or credential-gathering techniques before they succeed.
T1552.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of credential harvesting from chat services, but this is scoped to relevant/insightful intel rather than broad or guaranteed detection of the technique.
T1552.008prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and integration compromises directly informs preventive controls (firewalls/IDS/antimalware) and risk processes that can block collection paths or credential exposure in chat services, but does not guarantee removal of the root sharing behavior or all access vectors.
T1553detects — Threat intelligence activities include collecting/analyzing indicators and feeding them into detective controls (IDS, anti-malware) and testing processes, which can surface T1553 subversions when known TTPs, tools, or IOCs match observed activity.
T1553prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (e.g. anti-malware, IDS) and risk processes that can block or raise barriers to subverting trust mechanisms before the technique succeeds.
T1553.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and testing can surface indicators or patterns associated with Gatekeeper bypasses, but the control is not scoped to reliably detect this specific macOS technique in real time or across all vectors.
T1553.002detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface signed-but-malicious binaries; this is limited to known or patterned cases rather than all possible code-signing abuse.
T1553.002prevents — Threat intelligence on attacker methodologies, tools, TTPs and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls and testing to reduce the likelihood of successful code-signing material theft or bypass, but does not stop adversaries from creating/acquiring/stealing materials or producing validly-signed malware.
T1553.003detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and test processes can surface hijacking indicators (e.g. anomalous registry changes or signature anomalies), but this is only a slice of the technique's stealthy, registry/DLL-based methods that often evade broad detection.
T1553.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. application control, anti-malware), and testing to block known hijacking techniques before they succeed.
T1553.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the technique or its indicators post-compromise, but the control is primarily about awareness production rather than mandating detection mechanisms, leaving most execution unobserved.
T1553.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer), indicators (operational layer), and supply-chain risks can be fed into risk management, preventive controls (e.g. anti-malware, firewalls), and testing to stop the technique from executing, but this is only one slice of a broader awareness process that does not itself block installation.
T1553.005detects — Threat intelligence activities include collecting/analysing tactical and operational indicators (tools, techniques, specific attacks) that can surface MOTW-bypass TTPs and feed them into detective controls and testing, but the control itself performs no direct detection of the technique in flight or in artifacts.
T1553.005prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can block MOTW-bypass techniques before they succeed.
T1553.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of policy-modification activity (e.g. specific commands, registry changes, kernel writes), but this is scoped only to relevant/insightful intelligence that the org has chosen to ingest and is not a dedicated detection mechanism for the technique itself.
T1553.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) for policy modification can be fed into risk processes, preventive controls (e.g. application controls, kernel protections), and testing to stop the technique from succeeding in many cases, but does not guarantee prevention as it depends on timely, accurate intel and effective downstream implementation.
T1554detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including binary modifications) and feeding them into detective controls like IDS/anti-malware as well as security testing, which surfaces some instances of T1554 but does not guarantee detection of all variants or novel patches.
T1554prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk management, which can block many binary modification vectors before they succeed; it does not guarantee prevention of all instances (e.g., novel/undetected patches or insider actions).
T1555detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1555 activity or related indicators, but this is scoped to selected relevant sources and does not mandate broad detection of credential searches across all platforms or password stores.
T1555prevents — Threat intelligence activities include feeding insights into preventive controls (firewalls, IDS, anti-malware) and risk management to enable actions that can block credential-access techniques before they succeed, but this is indirect, depends on downstream implementation, and does not guarantee prevention of local password-store searches.
T1555.001detects — A.5.7's operational threat intelligence layer and its use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators or patterns associated with Keychain credential dumping on macOS, but this is limited to known TTPs shared via intel feeds rather than reliably detecting novel or in-progress instances of the technique.
T1555.001prevents — A.5.7's strategic/tactical/operational threat intelligence, when fed into risk management and technical preventive controls (firewalls/IDS/antimalware), can drive configuration or tooling that stops the Keychain dump technique from succeeding on macOS, but this is an indirect, non-guaranteed slice rather than a direct barrier to credential acquisition from Keychain.
T1555.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of memory scraping or related credential access after the fact, but this is a narrow slice of the technique's root-privileged, in-memory nature with no mandated coverage of the dominant platform behaviors.
T1555.002prevents — Threat intelligence on attacker methodologies/tools for credential dumping (tactical layer) and specific indicators (operational layer) can be fed into risk processes and preventive/detective controls (firewalls, IDS, anti-malware) to block the root-access memory-scanning technique in many cases, but does not stop all instances (e.g. novel/undetected attacks or privileged insiders).
T1555.003detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational IOCs and attacker TTPs) that can feed detective controls and risk processes, providing awareness that surfaces this browser-credential technique when it matches known patterns, but does not itself perform detection.
T1555.003prevents — Threat intelligence on attacker methodologies/tools for credential access (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (e.g. anti-malware, firewalls) and risk processes that can block the browser-file/memory theft technique before it runs.
T1555.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1555.004 indicators or related behaviors, but this is limited to known IOCs or anomalies chosen by the organization rather than reliably detecting the technique itself.
T1555.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, firewalls), and testing to block common Credential Manager access paths such as vaultcmd.exe, Mimikatz, or password recovery tools, but cannot prevent all variants or novel techniques against this credential store.
T1555.005detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware) and risk processes, can surface indicators or behaviors tied to password-manager credential extraction (e.g. memory scraping or brute-force attempts), but this is scoped by relevance and does not mandate or guarantee detection of the technique itself.
T1555.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can block the memory-extraction, exploitation, and brute-force vectors described in T1555.005; this is only a slice of the full technique surface (e.g., does not reach every possible password-manager implementation or non-technical vectors).
T1555.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of secrets-manager access attempts, but this is scoped to selected relevant sources and does not guarantee detection of the technique itself.
T1555.006prevents — A.5.7's strategic/tactical/operational threat intel, when fed into risk management and technical preventive controls (firewalls/IDS/antimalware), can inform privilege tightening, monitoring rules, or access policies that stop the prerequisite privilege acquisition needed for T1555.006; this is a genuine but minority slice because the control itself only produces awareness and does not directly enforce any prevention.
T1556detects — A.5.7 collects/analyzes threat intel (incl. operational indicators and attacker TTPs) that can feed detective controls and risk processes to surface T1556-like modifications, but the control itself only produces awareness inputs and does not perform detection.
T1556prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific TTPs (operational) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block the modification techniques before they succeed.
T1556.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of LSASS patching or anomalous DC auth, but this is limited to known IOCs and does not broadly detect novel or in-memory patching.
T1556.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to preventive controls and risk processes that can block the Skeleton Key-style patch before it is deployed.
T1556.002detects — A.5.7's operational and tactical layers plus its use as input to detective controls (IDS, anti-malware) and test processes can surface indicators of a malicious password filter DLL (e.g. anomalous registration or known bad hashes), but this is scoped only to what the org elects to ingest/monitor and does not guarantee detection of the technique itself.
T1556.002prevents — A.5.7's threat-intelligence collection/analysis feeds risk management, preventive controls (firewalls/IDS/antimalware), and testing processes that can block malicious DLL registration or credential-harvesting before it succeeds; this reaches only a slice of the technique (e.g., via updated signatures or policy), leaving direct LSA/filter registration paths mostly untouched.
T1556.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface PAM modifications or related indicators, but this is scoped to relevant, actionable intel from selected sources rather than broad or guaranteed detection of the technique.
T1556.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS), and testing to stop PAM modifications/backdoors from occurring, but this is indirect, depends on accurate actionable intel, and leaves many implementation-specific vectors unaddressed.
T1556.004detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls and test processes, which can surface this technique post-implantation or in use; however, the control's scope is limited to known, shared intelligence and does not mandate broad detection coverage of novel or internal image modifications.
T1556.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when indicators or anomalous AD/policy changes appear in collected/analysed sources, but this is scoped only to what the org's chosen sources and analysis happen to cover rather than a mandated detection mechanism.
T1556.005prevents — A.5.7's threat-intelligence cycle (collect/analyse/share) feeds risk management, preventive controls (e.g. firewalls, anti-malware) and test processes that can block the AD property change or the credential-theft technique before it succeeds; this is genuine but only a minority slice of the class, as the dominant prevention is simply not enabling reversible encryption (a configuration baseline outside this control).
T1556.006detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including MFA bypass techniques) and feeding them into detective controls like IDS/anti-malware as well as test processes, which surfaces some instances of this technique but leaves large platform/implementation slices (e.g., manual config patching on Linux or non-monitored IaaS) outside its mandated scope.
T1556.006prevents — Threat intelligence on attacker methodologies, tools, and specific MFA bypass techniques (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. MFA configs, conditional access hardening), and testing to stop many (but not all) such modifications from succeeding.
T1556.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface specific TTPs, IOCs or anomalous authentication behavior tied to hybrid backdoors, but the control is primarily about awareness production rather than guaranteed detection of the technique itself.
T1556.007prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific TTPs/indicators (operational) for hybrid identity backdoors can be fed into risk processes, preventive controls (e.g. firewalls, anti-malware, config hardening), and testing to stop the technique from succeeding in many cases, but does not guarantee prevention of the on-premises/cloud compromise or modification steps that enable it.
T1556.008detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and test processes can surface the specific Registry-based DLL registration and anomalous credential-capture behavior, but this is only a slice of the full technique (strategic layer and non-technical sharing add no detection value).
T1556.008prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes and preventive controls (e.g. restricting Registry changes or DLL loading) to stop the technique from being used, but this is only a slice of the full class given the control's broad awareness focus rather than direct enforcement.
T1556.009detects — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker methodologies and indicators) can surface T1556.009 as a known technique when fed into monitoring or risk processes, but the control itself only produces awareness and does not mandate or perform detection of in-progress policy modifications.
T1556.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes and preventive controls (e.g. updating conditional access rules or blocking indicators), which stops the modification technique from succeeding in many cases, but the control is governance-oriented awareness rather than a direct enforcement mechanism and does not reach all instances or platforms.
T1557detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface AiTM indicators (e.g. anomalous ARP/DNS/LLMNR activity or downgrade signals), but the control is scoped to relevant/insightful intelligence sharing and does not mandate or guarantee detection coverage of all AiTM vectors or platforms.
T1557prevents — Threat intelligence on attacker methodologies, tools, TTPs (tactical/operational layers) and indicators is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block AiTM protocol abuses (ARP/DNS/LLMNR poisoning, downgrade attacks) before they succeed.
T1557.001detects — A.5.7 requires collection, analysis and dissemination of operational threat intelligence (specific attacks, technical indicators) that is then fed into detective controls such as IDS/anti-malware and into security testing, which surfaces LLMNR/NBT-NS/mDNS poisoning and SMB relay attempts when those indicators are present.
T1557.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, firewalls/IDS/antimalware, and testing to block LLMNR/NBT-NS/mDNS poisoning and relay (e.g. via signatures or disabling protocols), but does not itself stop the technique from being available or always succeed in blocking it.
T1557.001responds — A.5.7 produces and shares threat intelligence on attacker methodologies/tools (tactical layer) and specific attacks/indicators (operational layer) that is fed into detective controls (IDS, anti-malware) and incident processes, enabling response once name-resolution poisoning/relay is underway, but does not itself perform containment/eradication.
T1557.002detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks and technical indicators) and feeds it into detective controls like IDS, which can surface ARP cache poisoning in flight; this is only a slice because the control is governance-oriented and does not itself perform detection.
T1557.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block ARP poisoning vectors before they succeed, but this is only a slice of the stateless/protocol-level attack surface rather than a universal block.
T1557.003detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational IOCs and attacker methodologies) and feeds it into detective controls like IDS, which can surface DHCP spoofing in flight; this is a genuine but minority slice because the control itself only produces awareness and does not mandate or perform detection.
T1557.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can inform actions that block rogue DHCP server spoofing on the network, but does not guarantee prevention of all instances or variants of the technique.
T1557.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of evil twin APs or related anomalies, but this is limited to known patterns and does not broadly instrument for the technique's physical/radio-layer execution.
T1557.004prevents — Threat intelligence on attacker methodologies, tools (e.g. Wi-Fi Pineapple), indicators, and public Wi-Fi targeting can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to reduce the likelihood the Evil Twin technique is ever executed against the organization.
T1558detects — A.5.7's operational layer, collection/analysis of specific attacks and technical indicators, plus feeding into detective controls (IDS, anti-malware) and risk processes, surfaces T1558's ticket-stealing or forging activity in most cases (e.g. anomalous Kerberos traffic or indicators), with the bounded remainder being stealthy forgeries that evade all indicators.
T1558prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific TTPs/indicators (operational) for Kerberos ticket theft/forgery, when fed into risk processes and preventive controls (e.g. enhanced monitoring, config hardening, or updated detection rules in IDS/antimalware), can stop the technique from succeeding in many cases, but does not eliminate the underlying Kerberos weaknesses or block all variants.
T1558.001detects — A.5.7 collects/analyzes threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, which may surface golden-ticket activity; it does not itself perform detection.
T1558.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TGT-forging indicators (operational layer) can be fed into risk processes, preventive controls (e.g. enhanced credential protection, monitoring for KRBTGT access), and testing to stop the KRBTGT hash theft or golden ticket use before it succeeds, but this is only a slice of the full technique chain (which also depends on initial privileged access and dumping).
T1558.002detects — A.5.7 collects/analyzes operational threat intelligence (including technical indicators of specific attacks like forged silver tickets) and feeds it into detective controls (IDS, anti-malware) and test processes, surfacing the technique when indicators match, but this is scoped to known threats only and does not guarantee detection of novel or undetected instances.
T1558.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TGS forgery indicators (operational layer), and integration into preventive controls (firewalls/IDS/antimalware) and risk processes can block hash acquisition paths or ticket validation, but does not stop all silver ticket forgeries (e.g. offline hash use without KDC interaction).
T1558.003detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, monitoring) and risk processes, surface Kerberoasting TGS requests, anomalous SPN enumerations, or RC4 ticket patterns before or during execution.
T1558.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TGS-ticket attacks (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, stronger encryption configs), and testing to stop Kerberoasting from succeeding, but this is indirect, depends on what the org actually implements from the intel, and leaves many enabling conditions (weak service accounts, RC4 use, SPN enumeration) untouched.
T1558.004detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, TTPs, IOCs) from internal/external sources and feeding them into detective controls (IDS, anti-malware) and security testing, which surfaces AS-REP roasting attempts or related weak-account patterns before or while they occur.
T1558.004prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. account config enforcement), and testing to reduce prevalence of disabled Kerberos pre-auth accounts and insecure algorithms, thereby stopping the technique from running in many cases; it is not a direct preventive mechanism and leaves residual exposure where intelligence is incomplete or unenforced.
T1558.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface ccache theft indicators or related TTPs, but this is scoped by relevance/insight/actionability and does not mandate coverage of this specific Linux/macOS technique.
T1558.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware), which can block the collection or use of ccache files on Linux/macOS before the technique succeeds.
T1559detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface specific IPC-abuse TTPs or indicators, but this is scoped only to the actionable/operational slice of the technique rather than broadly detecting all IPC abuse across platforms.
T1559.001detects — A.5.7 collects/analyzes tactical+operational threat intel (including specific TTPs, tools, and indicators) and feeds it into detective controls like IDS/anti-malware as well as test processes, which can surface COM abuse when it matches known patterns, but this is scoped by relevance/insight/actionability and does not guarantee detection of novel or un-indicated instances.
T1559.002detects — A.5.7 collects/analyzes/shares threat intel (including operational IOCs and attacker TTPs) that can feed detection rules in IDS, anti-malware, and monitoring tools, but the control itself performs no detection and stops at producing actionable intel for others to use.
T1559.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can disable or block DDE pathways before the technique runs.
T1559.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface XPC abuse indicators or anomalous behavior, but this is limited to known/observable instances rather than broadly detecting the technique's core (poor validation/sanitization in custom XPC handlers).
T1559.003prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific indicators (operational) can be fed into preventive controls and risk processes to block XPC abuse vectors before exploitation occurs, but this is only one slice of the technique's surface (e.g., poor input sanitization or client validation in custom apps).
T1560detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1560 indicators or anomalous compression/encryption activity, but this is scoped only to what the org ingests, vets, and shares rather than mandating broad detection coverage.
T1560.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of utility-based archiving (e.g. specific tools, command lines, file patterns), but this is scoped only to relevant/insightful intelligence the org ingests and does not guarantee detection of the technique itself
T1560.001prevents — Threat intelligence on attacker methodologies, tools (e.g. 7-Zip, certutil), and TTPs can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block or detect the specific utilities and packaging behaviors before they run.
T1560.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface the specific libraries, tools, or anomalous archival behavior in T1560.002, but this is scoped to chosen relevant sources and does not broadly instrument or guarantee detection of the technique across all executions.
T1560.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface custom archival artifacts or behaviors when they match known indicators or anomalous patterns, but custom methods by definition lack standard signatures and the control's scope is awareness/risk-input rather than direct detection instrumentation.
T1560.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls, and testing to block custom archival implementations before they run, but this is only one slice of a broad awareness activity that does not guarantee prevention of the technique.
T1561detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface indicators and patterns of disk-wiping activity (MBR overwrites, erase commands, worm-like propagation) before or while the technique executes.
T1561prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block the write-access paths, propagation techniques and indicators used by disk-wiping malware before execution.
T1561.001detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS/anti-malware can surface T1561.001 indicators or anomalous disk-wipe behavior, but this is scoped only to the subset of indicators the org ingests and tunes into its tools, leaving the bulk of in-the-wild variants undetected.
T1561.001prevents — Threat intelligence on attacker methodologies, tools (e.g. RawDisk), propagation techniques, and destructive wipers directly feeds preventive controls, risk processes, and testing that can stop T1561.001 from executing, but only for the informed slice of threats the org has visibility into and chooses to act on.
T1561.001recovers — A.5.7 threat intelligence is explicitly used as input to information security risk management, preventive/detective controls, and testing processes that enable recovery from realized destructive availability events such as disk content wipe.
T1561.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of disk-wipe activity or precursors, but this is limited to selected relevant sources and does not guarantee detection of the technique itself across all platforms or propagation vectors.
T1561.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and sharing with peers can inform preventive controls (firewalls, IDS, anti-malware, risk processes) that stop the technique from executing in many cases, but does not guarantee prevention of all instances such as novel/zero-day variants or insider-enabled propagation.
T1561.002recovers — A.5.7 threat intelligence is used as input to risk management, preventive/detective controls, and testing processes that enable recovery planning and restoration after a disk-structure wipe event (e.g., via backups or rebuilds informed by known attacker TTPs).
T1563detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and feeding into detective controls (IDS, anti-malware) and test processes directly surfaces T1563 session-hijacking activity or its indicators.
T1563prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) and risk processes to block hijacking vectors before they succeed, but this is only a slice of the technique's surface (e.g., does not eliminate all session-management flaws or credential exposure).
T1563.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of SSH agent compromise or anomalous session hijacking, but this is scoped only to what the org elects to ingest and instrument, leaving large residual coverage gaps for the technique itself.
T1563.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block SSH agent compromise paths or session hijacking before it succeeds, but this is only a slice of the technique's prerequisites (e.g., initial root/compromise, trust relationships) and does not stop all instances.
T1563.002detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls and risk processes, which may surface RDP hijacking when it matches known patterns, but the control itself performs no detection and many hijacks use native tools with no prior intel.
T1563.002prevents — Threat intelligence on attacker methodologies/tools for session hijacking (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. firewalls/IDS), and testing to stop the technique from succeeding in many cases, but does not eliminate the underlying RDP session-stealing vector itself.
T1564detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface some hiding techniques via indicators or anomalies, but the control is primarily about upstream collection/analysis for awareness and risk processes, not direct detection of T1564 artifacts.
T1564prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block the specific hiding techniques before they succeed.
T1564.001detects — Threat intelligence activities include collecting/analysing operational indicators of specific attacks (including evasion via hidden files) and feeding them into detective controls and security testing, but the control itself only surfaces awareness for later use rather than performing detection.
T1564.001prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block or raise barriers to the hiding technique before it succeeds.
T1564.002detects — Threat intelligence activities include collecting/analyzing sources that can feed into detective controls (IDS, anti-malware) and risk processes, which can surface hidden-user TTPs when observed in the threat environment, but this is indirect, not a dedicated detection mechanism for the technique itself.
T1564.002prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of hidden-user techniques being introduced or succeeding, but does not stop the underlying configuration-manipulation methods from being available or used.
T1564.003detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls (IDS, anti-malware) and testing processes, which can surface the described hidden-window TTPs when they match known patterns, but this is scoped only to known threats and does not broadly instrument for novel or non-indicator uses of the technique.
T1564.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface NTFS attribute abuse after it occurs, but the control is primarily about producing and sharing intelligence rather than mandating specific detection mechanisms for this technique.
T1564.005detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational indicators and attacker methodologies) that can feed detective controls and tests, which may surface some hidden file system uses when known patterns exist, but does not itself perform detection.
T1564.005prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware), which can block hidden file system implementations before they succeed.
T1564.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of virtual-instance execution or anomalies, but the control is primarily about awareness production rather than direct detection and does not reach most of the technique's hiding mechanisms or platforms.
T1564.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into preventive controls (firewalls/IDS/antimalware) and risk processes to block common virtualization techniques before execution, but many niche or novel VM/sandbox usages remain unaddressed.
T1564.007detects — A.5.7's operational and tactical threat-intelligence layers, when fed into IDS, anti-malware, and security testing, can surface known VBA-stomping TTPs or IOCs (e.g. anomalous p-code/source mismatch), but the control itself only gathers/analyzes/shares intel and does not perform or guarantee detection of this technique.
T1564.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, test techniques, and preventive/detective controls to reduce the likelihood of VBA stomping succeeding in the environment.
T1564.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of rule abuse or related TTPs, but the control is primarily about ingesting and sharing external threat intel rather than directly detecting this post-compromise mailbox technique.
T1564.008prevents — Threat intelligence (including tactical/operational layers, analysis, and feeding it into preventive controls like anti-malware, IDS, or email filtering rules) can inform configurations that block or surface the creation/abuse of malicious inbox/transport rules, but does not stop an already-authenticated adversary (or insider) from creating them.
T1564.009detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational indicators and attacker methodologies) that can feed into detective controls and testing to surface resource-fork abuse on macOS; this is genuine but only a minority slice of the class because the control itself performs no direct detection and many instances remain invisible without specific intel or tooling.
T1564.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to block known resource-fork hiding techniques on macOS, but does not stop novel or unknown uses of the deprecated mechanism.
T1564.010detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface PEB-spoofing artifacts post-execution; this is limited to known patterns shared via intel sources rather than reliably catching novel or in-memory variants.
T1564.010prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block common process-spoofing vectors before execution, but does not stop novel or custom PEB-overwrite implementations.
T1564.011detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, indicators) and feeds it into detective controls and test processes, which can surface this technique when observed in the wild or during testing, but the control itself performs no direct detection and many instances remain unseen.
T1564.012detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS/anti-malware, which can surface use of well-known AV exclusions as an anomalous or malicious placement.
T1564.012prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to tune preventive technical controls such as anti-malware, enabling those controls to avoid or close the very exclusions the technique abuses; this stops the technique in many but not all cases (e.g. unknown/default exclusions, non-AV vectors, or when intel is not actioned).
T1564.013detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of bind-mount abuse after it occurs, but this is limited to known TTPs shared via intel sources and does not broadly instrument for novel or in-process filesystem manipulation on Linux.
T1564.014detects — A.5.7's operational threat intelligence layer and its explicit use as input to detective controls (IDS, anti-malware) and security testing can surface xattr-based hiding techniques when indicators or methodologies are known and fed into those tools, but this is scoped only to what the org has collected/analyzed and integrated rather than a broad or inherent detection guarantee.
T1564.014prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) directly feeds preventive controls (firewalls, IDS, anti-malware, testing) that can block xattr abuse before execution, but does not stop all instances as it depends on relevance, sharing, and integration into risk processes.
T1565detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1565 indicators or anomalies after manipulation occurs, but the control is primarily about upstream awareness production rather than direct detection mechanisms and leaves many stealthy or custom manipulations unreached.
T1565prevents — Threat intelligence activities (collection, analysis, sharing into risk processes, and feeding preventive controls like firewalls/IDS/antimalware plus testing) can inform actions that stop many T1565 instances before they run, especially those relying on known methodologies, indicators, or prolonged gathering; however, novel/zero-day manipulations or those not matching available intel remain unaddressed.
T1565.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of stored-data manipulation after the fact, but the control is primarily about upstream awareness production rather than direct detection of the technique.
T1565.001prevents — Threat intelligence (strategic/tactical/operational) is explicitly used as input to technical preventive controls and risk management processes that can block the information-gathering, expertise-building, and access steps required for complex stored-data manipulation, though it does not stop simpler direct-integrity attacks once the adversary is already positioned.
T1565.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of transmitted-data manipulation after the fact, but this is only a slice of the broad, expertise-dependent technique that spans network/process interception on multiple platforms.
T1565.002prevents — Threat intelligence (strategic/tactical/operational) that is relevant, insightful, contextual and actionable directly feeds risk management, preventive controls (e.g. firewalls, IDS, anti-malware) and testing to stop the adversary's information-gathering, tooling and interception steps required for T1565.002; it does not guarantee every possible transmission path or complex-system manipulation is blocked.
T1565.003detects — A.5.7's operational and tactical layers plus its explicit feeding of indicators into IDS, anti-malware and test processes surface some runtime manipulation techniques (especially those with detectable IOCs or anomalous binaries), but the control is silent on depth of coverage for in-memory or specialized-system manipulations that lack prior indicators.
T1565.003prevents — Threat intelligence on attacker methodologies, tools, TTPs and specific IOCs (tactical/operational layers) is explicitly used as input to preventive technical controls and risk processes that can stop the information-gathering, binary modification or masquerading steps required for T1565.003; it does not guarantee prevention in all cases or against novel variants.
T1566prevents — Strategic and tactical threat intelligence on phishing campaigns and lures informs user awareness programs and email filtering, lowering the likelihood that users will execute malicious attachments or links.
T1566detects — A.5.7 collects/analyzes/shares threat intel (incl. tactical/operational IOCs, attacker TTPs and phishing patterns) that feeds technical detective controls and risk processes, enabling detection of phishing campaigns; it does not itself perform detection.
T1566responds — A.5.7 produces and shares threat intelligence on attacker methodologies, tools, indicators and campaigns (tactical/operational layers) that is fed into incident response processes, technical detective controls and test techniques, enabling containment/eradication once a phishing campaign is underway; it is not the primary response mechanism and leaves many social-engineering and delivery variants untouched.
T1566.001detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and feeding into detective controls (IDS, anti-malware) and test processes directly surfaces T1566.001 indicators and the technique in flight.
T1566.001prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to update preventive controls (firewalls, anti-malware, email boundary defenses) and risk processes that can block the attachment delivery or execution path before it succeeds.
T1566.002detects — A.5.7's operational layer, collection/analysis of specific-attack indicators, and feeding into detective controls (IDS, anti-malware) and test processes directly surfaces T1566.002 indicators and campaigns; strategic/tactical layers add context but are not required for detection of this technique.
T1566.002prevents — Threat intelligence on attacker methodologies, tools, phishing variants, obfuscation, and consent-phishing patterns (tactical/operational layers) is explicitly used to feed preventive controls, risk processes, and tests that can stop the technique from succeeding, but the control only supplies awareness and does not itself enforce any blocking action.
T1566.003detects — A.5.7 requires collecting/analysing operational threat intelligence (specific attacks and technical indicators) and feeding it into detective controls like IDS or anti-malware, which can surface spearphishing-via-service attempts when indicators match; this is limited to known patterns and does not broadly detect novel social-engineering rapport-building or unmonitored third-party channels.
T1566.003prevents — Threat intelligence on attacker methodologies, tools, social engineering via third-party services, and specific TTPs (including this technique) directly feeds risk processes, technical preventive controls (e.g. anti-malware, email filtering), and testing that can block the messages/links/payloads before they succeed.
T1566.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators or patterns of vishing campaigns, but the control is primarily about upstream collection/analysis/sharing rather than real-time detection of the voice-based social engineering technique itself.
T1566.004prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (incl. vishing as a spearphishing variant) and its use as input to preventive controls and risk processes can stop the technique from succeeding in many cases, but does not eliminate social-engineering execution paths or guarantee prevention.
T1567detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of web-service exfiltration, but this is only a slice of the class given its emphasis on strategic/tactical intel, mutual sharing, and lack of mandated detection mechanisms.
T1567prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block or constrain this exfiltration technique before it succeeds.
T1567.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of exfiltration to code repos, but this is scoped by relevance/insight/actionability and does not broadly instrument or guarantee detection of the technique.
T1567.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cloud exfiltration, but this is limited to known IOCs in selected sources and does not broadly detect the technique itself.
T1567.002prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, DLP, egress filtering) to block the specific exfiltration path before it succeeds; this is explicitly listed in the control's guidance, but remains only a slice because the control itself does not mandate or implement the blocking action.
T1567.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of exfiltration to text storage sites, but this is scoped by relevance/insight/actionability and does not guarantee detection of the technique itself.
T1567.003prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block or constrain exfiltration channels to text storage sites before the technique succeeds.
T1567.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface webhook exfiltration when it matches known indicators or anomalous patterns, but this is limited to cases where intelligence is available and integrated, not a broad or guaranteed detection of the technique.
T1567.004prevents — A.5.7's threat-intelligence loop (collect/analyze/share into risk processes, preventive controls, and testing) can surface webhook-exfil TTPs early enough for blocking rules, monitoring, or SaaS-config changes that stop the technique from ever running, but only for known patterns in the bounded slice of strategic/tactical intel that organizations actually action.
T1568detects — A.5.7's operational layer (specific attacks and technical indicators) plus its explicit use as input to detective controls like IDS directly surfaces T1568's dynamic C2 algorithm, domain/IP/port flux, and fallback behavior; strategic/tactical layers and non-technical sharing form a bounded remainder.
T1568prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific IOCs (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) to block known dynamic-resolution patterns/algorithms before connections succeed, but this does not stop novel or unshared algorithms from being used.
T1568.001detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) plus its explicit use as input to detective controls like IDS directly surfaces Fast Flux DNS patterns such as rapid IP flux, short TTLs, and round-robin resolutions.
T1568.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) to block fast-flux resolutions or C2 domains before the technique succeeds, but this is only a slice of the class as many fast-flux variants remain undetected or unblocked in real time.
T1568.002detects — A.5.7's operational layer, collection/analysis of technical indicators, and feeding into detective controls (IDS, anti-malware) and testing directly surface DGA-based C2 domains or anomalous resolutions as they occur.
T1568.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls/IDS/antimalware) and risk processes to block known or predictable DGA patterns, but cannot stop novel/seed-based/time-based generation that defenders have not yet observed or reverse-engineered.
T1568.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface this specific C2 calculation when indicators or patterns are known and ingested, but the control's scope is bounded to relevant/known threats and does not mandate coverage of novel or custom DNS-calculation variants.
T1568.003prevents — threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS), and testing to block this exact C2 calculation technique before it succeeds
T1569detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes surface the abuse of system services/daemons when observable indicators or anomalous behavior are present in collected sources.
T1569.001detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, technical indicators) and feeds it into detective controls like IDS or anti-malware, which can surface launchctl abuse when indicators are known; this is limited to known patterns and does not broadly instrument for unknown uses of the technique.
T1569.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block known launchctl abuse patterns on macOS, but this does not stop novel or undetected uses of the technique.
T1569.002detects — A.5.7 collects/analyzes/shares threat intel (incl. operational IOCs and attacker TTPs) that can feed detective controls like IDS or anti-malware to surface this technique post-execution, but the control itself only produces awareness inputs and does not perform detection.
T1569.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware), which can block abuse of the service control manager before execution occurs.
T1569.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of systemctl abuse in Linux environments, but this is scoped only to the subset of threat intel that is collected, relevant, and integrated — not a broad or guaranteed detection mechanism for the technique.
T1569.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to block known systemctl abuse paths before they succeed, but this is only a slice of the Linux technique space and depends on timely, actionable intel rather than a universal barrier.
T1570detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface T1570 activity via IOCs or anomalous file transfers, but this is limited to known indicators and does not broadly detect novel or native-tool variants across all platforms.
T1571detects — A.5.7's operational layer, collection/analysis of technical indicators, and use as input to detective controls (IDS, firewalls) and testing directly surfaces non-standard port usage as anomalous or malicious.
T1571prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to update technical preventive controls such as firewalls and IDS, which can then block non-standard port usage; this is only a slice of the full technique because intelligence is not itself the blocking mechanism and does not reach all possible non-standard port abuses (e.g. post-compromise registry changes on victim systems).
T1572detects — A.5.7 collects/analyzes threat intel on attacker methodologies/tools (tactical layer) and specific attacks/indicators (operational layer) to feed detective controls like IDS and inform risk processes, which can surface tunneling when indicators or patterns are known, but does not itself perform detection and leaves many novel or blended tunneling cases unreached.
T1572prevents — A.5.7's threat-intelligence loop (collect/analyze/share into risk processes, preventive controls, and testing) can surface T1572 indicators or actor TTPs in time for blocking rules or config changes that stop the technique from running, but this is indirect, depends on timely actionable intel, and leaves many tunneling variants (e.g. novel SSH/DoH blends) unreached.
T1573detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of custom C2 encryption implementations, but this is limited to known patterns rather than reliably detecting novel or well-obfuscated encrypted channels.
T1573.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of known symmetric C2 encryption, but this is limited to known IOCs/patterns and does not broadly detect the technique itself.
T1573.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of asymmetric crypto C2, but this is scoped only to relevant/insightful intel that the org has sourced and analyzed, leaving most in-the-wild uses undetected.
T1573.002prevents — Threat intelligence on attacker methodologies, tools, and specific C2 techniques (including asymmetric crypto for obfuscation) can be fed into risk processes, preventive controls (e.g. firewall/IDS rules), and testing to stop the technique from being used successfully, but this is only one slice of a broad awareness activity that does not itself block the technique.
T1574detects — A.5.7's operational and tactical layers plus explicit use as input to intrusion detection, anti-malware and testing controls surface many hijack-execution indicators (e.g. anomalous library loads, registry poisoning, unexpected process ancestry) after the technique runs.
T1574prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, app control, risk processes) to block common hijack vectors before they succeed, but does not stop novel or unmodeled hijacks and the control itself only supplies awareness rather than the blocking action.
T1574.001detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and other detective controls surface DLL sideloading, search-order anomalies, phantom references and substitution via IOCs, behavioral analytics and enriched monitoring.
T1574.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block common DLL sideloading/search-order/phantom vectors before they succeed, but this is inherently partial as it depends on prior knowledge, specific IOC coverage, and cannot stop novel/zero-day variants of the technique.
T1574.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface dylib hijacking indicators or anomalous library loads, but this is scoped by relevance and does not guarantee detection of all instances or variants of the technique.
T1574.004prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS), and testing to block known dylib hijacking paths or vulnerable apps, but does not stop novel or unshared instances of the technique.
T1574.005detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including those abusing installer permission weaknesses) and feeding them into detective controls like IDS or anti-malware, which can surface the technique when it matches known patterns, but this is scoped only to known threats and does not broadly instrument for unknown instances.
T1574.005prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls/risk processes can inform actions that stop the installer-weakness pattern from being exploitable, but only for a slice of cases (known installers, monitored environments) rather than eliminating the underlying permission-setting defect across all software.
T1574.006detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) and feeds it into detective controls like IDS or anti-malware, which can surface dynamic linker hijacking when known indicators or behaviors are present; it does not itself perform detection and leaves many novel or environment-specific instances unreached.
T1574.006prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) and risk processes to stop LD_PRELOAD/DYLD_INSERT_LIBRARIES hijacking before execution, but this is only a slice of the class as the control provides awareness rather than mandating or enforcing any specific preventive mechanism.
T1574.007detects — A.5.7's operational and tactical layers plus its explicit use as input to intrusion detection, anti-malware and testing controls can surface PATH hijacking indicators or anomalous binary loads, but the control is scoped only to relevant/insightful intelligence sharing and does not mandate broad runtime detection of the technique itself.
T1574.007prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS), and testing to block PATH hijacking before it succeeds, but the control only supplies awareness and does not itself enforce any blocking mechanism.
T1574.008detects — Threat intelligence activities include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls like IDS or anti-malware, which can surface search-order hijacking artifacts after the fact; this is limited to known patterns shared with similar orgs rather than reliably catching novel or internal instances.
T1574.008prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls and risk processes to stop vulnerable search-order patterns from being present or exploitable, but this is indirect, depends on downstream implementation, and leaves many instances (e.g., legacy code or unpatched apps) untouched.
T1574.009detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of unquoted-path hijacking after it occurs, but the control is not scoped to or focused on detection of this specific technique.
T1574.009prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, testing), and configuration baselines to identify and eliminate unquoted paths before exploitation, but this is indirect, depends on human/system action, and leaves residual unaddressed paths.
T1574.010detects — threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including technical IOCs) and feeding them into detective controls such as IDS or anti-malware, which can surface this Windows-specific binary-hijacking technique when known patterns or IOCs are present; the remainder is that the control does not itself perform detection and many instances leave no prior intelligence signature
T1574.010prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, firewalls), and testing to block common permission weaknesses and hijacks before they are exploited, but does not guarantee prevention of all novel or unshared instances of the flaw.
T1574.011detects — A.5.7 collects/analyzes threat intel (incl. operational IOCs and attacker TTPs) that can feed detection tools and risk processes, but does not itself perform detection and reaches only the subset of this technique that appears in known intel sources.
T1574.011prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. ACL hardening on service Registry keys), and testing to stop the permission flaw from being present or exploitable, but this is only one slice of a broader class of Registry-permission weaknesses that the control does not comprehensively address.
T1574.012detects — A.5.7's operational and tactical threat-intelligence layers, when fed into detective controls (IDS, anti-malware, security testing), can surface the specific TTP of COR_PROFILER abuse (registry changes, anomalous profiler DLL loads, or .NET process hooking), but the control itself only gathers/analyzes/shares intel and does not perform or guarantee detection.
T1574.012prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. app whitelisting, registry monitoring, .NET hardening), and testing to stop this technique from being viable in the environment.
T1574.013detects — A.5.7 explicitly feeds threat intelligence (including tactical/operational IOCs and attacker TTPs) as input into detective controls such as intrusion detection systems and anti-malware, which can surface the technique when it matches known patterns or indicators; this is only a slice because the control itself performs no detection and many implementations of the technique (e.g., novel or restored-table variants) remain undetected.
T1574.013prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, firewalls), and testing to block this Windows-specific in-memory hijack technique before it runs, but the control only supplies awareness and does not itself enforce any blocking action.
T1574.014detects — A.5.7 collects/analyzes/shares threat intel (including tactical/operational IOCs and attacker TTPs) that can feed detection rules in IDS, anti-malware, and monitoring tools, but does not itself perform detection and leaves many implementation gaps (e.g., no coverage for novel or unshared indicators).
T1574.014prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, app whitelisting), and testing to block common AppDomainManager hijacking vectors before execution.
T1578detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls like IDS can surface T1578 activity when known patterns or IOCs are present, but this is limited to known threats and does not broadly detect novel or undetected modifications.
T1578.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of snapshot creation for evasion, but this is scoped by relevance/insight/actionability filters and does not broadly instrument the IaaS technique itself
T1578.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of new-instance creation as anomalous cloud activity, but this is only a minority slice of the technique's evasion surface (no universal coverage of all creation events or post-creation activity).
T1578.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface the T1578.003 technique when it matches known patterns, but this is scoped only to known threats and does not broadly instrument for unknown or novel instance-deletion activity.
T1578.003prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood an adversary gains the initial access or privileges needed to delete a cloud instance.
T1578.003recovers — A.5.7 threat intelligence can feed risk processes and detective/preventive controls that improve backup, snapshot or forensic recovery regimes for cloud instances, enabling partial state restoration after deletion, but does not itself perform recovery.
T1578.003responds — A.5.7 threat intelligence can feed risk processes, technical detective controls, and incident response once the deletion technique is underway, providing contextual awareness that aids containment/eradication, but the control itself only supplies information and does not perform the response actions.
T1578.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of snapshot reversion or ephemeral reset anomalies, but this is limited to what sources provide and does not broadly instrument the technique itself.
T1578.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface specific TTPs or indicators of configuration modification attempts, but the control is primarily about awareness production rather than real-time detection of the technique itself.
T1578.005prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (incl. cloud config abuse for evasion) feeds risk processes and preventive controls (firewalls/IDS/antimalware), enabling informed actions that can block the technique before it runs, but this is indirect, depends on downstream implementation, and leaves many config-modification vectors untouched.
T1580detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls like IDS can surface T1580 activity when it matches known patterns or IOCs, but this is scoped only to the subset of instances covered by ingested intelligence rather than broadly detecting all discovery attempts.
T1580prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, IAM policies, API rate-limiting, etc.) to block the reconnaissance APIs, CLI calls and wordlist scanning that realize T1580, but this is only a slice of the class because the technique can still succeed via legitimate user access keys or unmonitored discovery paths.
T1583.001prevents — Threat intelligence on attacker methodologies, tools, emerging TTPs, and specific IOCs (including domain acquisition patterns, lookalikes, typosquatting, expired-domain repurposing) enables informed preventive actions that stop many instances of the technique from succeeding, but does not stop adversaries from acquiring and using domains.
T1583.002prevents — Threat intelligence on attacker methodologies, tools, specific TTPs and indicators (tactical/operational layers) can be fed into risk processes, preventive controls and testing to reduce the likelihood an organization will be successfully targeted by or fall victim to this exact technique, but the control itself only supplies awareness and does not stop adversaries from setting up their own DNS servers.
T1583.003prevents — Threat intelligence on attacker methodologies, tools, infrastructure acquisition patterns and specific providers (tactical/operational layers) can be fed into risk processes and preventive controls to raise barriers or block easy/anonymous VPS rental, but does not stop the technique outright as adversaries retain many unmonitored or low-registration providers.
T1583.004prevents — Threat intelligence on attacker methodologies, tools, infrastructure acquisition patterns and specific IOCs (tactical/operational layers) can be fed into risk processes, preventive controls and testing to raise barriers or detect early signs of adversary server acquisition, but does not stop the purchase/lease itself.
T1583.005prevents — Threat intelligence on attacker methodologies, tools (botnets, booter services, EOL/ORB/IoT devices), and indicators directly feeds risk processes, preventive controls (firewalls, IDS, anti-malware), and testing to block acquisition or downstream use of botnets, but cannot stop all purchases or leases of external botnets.
T1583.006prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies and indicators, when fed into risk management and preventive controls, can block some common web-service registrations or downstream abuse, but does not stop the adversary technique of simply registering for legitimate services.
T1583.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of serverless C2/proxy usage, but the control is scoped to relevant/insightful intelligence sharing and does not mandate detection of this specific pre-attack infrastructure technique.
T1583.007prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to raise barriers or block common serverless-abuse patterns before acquisition/use.
T1583.008detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface malvertising indicators or related artifacts post-purchase, but the control's core focus is pre-harm awareness and prevention rather than real-time detection of the ad-purchase or evasion techniques themselves.
T1583.008prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and evasion tricks (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to block or reduce the chance of malvertising campaigns succeeding against the organization.
T1584detects — A.5.7's collection/analysis/sharing of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface T1584 activity or IOCs after the compromise occurs, but this is only a slice of the broad pre-attack technique that also includes strategic/tactical intel and non-detectable infrastructure compromises.
T1584prevents — Threat intelligence on attacker methodologies, tools, emerging TTPs, and specific IOCs (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block compromise of infrastructure before it occurs.
T1584.001detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface domain hijacking when indicators appear, but this is limited to post-compromise detection of known patterns rather than reliably catching novel or stealthy hijacks like subdomain takeover or shadowing before or at the moment of occurrence.
T1584.001prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls and risk processes, which can stop domain hijacking techniques from succeeding in many cases, but this is only one slice of the multi-vector technique (e.g., social engineering, renewal gaps, cloud compromises) and does not guarantee prevention.
T1584.002detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface the compromise of third-party DNS servers or related anomalous DNS behavior, but this is limited to known indicators and does not broadly detect novel or silent subdomain hijacks.
T1584.002prevents — Threat intelligence on attacker methodologies, tools, specific indicators, and the changing landscape (including DNS compromise techniques) enables informed preventive actions, risk management updates, and tuning of preventive controls like firewalls/IDS that can stop the compromise or its downstream use, but this is only one slice of a multi-vector pre-compromise technique that also depends on unaddressed factors like third-party patching and supply-chain defenses.
T1584.003prevents — Threat intelligence on attacker methodologies, tools, emerging TTPs, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood that such VPS compromises succeed or are chosen, but does not stop the technique outright as it is an external pre-compromise action against third-party assets.
T1584.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of third-party server compromise or related TTPs, but this is limited to known/observable cases and does not broadly detect the pre-compromise acquisition itself.
T1584.004prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block compromise paths for third-party servers used in targeting.
T1584.005detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and risk processes can surface botnet-related IOCs or adversary activity, but this is limited to known/post-compromise indicators rather than reliably detecting the pre-targeting botnet-building itself on PRE platforms.
T1584.005prevents — Threat intelligence on attacker methodologies, tools, botnet build/takeover TTPs, and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop many botnet-formation attempts before they succeed, but does not block all compromise vectors or guarantee prevention of every instance.
T1584.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of compromised web-service accounts or related TTPs, but this is scoped to a minority slice of the PRE technique's broad targeting and infrastructure-compromise surface.
T1584.006prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to block compromise of web service accounts or their downstream abuse, but this is only one slice of a PRE technique that also turns on user credential theft, supply-chain compromise, and non-technical vectors that intelligence does not universally stop.
T1584.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of compromised serverless infrastructure or related C2/proxy activity, but this is limited to known/analyzable indicators and does not broadly detect the initial compromise or all attribution-hiding uses.
T1584.007prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware, testing) to block compromise paths or serverless abuse before it occurs, but this is only a slice of the broad pre-attack technique rather than a comprehensive block.
T1584.008detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface the T1584.008 technique when indicators are known and relevant, but this is limited to post-compromise detection of known patterns rather than reliably detecting novel or zero-day device compromises on third-party/premise devices.
T1584.008prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators for compromising SOHO/edge network devices (tactical/operational layers) enables informed preventive actions such as hardening configurations, patching, or blocking known bad sources, which stops the compromise technique from succeeding in many cases; it is not full because the control is awareness-oriented, does not mandate specific preventive mechanisms, and leaves residual risk from novel/undetected compromises.
T1585prevents — Threat intelligence on attacker methodologies, tools, personas, and account-creation patterns (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to raise barriers or detect the technique before it succeeds, but the control only supplies awareness and does not itself block account creation on public services.
T1585.001prevents — Threat intelligence on attacker methodologies, tools, personas, and social-media techniques (tactical/operational layers) is explicitly used as input to preventive controls and risk processes, which can stop the technique from being employed or succeeding; it is not a direct barrier and leaves many adversary accounts unaddressed.
T1585.002prevents — Threat intelligence on attacker methodologies, tools, personas, disposable services and infrastructure-acquisition patterns (tactical/operational layers) can be fed into risk processes, preventive controls and testing to raise the bar on creation and downstream use of such accounts, but does not stop adversaries from creating them.
T1586detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of account compromise activity (e.g. credential purchases, phishing-for-credentials patterns, anomalous persona use), but this is limited to known/post-facto IOCs and does not broadly detect the full range of pre-compromise reconnaissance or credential-theft techniques described.
T1586prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk management to stop the reconnaissance, credential theft, and account compromise steps of T1586 from succeeding.
T1586.001prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls and risk processes that can block credential theft, phishing, and account compromise techniques before they succeed.
T1586.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of email-account compromise or related TTPs, but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of the PRE technique itself.
T1586.002prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to preventive controls (firewalls, IDS, anti-malware) and risk processes that can block the reconnaissance, credential theft, and phishing vectors used to compromise email accounts, but this is only a slice of the class (does not stop all purchase, insider-sale, or post-compromise abuse methods).
T1586.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and risk processes surfaces knowledge of T1586.003 indicators or related campaigns, but only for known threats from vetted sources and does not broadly detect novel or in-progress compromises of cloud accounts.
T1586.003prevents — Threat intelligence on attacker methodologies, tools, indicators, and cloud-specific TTPs (tactical/operational layers) is explicitly used to feed preventive controls, risk processes, and testing that can stop the reconnaissance, credential theft, and compromise steps of T1586.003 before the account is acquired; it is not a universal barrier and leaves residual paths such as zero-days or insider-enabled compromise.
T1587.001prevents — Threat intelligence on attacker methodologies, tools, malware components and TTPs (tactical/operational layers) can be fed into risk management, preventive controls and testing to stop many instances of this PRE technique from being used against the organization.
T1587.004prevents — Threat intelligence on attacker methodologies, tools, exploit development practices, and specific indicators enables informed preventive actions (e.g. patching, test updates, tuning of preventive controls) that stop many in-house exploits from being developed or from succeeding, but leaves a bounded remainder (zero-days unknown to intel sources, in-house adversary skill that bypasses shared indicators, and non-actionable strategic/tactical layers).
T1588prevents — Threat intelligence on attacker methodologies, tools, purchased/stolen malware/exploits, and vulnerability info (tactical/operational layers) is explicitly used to inform preventive controls and risk processes that can stop acquisition from succeeding or being leveraged, but this is only a slice of the broad PRE technique (which also covers free downloads and in-house development not addressed by intel-driven prevention).
T1588.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface acquisition activity or the resulting malware indicators, but the control is primarily about awareness production rather than real-time detection of the PRE technique itself.
T1588.001prevents — Threat intelligence on attacker methodologies, tools, malware sources (tactical/operational layers) and feeding it into risk management, preventive controls, and testing processes enables informed actions that can stop adversaries from successfully acquiring and using malware in many cases, but does not guarantee prevention of all such acquisitions.
T1588.002prevents — A.5.7's collection/analysis of tactical/operational threat intelligence on attacker tools and methodologies, when fed into risk management and technical preventive controls, can stop some tool-acquisition paths from being viable, but does not block the majority of acquisition methods (buying, downloading, stealing, cracking) described in the technique.
T1588.003detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the acquisition or use of stolen/purchased code-signing certs as a specific threat indicator, but this is only one slice of the pre-attack technique whose core (the purchase/steal step itself) sits outside most detection scopes.
T1588.004detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface the purchase/steal of certificates or related indicators, but this is limited to known/post-facto intel rather than reliably detecting the technique in all cases (e.g. novel purchases or internal thefts).
T1588.004prevents — Threat intelligence on attacker methodologies, tools, certificate theft/compromise patterns, and free-CA abuse can be fed into risk processes, preventive controls, and testing to reduce the likelihood adversaries successfully acquire usable certificates, but does not stop purchase, theft, or domain hijacking outright.
T1588.005detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators, exploit forums, newly discovered exploits) and its use as input to detective controls like IDS can surface adversary acquisition or monitoring of exploits, but this is limited to known indicators and does not broadly detect the technique itself.
T1588.005prevents — Threat intelligence on attacker methodologies, tools, exploit marketplaces, forums, and newly discovered exploits (tactical/operational layers) is explicitly used to feed risk management, preventive controls (firewalls/IDS/antimalware), and testing — enabling informed actions that stop many (but not all) purchased/stolen/downloaded exploits from being successfully used against the organization.
T1588.006detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface adversary monitoring of vulnerability disclosures, but this is only one narrow slice of the technique's full scope (which also includes closed databases, targeting researchers, and exploit development).
T1588.006prevents — A.5.7's collection/analysis of threat intel (including tactical/operational details on vulnerabilities and attacker methodologies) feeds risk management, preventive controls, and testing to enable actions that stop many vulnerability-acquisition paths from succeeding, but does not block open-source monitoring, closed DB access, or vendor targeting itself.
T1588.007detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface AI-assisted techniques (e.g. generated phishing, obfuscated payloads, or anomalous LLM queries), but this is limited to observable indicators rather than reliably catching the upstream acquisition or all downstream uses of generative AI tools.
T1588.007prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker tools (incl. AI/LLMs) and feeding it into risk management, preventive controls, and testing processes enables informed actions that can block or raise barriers to adversaries obtaining/using such AI tools for targeting tasks.
T1589detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls can surface T1589 activity when it matches known patterns or sources, but the control is scoped to relevant/insightful intel rather than mandating detection of all identity-gathering techniques.
T1589prevents — Threat intelligence activities explicitly include feeding relevant, insightful, and actionable information into risk management, technical preventive controls (firewalls/IDS/antimalware), and security testing processes, which can block many common T1589 collection paths such as exposed data sets, phishing for information, and active scanning enumeration; however, it does not stop all methods (e.g., internal leaks or novel techniques) and is not a direct barrier.
T1589.001detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators, dark-web markets, breach dumps) and its feeding into detective controls and risk processes surfaces credential-gathering activity, but only for known patterns from vetted sources rather than novel or internal leaks.
T1589.001prevents — Threat intelligence (strategic/tactical/operational) that is relevant, insightful, contextual and actionable directly feeds risk management, preventive controls (firewalls/IDS/antimalware), and testing to stop credential-gathering techniques such as phishing elicitation, credential leaks, dark-web purchases and infostealer logs from succeeding against the organization.
T1589.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the gathering/enumeration activity when observable indicators appear, but the control is primarily about ingesting and sharing intel rather than mandating detection of this PRE technique and many passive collections (social media, public datasets) leave no detectable event.
T1589.002prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive controls and risk processes that can block or constrain public email address exposure and enumeration paths before the technique runs.
T1589.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls can surface the gathering of employee names when it matches known patterns or IOCs, but this is limited to cases where the activity is already patterned/observable rather than all instances of passive OSINT.
T1589.003prevents — A.5.7's strategic/tactical threat intelligence on attacker methodologies (including name harvesting for reconnaissance, phishing lures, and social engineering) and its use as input to risk management, preventive controls, and testing processes can inform actions that stop the technique from succeeding in many cases, but does not eliminate the public availability of employee names or guarantee prevention across all vectors.
T1590detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface T1590 activity when indicators match known patterns, but this is limited to post-exposure known threats rather than all network-gathering methods (e.g., passive open-source or internal reconnaissance).
T1590prevents — Threat intelligence activities explicitly include using gathered/analyzed intel as input to technical preventive controls (firewalls, IDS, anti-malware) and risk management processes that can block or constrain some pre-attack network-gathering vectors (e.g. blocking known scanning IPs or exposed data sources), but this is indirect, depends on implementation, and leaves the bulk of passive/open-source collection untouched.
T1590.001prevents — A.5.7's strategic/tactical/operational threat intelligence, when fed into risk management, preventive controls (firewalls/IDS/antimalware), and testing, can inform actions that block or reduce exposure of domain properties (e.g. via tighter WHOIS privacy, DNS hardening, or limiting public API responses), but does not stop adversaries from performing the reconnaissance technique itself.
T1590.002detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS) can surface the DNS reconnaissance technique when indicators are known and ingested, but this is scoped only to the subset of cases where prior intel exists rather than broadly detecting novel or passive DNS gathering.
T1590.002prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, indicators) plus its explicit use as input to preventive controls (firewalls, IDS, anti-malware) and risk processes can block many forms of passive DNS reconnaissance and zone-transfer abuse before they succeed, but leaves a bounded remainder for novel or non-signatured collection that is not yet in intel feeds.
T1590.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls can surface the technique when it manifests as observable indicators or patterns, but the control is silent on real-time detection of pre-attack reconnaissance itself and many collection methods (e.g. passive open-source searches) leave no detectable signal.
T1590.003prevents — A.5.7's strategic/tactical threat intelligence on attacker methodologies, tools, and third-party trust relationships (plus feeding it into risk management and preventive controls) can stop the adversary from successfully gathering or exploiting network trust dependency information in many cases, but not all (e.g. passive OSINT exposure or unmodeled vectors remain).
T1590.004detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface the T1590.004 technique when it produces observable indicators, but this is limited to cases where intel sources capture it and does not broadly instrument or guarantee detection of topology gathering itself.
T1590.004prevents — A.5.7's threat-intelligence loop (collect/analyse/share into risk processes, preventive controls, and testing) supplies actionable insight that can block the adversary from successfully gathering or exploiting topology data, but only for the subset of instances that match known patterns or indicators; it does not stop novel, zero-day, or internal reconnaissance that falls outside the produced intelligence.
T1590.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface adversary IP-gathering activity when it triggers observables, but the control is primarily oriented toward strategic/tactical awareness and prevention rather than real-time detection of this specific pre-attack reconnaissance technique.
T1590.005prevents — Threat intelligence (strategic/tactical/operational) about attacker methodologies for gathering victim IP blocks, ranges, and derived details feeds directly into risk processes, preventive controls (firewalls, IDS, anti-malware), and testing that can block the reconnaissance technique from succeeding against the organization.
T1590.006detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface adversary reconnaissance for network security appliances, but this is limited to known indicators rather than all possible gathering activity on PRE platforms.
T1590.006prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, NIDS/firewall specifics) and its use as input to preventive controls (firewalls, IDS, anti-malware) and risk processes can stop adversaries from successfully gathering or acting on this recon data in many cases, but not comprehensively as it depends on sources, sharing, and downstream implementation.
T1591detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface T1591 activity when it matches known patterns or sources, but this is limited to a minority slice of the broad, passive/pre-attack reconnaissance technique that often leaves no detectable signal.
T1591prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, indicators) plus feeding it into risk management, preventive controls, and testing processes enables informed actions that stop adversaries from successfully gathering victim org details via exposed data sets or elicitation.
T1591.001detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls (e.g. IDS) can surface the reconnaissance technique when indicators appear in monitored sources, but this is scoped only to what the org has chosen to ingest and does not broadly instrument the many passive/public data exposures described.
T1591.001prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, specific TTPs, indicators) and its use as input to preventive controls and risk processes can inform actions that stop adversaries from successfully gathering physical location data via the described methods (e.g. blocking phishing vectors or hardening public data exposure), but this is indirect, depends on implementation, and leaves many passive OSINT avenues untouched.
T1591.002detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface T1591.002 activity when it matches known threat patterns, but this is limited to post-exposure detection of known patterns rather than reliably detecting novel or internal business-relationship gathering.
T1591.002prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, specific TTPs, indicators) and its use as input to preventive controls and risk processes can inform actions that stop adversaries from successfully gathering business-relationship data via phishing, open-source searches, or supply-chain vectors, but it is not a direct barrier and leaves many passive exposure paths untouched.
T1591.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls can surface adversary gathering of business-tempo details when those details appear in monitored sources or trigger anomalies, but this is limited to chosen scope and does not broadly instrument the many passive/public ways the technique can occur.
T1591.003prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, specific TTPs, indicators) and its use as input to preventive controls and risk processes can inform actions that stop adversaries from successfully gathering business-tempo details via the described methods, but the control is governance-oriented, does not mandate specific blocks on public data exposure or elicitation, and leaves many collection vectors unaddressed.
T1591.004detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface the reconnaissance technique when it matches known patterns or sources, but this is limited to cases where the intel already exists and the org has chosen to instrument for it.
T1591.004prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, specific TTPs, indicators) plus feeding it into risk management, preventive controls, and testing processes enables informed actions that can block or constrain the reconnaissance technique before it succeeds, but only for a minority slice (known patterns already surfaced in intel) rather than the dominant open-source/OSINT paths that remain available.
T1592detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface T1592 activity when indicators match known patterns, but this is limited to post-exposure known threats rather than all reconnaissance methods described.
T1592prevents — Threat intelligence activities explicitly include using gathered/analyzed data as input to technical preventive controls (firewalls, IDS, anti-malware) and risk management processes, which can block some pre-attack host-gathering vectors (e.g. via updated signatures or blocking known scanning/phishing sources), but leaves many passive, OSINT, and non-technical collection methods untouched.
T1592.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface hardware-recon activity when it produces observable indicators, but the control is scoped to threat-intel collection/analysis rather than mandating broad detection of the PRE technique itself.
T1592.001prevents — Threat intelligence on attacker methodologies, tools, and indicators (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware, testing) to block common reconnaissance paths such as active scanning or phishing for hardware details, but cannot stop all passive/open-source exposure of hardware information.
T1592.002detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (IDS, anti-malware) and risk/test processes can surface T1592.002 activity when it matches known patterns or indicators, but this is limited to post-exposure or known-threat cases rather than reliably detecting novel/undisclosed reconnaissance.
T1592.002prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used to feed preventive controls (firewalls, IDS, anti-malware, risk processes, testing) that can block the reconnaissance technique or its downstream exploitation paths before it succeeds.
T1592.003prevents — Threat intelligence activities explicitly include collecting/analyzing tactical and operational intel on attacker methodologies/tools (including firmware-related targeting) to facilitate informed preventive actions and feed risk management, tests, and technical controls, which can stop some pre-attack gathering but leaves open-ended public/OSINT vectors and non-actionable strategic layers as residual.
T1592.004detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface T1592.004 activity when it matches known indicators or patterns, but this is limited to cases with prior indicators rather than all reconnaissance of client configs.
T1592.004prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and technical preventive controls (firewalls, IDS, anti-malware) to block common collection paths such as scanning or malicious content, but does not stop passive exposure via public data sets or all reconnaissance vectors.
T1593detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface the adversary's open-web search activity when it matches known indicators or patterns, but this is limited to cases where prior intel exists and is not inherent to the technique itself.
T1593prevents — Threat intelligence activities explicitly include collecting/analyzing open-source data on attacker methodologies, tools, and specific attacks to facilitate informed preventive actions and feed technical controls, which can stop adversaries from successfully using open-web searches for victim info in many cases, but this is not a direct barrier and leaves real residual (e.g., novel or internal-only victim data).
T1593.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface social-media reconnaissance when it produces observable indicators, but the control is primarily about ingesting and sharing intel rather than real-time detection of the passive PRE technique itself.
T1593.001prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, indicators) plus feeding it into risk management, preventive controls, and testing processes enables informed actions that stop T1593.001 reconnaissance from occurring in many cases, but does not guarantee prevention as intel may be incomplete, untimely, or unacted upon.
T1593.002detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface search-engine reconnaissance when it produces observable indicators, but the control is scoped to known threats and does not broadly instrument or guarantee detection of this PRE technique.
T1593.002prevents — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker methodologies and indicators) plus its explicit use as input to preventive controls (firewalls/IDS/antimalware) and risk processes can block some search-engine reconnaissance paths when leaks are known and blocked, but does not stop adversaries from crafting queries against public/non-leaked victim data.
T1593.003detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface adversary searches of public code repositories when those searches produce observable indicators, but the control's emphasis is on collection/analysis for awareness and risk processes rather than real-time detection of the reconnaissance technique itself.
T1593.003prevents — Threat intelligence activities explicitly include using gathered information as input to technical preventive controls (firewalls, IDS, anti-malware) and risk management processes that can block or constrain the reconnaissance technique before it yields usable targeting data.
T1594detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS) and testing can surface the T1594 technique when indicators or patterns from prior instances are known and match, but this is limited to post-facto or scoped detection rather than reliably catching novel/pre-deployment searches on victim sites.
T1594prevents — Threat intelligence collection/analysis of attacker methodologies (tactical layer), indicators, and sources feeds risk processes, technical preventive controls, and testing that can block or remove the public info adversaries rely on for this PRE reconnaissance technique.
T1595detects — A.5.7's operational layer and use as input to detective controls (IDS, firewalls, anti-malware) and risk processes can surface active scanning in flight or in logs when it targets the organization, but the control's mechanism is upstream collection/analysis rather than direct observation and much of pre-compromise external scanning occurs outside monitored organizational scope
T1595prevents — Threat intelligence on attacker methodologies, tools, indicators and the threat landscape (tactical/operational layers) is explicitly used as input to tune preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block or deter the specific active scanning behaviors before they succeed.
T1595.001detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) plus its use as input to detective controls (IDS) and risk processes surfaces scanning of the organization's own IP blocks as observable anomalous reconnaissance.
T1595.001prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block or deter IP-block scanning before it succeeds.
T1595.002detects — A.5.7's operational layer and use as input to detective controls (IDS, firewalls, anti-malware) and risk processes can surface scanning activity once it reaches the organization's estate (e.g. inbound probes against banners/ports), but the technique occurs pre-compromise on external infrastructure or unaffiliated targets with no guaranteed internal vantage, leaving a large slice unseen.
T1595.002prevents — Threat intelligence (including tactical/operational layers on attacker methodologies, tools, and specific indicators) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block or preempt the reconnaissance technique before it succeeds.
T1595.003detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and testing can surface wordlist scanning activity or its artifacts, but this is limited to known patterns shared via intel sources rather than reliably catching novel/custom wordlists or all reconnaissance probes.
T1595.003prevents — Threat intelligence on attacker methodologies, tools (e.g. Dirb/GoBuster), wordlist patterns, and reconnaissance techniques can be fed into risk processes, preventive controls (firewalls/IDS), and testing to block or avoid the specific scanning activity before it succeeds.
T1596detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface the adversary's use of open technical database searches when those searches produce observable indicators that match known patterns, but this is limited to cases where indicators are already known and fed into monitoring rather than broadly detecting the reconnaissance technique itself.
T1596prevents — Threat intelligence activities explicitly include using gathered/analyzed data as input to technical preventive controls (firewalls, IDS, anti-malware) and risk management processes that can block or constrain the adversary's ability to successfully leverage open technical database information for targeting.
T1596.001prevents — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker methodologies, tools, TTPs and indicators) is explicitly used to feed preventive controls and risk processes that can block the reconnaissance technique before it succeeds, but this is only one slice of a broader awareness activity that does not itself stop DNS searches.
T1596.002prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (including public data sources like WHOIS) and its use as input to preventive controls can stop the reconnaissance technique from succeeding in many cases, but does not block public queries or all downstream uses.
T1596.003prevents — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker methodologies, tools, and indicators) plus feeding it into preventive controls and risk processes can block some certificate-data reconnaissance paths, but leaves the public nature of CA data and many passive lookup vectors unaddressed.
T1596.004prevents — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker methodologies, tools, misconfigs, and indicators) plus feeding it into risk management, preventive controls (firewalls/IDS/antimalware), and testing processes enables informed actions that can block the reconnaissance technique from succeeding or being leveraged, but only for a slice of cases where intel is relevant/actionable in time.
T1596.005detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface adversary use of public scan databases as part of the threat environment, but this is limited to known patterns rather than reliably catching novel or internal reconnaissance.
T1596.005prevents — Threat intelligence activities explicitly include collecting/analyzing external sources on attacker methodologies, tools, and specific attacks (tactical/operational layers) to feed risk management, preventive controls, and testing, which can inform actions that stop adversaries from successfully using public scan databases for targeting.
T1597.002prevents — A.5.7's collection/analysis of tactical/operational threat intel (including purchased data sources, dark web markets, and indicators) plus feeding it into risk management, preventive controls, and testing can inform actions that stop adversaries from successfully purchasing or leveraging such data against the organization.
T1598detects — A.5.7 collects/analyzes threat intel (incl. tactical/operational indicators and attacker methodologies) that can feed detective controls and risk processes, enabling detection of phishing-for-info campaigns or related TTPs; it does not itself perform detection and its scope is limited to relevant/actionable intel that the org elects to ingest.
T1598prevents — Threat intelligence (strategic/tactical/operational) that is relevant, insightful, contextual and actionable directly feeds risk management, preventive controls (firewalls/IDS/antimalware), and testing to stop phishing-for-info campaigns before they succeed; this is a genuine but minority slice because the control is awareness-oriented and does not itself block the social-engineering delivery, spoofing or evasion techniques.
T1598.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of spearphishing campaigns, but the control is primarily about upstream collection/analysis for awareness rather than real-time detection of the technique itself.
T1598.001prevents — Threat intelligence on attacker methodologies, tools, social engineering lures, and third-party service abuse (tactical/operational layers) is explicitly used to inform preventive controls, risk processes, and testing that can stop the technique from succeeding, but this is only one input among many and does not guarantee prevention.
T1598.002detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware) and risk processes, surface spearphishing lures and TTPs before or during delivery, though not every custom or zero-day variant is guaranteed to be caught.
T1598.002prevents — Threat intelligence on attacker methodologies, tools, lures, and indicators (tactical/operational layers) is explicitly used to update preventive controls, risk processes, and tests that can stop the spearphishing technique from succeeding; it does not eliminate the social-engineering delivery vector itself.
T1598.003detects — Threat intelligence activities explicitly include collecting/analyzing operational indicators (specific attacks, technical IOCs) and feeding them into detective controls (IDS, anti-malware) and security testing, which surfaces spearphishing link attempts before or during execution.
T1598.003prevents — Threat intelligence on attacker methodologies, tools (e.g. EvilProxy, BitB), indicators, and social-engineering lures directly feeds preventive controls, risk processes, and testing that stop many spearphishing-link campaigns from succeeding, but cannot block every novel or zero-day variant.
T1598.004detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface vishing indicators or patterns, but the control is primarily about upstream intelligence collection/analysis rather than real-time detection of the technique itself.
T1598.004prevents — Threat intelligence on attacker methodologies, tools (e.g. vishing, spoofing, callback pretexts), and indicators directly feeds preventive actions, risk processes, and tuning of technical/social controls that stop many vishing attempts from succeeding, but does not eliminate the social-engineering technique itself or all tailored instances.
T1599detects — A.5.7's operational layer and use as input to detective controls (IDS, firewalls, anti-malware) and risk processes can surface indicators of perimeter device compromise or anomalous boundary traffic, but this is scoped only to relevant/insightful intel that the org elects to ingest and does not broadly instrument or guarantee detection of the technique itself.
T1599prevents — Threat intelligence activities include feeding insights into preventive controls (firewalls, IDS, anti-malware, risk processes, testing) and sharing to improve overall awareness, which can inform configuration or monitoring that stops some boundary-bridging techniques from succeeding; it does not stop the compromise of the device itself or reconfiguration once access is obtained.
T1599.001detects — A.5.7's operational layer and use as input to detective controls (IDS, firewalls, anti-malware) and risk processes can surface indicators of NAT configuration changes or anomalous boundary traffic, but this is limited to selected relevant sources and does not guarantee detection of the technique itself.
T1599.001prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, firewalls, IDS, and tests to block or detect NAT modifications before they succeed, but this is indirect, depends on timely actionable intel, and leaves many residual cases (e.g., novel attacks, insider control of the device, or unmonitored designs) unaddressed.
T1600detects — A.5.7 collects/analyzes threat intel on attacker methodologies, tools, and specific attacks (including technical indicators) and feeds it into detective controls like IDS/anti-malware, which can surface T1600 behaviors such as modified images or disabled crypto hardware; this is limited to known indicators and does not guarantee detection of novel instances.
T1600prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk-management processes that can block the device-compromise behaviors (T1601, T1600.001, T1600.002) required for T1600, but it is only one indirect input among many and does not itself stop the technique.
T1600.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of reduced key-space changes on network devices, but this is scoped only to what the org elects to ingest and instrument rather than a mandated detection of the technique itself.
T1600.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk management, preventive controls (e.g. anti-malware, config baselines), and testing to stop the device compromise and config modification steps that enable T1600.001, but this is only a slice of the full technique surface (does not block all initial access, all network devices, or post-compromise execution).
T1600.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of hardware encryption being disabled on network devices, but this is only a slice of possible detections given the technique's specificity and reliance on device compromise already occurring.
T1601detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1601 indicators or anomalies post-modification, but the control is silent on detection depth for in-memory or boot-time firmware changes on embedded devices.
T1601.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of a modified network-device image or anomalous boot behavior, but the control is scoped to relevant threat intel sharing/analysis and does not mandate instrumentation that would reliably catch in-memory patching or bootloader-based live modification on network devices.
T1601.001prevents — Threat intelligence on attacker methodologies, tools, specific TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop the technique from executing, but this is only a slice of the monolithic network-device attack surface described.
T1601.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of downgrade activity (e.g. anomalous firmware/OS file fetches or version changes), but this is limited to a minority slice of the technique's post-exploitation indicators on network devices rather than broadly detecting the core method.
T1601.002prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware, testing) to block the download/reconfiguration steps of this technique on network devices.
T1602detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface T1602 activity when it matches known patterns, but this is limited to known threats and does not broadly detect novel or internal repository access.
T1602prevents — Threat intelligence on attacker methodologies, tools, TTPs and indicators (tactical/operational layers) can be fed into risk processes and preventive controls (firewalls, IDS, anti-malware) to block access paths or exfiltration, preventing the technique from succeeding in many cases, but does not eliminate all vectors such as insider access, zero-days or unmonitored protocols.
T1602.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface SNMP MIB queries as anomalous or known-bad activity, but this is scoped only to the subset of threat intel the org ingests and operationalizes rather than a dedicated or universal detection mechanism.
T1602.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware) and risk processes to block SNMP queries or harden MIB exposure before the technique runs, but this is only a slice of the class as many SNMP/MIB exposures arise from misconfiguration rather than known attacker patterns.
T1602.002detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface the specific TTP of SNMP/SMI-based config dumping when indicators are present, but this is scoped only to the subset of sources, analysis, and sharing the org actually ingests rather than a universal detection mechanism.
T1602.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs (operational layer), and feeding it into preventive controls (firewalls/IDS/antimalware) and risk processes can block the SNMP/SMI-based access paths and credential harvesting described, but leaves residual exposure on unmanaged devices, novel variants, or non-network-layer vectors.
T1606detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including forged credentials) and feeding them into detective controls like IDS/anti-malware as well as test processes, but this is scoped to relevant/insightful sources and does not broadly instrument or surface all forging techniques across every platform.
T1606prevents — Threat intelligence on attacker methodologies, tools, specific TTPs (including credential-forging techniques) and indicators can be fed into risk processes, preventive controls (firewalls/IDS/antimalware) and testing to stop the technique from succeeding in many cases, but does not eliminate the root capability to forge web credentials when secrets or privileged APIs are already available.
T1606.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of forged-cookie activity, but the control is primarily about upstream collection/analysis/sharing rather than mandating runtime detection mechanisms, leaving most in-flight technique instances outside its direct scope.
T1606.001prevents — Threat intelligence on attacker methodologies/tools for forging cookies (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. anti-malware, IDS), and testing to stop the technique from succeeding in many cases, but does not eliminate the root capability to forge standardized cookie values using secrets.
T1606.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of SAML forgery or anomalous token use, but this is scoped to chosen sources and does not guarantee detection of the technique itself.
T1606.002prevents — Threat intelligence on attacker methodologies, tools, indicators and landscape (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware, risk processes, testing) and can therefore stop the SAML-token-forging technique from succeeding in many realistic cases, but the control does not itself stop certificate compromise or token forgery and leaves a large remainder where intelligence is absent, untimely or not actioned.
T1608prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) can be fed into risk processes, preventive controls (firewalls, IDS, anti-malware), and testing to block many staging behaviors before they succeed, but the control only supplies awareness and does not itself stop the adversary from staging on purchased, compromised, or public infrastructure.
T1608.001detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface indicators of uploaded/staged malware on third-party repos or infrastructure, but this is limited to known IOCs post-upload and does not broadly detect the adversary's upload action itself across decentralized or blockchain-hosted cases.
T1608.001prevents — Threat intelligence on attacker methodologies, tools, upload techniques, and specific IOCs (tactical/operational layers) is explicitly used to feed preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can block the upload stage or downstream delivery/execution of the staged malware.
T1608.002detects — A.5.7's operational and tactical threat-intelligence collection, analysis, and sharing into risk-management, IDS/firewall/anti-malware tuning, and security testing processes can surface indicators of adversary tool-staging activity on infrastructure, but this is only one slice of a PRE technique whose core (acquiring, compromising, or using third-party hosting) is not instrumented by the control.
T1608.002prevents — Threat intelligence on attacker methodologies, tools, infrastructure staging patterns and indicators (tactical/operational layers) can be fed into risk processes, preventive controls and testing to block many upload paths, but the PRE technique occurs entirely outside the defended environment and some adversary workarounds (e.g. direct third-party downloads) remain unblocked.
T1608.003detects — A.5.7's operational threat intelligence layer (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface the certificate-install technique when indicators are known and ingested, but this is scoped only to the subset of cases where relevant intel exists and is actioned — not the technique in general.
T1608.004detects — A.5.7's collection/analysis/sharing of operational threat intelligence (specific attacks, technical indicators, attacker methodologies) and its use as input to detective controls like IDS can surface T1608.004 staging activity when observed in the wild, but the control is scoped to known/relevant threats and does not mandate instrumentation that would catch novel or internal preparation.
T1608.004prevents — Threat intelligence on attacker methodologies, tools, watering-hole patterns, malvertising, and infrastructure acquisition directly feeds risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop staging of drive-by resources before the technique runs.
T1608.005detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and testing can surface T1608.005 infrastructure/setup indicators, but this is limited to known patterns shared via intel sources and does not broadly detect novel/pre-deployment adversary link-target preparation on PRE platforms.
T1608.005prevents — Threat intelligence on attacker methodologies, tools, phishing infrastructure (domains, link shorteners, IPFS), and indicators directly feeds preventive controls and risk processes that can block or disrupt setup of link targets before the technique runs.
T1608.006detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface SEO poisoning indicators or related lures, but the control is primarily about awareness production rather than direct detection of the technique itself.
T1608.006prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, indicators) plus feeding it into preventive controls and risk processes can inform actions that block SEO poisoning lures before they succeed, but the control itself only supplies awareness and does not directly stop the adversary technique.
T1609detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of container admin abuse (e.g. anomalous kubectl/docker exec or kubelet API calls), but this is limited to selected relevant sources and does not guarantee detection of the technique itself.
T1609prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls, and testing to block common container admin abuse paths, but does not stop all instances (e.g. novel/zero-day abuse of legitimate admin interfaces with valid permissions).
T1610detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1610 indicators or anomalous container deployments, but this is scoped only to selected relevant sources and does not mandate broad detection coverage of the technique.
T1610prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific TTPs/indicators (operational layer), and feeding it into preventive controls and risk processes can stop some container-deployment techniques (e.g. blocking known malicious images or vulnerable configs), but leaves many others (novel images, legitimate deployment paths abused at runtime, or unknown bypasses) untouched.
T1611detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks (including container escapes) and feeding them into detective controls such as IDS or anti-malware, which surfaces some instances of T1611; this is limited to known patterns shared via intel sources and does not broadly instrument for novel escapes.
T1611prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into risk management/preventive controls (firewalls, IDS, anti-malware, testing) can inform configuration hardening, vulnerability patching, and detection rules that stop many documented container/VM escape paths before they succeed.
T1612detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the build activity or its indicators when threat intel is available, but the control is silent on real-time detection of the build API call itself and most of the technique's stealth lies in using vanilla base images.
T1612prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, image scanning) and risk processes to block the build-API abuse or the subsequent Deploy Container step in many but not all cases.
T1613detects — A.5.7's collection/analysis of tactical/operational threat intel (incl. attacker tools, TTPs, and indicators) can feed into detective controls and risk processes that surface container-discovery activity, but the control itself only produces awareness inputs and does not perform or guarantee detection.
T1614detects — Threat intelligence collection/analysis (including operational indicators and sharing) can surface T1614 when observed in the wild or via external sources, feeding into detective controls and risk processes, but the control does not itself instrument or monitor for the technique on-host.
T1614.001detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks and technical indicators) and its use as input to detective controls like IDS can surface the technique when indicators are known and relevant, but this is scoped only to what the org has chosen to ingest and instrument rather than a broad guarantee of detection.
T1614.001prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (including language checks to evade geo-targeted scrutiny) can be fed into risk processes, preventive controls, and testing to reduce the chance the discovery technique is ever executed successfully against the organization.
T1615detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and risk processes can surface Group Policy Discovery activity or its indicators when observed, but the control is scoped to threat-intel collection/analysis rather than mandating broad real-time detection of this reconnaissance technique.
T1619detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls like IDS can surface T1619-like enumeration, but this is limited to known indicators in monitored environments rather than reliably detecting novel or credentialed discovery attempts.
T1619prevents — Threat intelligence on attacker methodologies, tools, TTPs and specific IOCs (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. IAM policies, API gateways, monitoring rules) and testing to block the discovery technique in many realistic scenarios, but cannot prevent all instances because the API calls remain available to any authenticated principal and intelligence is inherently incomplete/lagging.
T1620detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface T1620's in-memory technique when indicators or anomalous behavior are collected/analyzed, but this is scoped by relevance and implementation choices rather than mandating coverage of reflective loading's evasion properties.
T1620prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into preventive controls (firewalls, IDS, anti-malware, testing) to block common reflective loading techniques before execution, but many fileless/in-memory variants remain unblocked as the control only informs rather than directly enforces prevention.
T1621detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, monitoring) and risk processes, can surface patterns of repeated MFA-push generation or fatigue campaigns as anomalous behavior, but this is indirect, depends on downstream implementation, and does not inherently detect the technique in all its forms or platforms.
T1621prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific indicators (operational) for MFA fatigue/push-bombardment can be fed into risk processes, preventive controls (e.g. rate-limiting login attempts), and testing to stop the technique from succeeding in many cases, but does not eliminate the underlying MFA request-generation vector itself.
T1622detects — A.5.7's core activities of collecting/analyzing relevant, insightful, contextual, and actionable threat intelligence (including tactical/operational layers on attacker tools, methodologies, and specific technical indicators) are used to feed detective controls and test processes that surface debugger-evasion techniques in malware analysis and monitoring.
T1622prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) is explicitly used as input to preventive technical controls and risk processes, which can stop debugger-evasion techniques from being introduced or succeeding in many cases, but does not guarantee prevention of all instances or variants.
T1647detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks and technical indicators) and feeds it into detective controls and test processes, which can surface plist-modification TTPs when observed or tested; it does not itself instrument or monitor for the technique.
T1648detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of serverless abuse (e.g. anomalous function creation/invocation or related TTPs), but this is scoped to selected relevant sources and does not broadly instrument or guarantee detection of the technique itself.
T1648prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) is explicitly used as input to technical preventive controls (firewalls, IDS, anti-malware) and risk-management processes that can block serverless abuse vectors before execution.
T1649detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of certificate theft/forgery attempts, but this is limited to known IOCs in monitored sources and does not broadly detect the technique's stealthy execution vectors like API abuse or golden ticket forging.
T1649prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific TTPs/indicators (operational) for stealing or forging certificates can be fed into risk processes, preventive controls (e.g. firewalls, anti-malware), and testing to stop the technique from succeeding in many cases, but does not eliminate the root causes such as enrollment rights, misconfigurations, or CA key protection.
T1650detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and risk processes, which can surface acquisition of access via broker networks or shared indicators, but this is scoped to relevant/insightful intel only and does not broadly instrument the PRE technique itself.
T1650prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies, access brokers, and indicators (plus feeding it into risk management, preventive controls, and testing) can inform actions that block acquisition of access via known broker networks or implants, but cannot stop all purchases or partnerships in the open market.
T1651detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of cloud admin command abuse, but this is limited to known IOCs in a minority slice of the technique's surface (e.g. specific tools or post-compromise patterns), not broad detection of administrative abuse or trusted-relationship pivots.
T1651prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. IAM, firewalls, anti-malware), and testing to block admin abuse paths and VM agent execution before the technique runs.
T1652detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the technique when it produces observable indicators, but the control is primarily about upstream collection/analysis/sharing rather than mandating detection of the discovery action itself.
T1653detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface power-setting abuse or related indicators, but this is only a slice of the broad technique (config changes, file deletion, cross-platform variants) and the control itself performs no detection.
T1654detects — A.5.7's operational and tactical threat intelligence layers, plus its explicit use as input to detective controls (IDS, anti-malware, SIEM) and risk processes, surface log-enumeration activity when it matches known adversary methodologies, tools (wevtutil, PowerShell, CollectGuestLogs), or real-time monitoring patterns, with the bounded remainder being novel/undocumented instances or environments lacking integrated detection feeds.
T1657detects — A.5.7's collection/analysis of operational/tactical threat intel (indicators, methodologies, specific attacks) plus feeding it into detective controls (IDS, anti-malware) and risk processes surfaces financial theft campaigns (ransomware extortion, BEC, etc.) in flight or as patterns, with the bounded remainder being purely internal undetected transfers or novel unshared TTPs.
T1657prevents — Threat intelligence on attacker methodologies, tools, indicators, and financial-theft campaigns (ransomware extortion, BEC, etc.) is explicitly used to feed risk-management processes, tune preventive controls (firewalls, IDS, anti-malware), and inform testing, thereby stopping some but not all instances of the technique from succeeding.
T1657responds — A.5.7 produces and distributes threat intelligence on attacker methodologies, specific attacks and indicators (tactical/operational layers) that is explicitly fed into incident response processes, technical detective controls and risk management, enabling containment/eradication once financial theft (ransomware extortion, BEC, etc.) is underway; mostly because the clause stops at producing/sharing intelligence rather than executing the response actions themselves.
T1659detects — A.5.7's operational and tactical layers plus its mandated use as input to detective controls (IDS, anti-malware) and risk processes surface the specific TTP, indicators and anomalous traffic patterns of content injection; the remainder is pre-compromise upstream ISP-level injection that never reaches monitored organizational channels.
T1659prevents — Threat intelligence on attacker methodologies, tools, upstream channel compromises (e.g. ISP-level), and specific TTPs can be fed into risk processes, preventive controls (firewalls/IDS/antimalware), and testing to stop many content-injection vectors before they succeed, but upstream/ISP-level compromises and certain traffic races remain outside full organizational prevention.
T1665detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware, etc.) surface indicators, methodologies and artifacts of hidden C2 infrastructure; the remainder is purely strategic or pre-compromise resource-development activity outside the organization's visibility.
T1665prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk processes that can block or take down identifiable C2 infrastructure before the hide/evasion technique succeeds.
T1666detects — A.5.7 requires collecting/analyzing threat intelligence (including operational indicators and attacker methodologies) and feeding it into detective controls and risk processes, which can surface T1666-like hierarchy modifications when known patterns or IOCs are available, but does not itself instrument or guarantee detection of novel or permission-based hierarchy changes.
T1666prevents — Threat intelligence on attacker methodologies, tools, TTPs, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood this hierarchy-modification technique is attempted or succeeds, but it does not stop the technique from being available to a sufficiently privileged adversary.
T1667detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware, monitoring) and risk processes, surface email-bombing patterns, indicators, and precursors before or while the flood occurs.
T1667prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into preventive controls (firewalls, IDS, anti-spam, signup-validation logic) and risk processes to stop the flooding technique from succeeding; this is explicitly listed in the control's guidance, but remains a slice because many email-bombing vectors (open relays, unmonitored lists, social precursors) sit outside what intelligence-driven preventive rules can block.
T1667responds — A.5.7 produces and shares threat intelligence that can feed into incident response processes and technical detective controls once email bombing is detected as an underway event, but the control itself stops at awareness production and does not perform containment or eradication.
T1669detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of Wi-Fi connection attempts or anomalies, but this is limited to known/analyzable TTPs and does not broadly instrument wireless proximity, dual-homed bridging, or post-connection sniffing.
T1669prevents — Threat intelligence on attacker methodologies, tools, TTPs, and indicators (tactical/operational layers) that feed risk management, preventive controls (e.g. firewalls, IDS, anti-malware), and testing can inform actions that block open Wi-Fi exploitation, credential misuse for secured networks, or dual-homed bridging, but cannot stop physical proximity attacks or all novel/unknown variants.
T1671detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface indicators of malicious OAuth integrations, but this is limited to known IOCs or anomalies and does not broadly detect novel or stealthy persistence via integrations.
T1671prevents — Threat intelligence on attacker methodologies, tools, and specific indicators (tactical/operational layers) can be fed into risk processes, preventive controls (e.g. app consent policies, MFA/token protections), and testing to stop the OAuth integration technique from succeeding in many cases, but the control itself only supplies awareness and does not mandate or enforce any blocking action.
T1673detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls (e.g. IDS) and risk processes can surface VM discovery attempts when they match known TTPs, but this is limited to recognized patterns rather than all instances of the technique.
T1673prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) can be fed into risk processes, preventive controls (e.g. firewalls/IDS), and testing to block common discovery paths or the initial access required for it, but does not stop all post-compromise enumeration techniques on diverse platforms.
T1674detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware) and test processes, can surface known input-injection TTPs or indicators after the fact, but the control itself only produces awareness and does not mandate or perform detection.
T1675detects — A.5.7's operational and tactical layers plus feeding into detective controls (IDS, anti-malware) and test processes can surface indicators of ESXi abuse, but the control is scoped to relevant/insightful intelligence sharing and risk-process integration rather than mandating specific detection coverage of this niche hypervisor technique.
T1675prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) for abusing ESXi/VMware Tools services can be fed into risk processes, preventive controls (e.g. firewalls, anti-malware), and testing to stop the technique from running, but this is only a slice of the full technique surface rather than comprehensive prevention.
T1677detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls like IDS can surface poisoned-pipeline activity once it occurs, but the control is silent on automated detection mechanisms for CI/CD-specific IOCs and the bulk of the technique's stealthy injection vectors sit outside routine threat-intel feeds.
T1677prevents — Threat intelligence on attacker methodologies/tools (tactical), specific TTPs/indicators (operational), and supply-chain patterns can be fed into risk processes, preventive controls, and testing to stop many poisoning vectors before they execute, but it does not block the class outright (e.g. novel or internal-repo attacks remain possible).
T1678detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and testing can surface time-based delay artifacts or anomalies, but the control is primarily about upstream intelligence collection/analysis rather than direct runtime detection of the technique.
T1678prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood of successful delay-execution techniques being introduced or bypassing detection.
T1679detects — A.5.7's operational and tactical layers plus its mandated use as input to IDS, anti-malware, and testing processes surface selective-exclusion artifacts or anomalies when they align with known threat intel, but the control is silent on real-time behavioral detection of the technique itself and many exclusions remain invisible without specific prior indicators.
T1680detects — A.5.7's threat-intelligence collection/analysis feeds into detective controls (IDS, anti-malware, testing) and risk processes that can surface the reconnaissance pattern, but the control itself only supplies inputs and does not perform or guarantee detection of T1680 executions.
T1681detects — A.5.7's collection/analysis/sharing of operational threat intelligence (specific attacks, indicators, actor methodologies) directly surfaces when adversaries perform T1681 reconnaissance on their own campaigns in vendor data, feeding risk processes and technical controls that can flag the activity.
T1681prevents — A.5.7's core purpose and outputs (collect/analyze/share relevant, insightful, actionable threat intel on attacker TTPs, indicators, and campaigns) directly feed risk management, preventive controls (firewalls/IDS/antimalware), and testing to enable informed actions that stop the reconnaissance technique from succeeding or recurring, but this is governance-level intel production rather than a technical barrier that universally blocks the PRE technique.
T1682detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, indicators) and its use as input to detective controls like IDS can surface the technique when it produces observable indicators, but the control's scope is limited to known/relevant threats and does not broadly instrument or guarantee detection of public AI queries.
T1682prevents — A.5.7's collection/analysis of tactical/operational threat intel (attacker methodologies, tools, TTPs) plus feeding it into risk management, preventive controls (firewalls/IDS/antimalware), and testing processes can inform blocks on public AI queries or related recon when those patterns are known and actionable, but this is only a slice of the broad PRE technique that also covers non-blockable public LLM access and synthesis of open data.
T1683prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (including AI-assisted content generation for social engineering/phishing) feeds risk management and updates to preventive controls, which can stop the technique from being viable against the organization; this is only a slice because the control is awareness-oriented, does not itself block content generation, and leaves many adversary-side execution paths untouched.
T1683.001prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (including AI-assisted content generation for phishing lures and social engineering) feeds risk processes and updates to preventive controls, which can stop the technique from succeeding in many cases, but does not eliminate the adversary's ability to manually create or commission such written content.
T1683.002detects — A.5.7's collection/analysis of operational threat intelligence (specific attacks, technical indicators) and its use as input to detective controls (e.g. IDS, anti-malware) and security testing can surface indicators of synthetic audio-visual content or its downstream use in phishing/social engineering, but this is limited to known patterns rather than reliably detecting novel or real-time deepfakes at scale.
T1683.002prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (incl. AI-generated deepfakes for phishing/social engineering) feeds risk processes and preventive controls to stop the technique from being used against the org; it does not block adversaries from creating the content itself.
T1684detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, indicators) and feeds it into detective controls and test processes, which can surface social engineering attempts in flight or in logs; partial because the clause's mechanism is upstream intelligence production rather than direct observation, many social-engineering deliveries (e.g. voice, in-person, or pre-compromise trust-building) leave no detectable artifact inside the organization's monitored estate, and relevance/context filters may exclude the technique entirely.
T1684prevents — A.5.7's collection/analysis of tactical/operational threat intel on attacker methodologies (including social engineering patterns, phishing, urgency/scare tactics) is explicitly used as input to preventive controls and risk processes that can stop the technique from succeeding, but this is only a slice of the broad human-targeted technique that also relies on non-technical trust manipulation not fully addressed by intel feeds.
T1684responds — A.5.7 produces and distributes actionable threat intelligence on attacker methodologies (tactical layer) and specific attacks (operational layer) that is fed into incident response, risk processes, and technical detective controls; this directly supports containment/eradication once a social-engineering event is underway, with the bounded remainder being pre-compromise influence attempts that never reach the organization’s estate.
T1684.001detects — A.5.7 collects/analyzes operational threat intelligence (specific attacks, indicators) and feeds it into detective controls (IDS, anti-malware) and risk processes, which can surface impersonation campaigns once observed; partial because the clause sets requirements for intelligence production rather than mandating detection coverage of all impersonation vectors (e.g. non-technical social engineering, novel TTPs, or pre-delivery reconnaissance) and detection ultimately depends on downstream controls' scope.
T1684.001prevents — Threat intelligence on attacker methodologies, tools, social engineering patterns, and specific TTPs (tactical/operational layers) can be fed into risk processes, awareness, email filters, and training to stop many impersonation campaigns from succeeding, but it does not block the technique outright (recon, infrastructure acquisition, or human-targeted persuasion can still occur).
T1684.001responds — A.5.7 produces and shares threat intelligence on attacker methodologies (tactical layer) and specific attacks (operational layer) that is fed into incident response processes, enabling containment/eradication once an impersonation campaign is underway, but the control itself performs no response actions.
T1684.002detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical) and specific attacks (operational) including indicators, then feeds it into detective controls and test processes, which can surface Email Spoofing attempts; it does not itself perform detection.
T1684.002prevents — Threat intelligence on attacker methodologies, tools (e.g. spoofing via weak DMARC), and specific TTPs can be fed into risk processes, email filtering rules, and preventive controls to stop the technique from succeeding, but the control itself only supplies awareness and does not directly enforce any preventive mechanism.
T1685detects — A.5.7's operational and tactical layers plus explicit use as input to IDS, anti-malware, and other detective controls surface tool-tampering and telemetry-disruption artifacts (e.g. killed EDR processes, altered ETW/Registry/Sysmon state, anomalous sensor behavior) once they occur, though strategic sharing and risk-process integration add coverage without changing the core detection verb.
T1685prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to strengthen preventive controls (firewalls, anti-malware, etc.) and risk processes, which can stop many instances of tool-tampering before they succeed, but does not guarantee prevention of the technique itself.
T1685.001detects — A.5.7 collects/analyzes relevant threat intel on attacker methodologies (tactical) and specific TTPs (operational) including log tampering, then feeds it into detective controls and risk processes, surfacing the technique when it matches known patterns; partial because intel is scoped to known/relevant threats and does not guarantee detection of novel variants or all instances.
T1685.001prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to block common disable/modify techniques before they succeed, but does not stop all instances (e.g., novel methods, privileged insiders, or unmonitored vectors).
T1685.002detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface anomalous disabling of cloud logging, but the control is primarily about ingesting and sharing intelligence rather than mandating detection mechanisms for this specific technique.
T1685.002prevents — Threat intelligence on attacker methodologies/tools (tactical) and specific TTPs/indicators (operational) can be fed into preventive controls (firewalls, IDS, anti-malware, risk processes) to block the permission abuse or configuration changes that enable T1685.002, but this is only a slice of the class since many instances rely on legitimate admin privileges that intelligence alone does not remove.
T1685.003detects — Threat intelligence activities include collecting/analyzing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware) and testing processes, which can surface this UI-spoofing TTP when it matches known patterns or indicators, but the control does not itself perform detection and many instances (novel, non-indicated, or post-tampering) remain undetected.
T1685.004detects — A.5.7 collects/analyses threat intel on attacker methodologies (tactical) and specific attacks (operational) including indicators, then feeds it into detective controls like IDS/anti-malware and test processes, which can surface attempts to disable/modify auditd but does not itself perform detection.
T1685.004prevents — Threat intelligence on attacker methodologies, tools, and specific TTPs (tactical/operational layers) can be fed into risk processes, preventive controls, and testing to reduce the likelihood this Linux audit-disable technique is ever successfully used.
T1685.005detects — A.5.7's operational layer and use as input to detective controls (IDS, anti-malware) and risk processes can surface the clearing technique when indicators are known and shared, but the control is silent on instrumentation depth or guaranteed coverage of log-clearing artifacts.
T1685.005prevents — Threat intelligence on attacker TTPs (tactical/operational layers) and feeding it into risk management, preventive controls, and testing processes can inform actions that block common log-clearing vectors before they succeed.
T1685.006detects — A.5.7 collects/analyzes threat intel on attacker methodologies (tactical) and specific attacks (operational) including indicators, then feeds it into detective controls and risk processes; this surfaces the T1685.006 technique when it matches known patterns but does not guarantee detection of every instance or novel variants.
T1686detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface firewall-tampering activity or related indicators, but the control is not scoped to detection itself and leaves most platform-specific behaviors (ESXi esxcli, Windows netsh, etc.) outside its direct reach.
T1686prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) is explicitly used as input to update preventive controls like firewalls, which can stop the disable/modify technique from succeeding when those updates occur before the attack.
T1686.001detects — A.5.7's operational and tactical layers plus its explicit use as input to detective controls (IDS, anti-malware) and risk processes can surface cloud firewall modifications after they occur, but the control is primarily about awareness production rather than real-time detection and does not mandate coverage of this specific IaaS technique.
T1686.001prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific indicators (operational layer) feeds risk processes, firewall/IDS rule tuning, and testing that can block the T1686.001 technique before it succeeds; this is genuine but only a slice because the control is awareness-oriented, does not itself enforce any rule, and many paths to cloud firewall modification (e.g., insider abuse of legitimate IAM) sit outside what intelligence can prevent.
T1686.002detects — A.5.7's operational and tactical layers plus its explicit use as input to IDS, anti-malware and test processes surface many firewall-tampering indicators and anomalies, but the control is silent on real-time detection coverage depth and does not reach every vector (e.g., indirect host-config manipulation or fully offline device changes).
T1686.002prevents — Threat intelligence on attacker methodologies/tools (tactical layer), specific indicators (operational layer), and integration into preventive controls (firewalls/IDS) and risk processes can inform actions that stop many instances of this technique from succeeding, but does not guarantee prevention of all cases (e.g., novel exploits or insider access).
T1686.003detects — A.5.7's operational layer and use as input to detective controls (e.g. IDS) and risk processes can surface the specific T1686.003 technique when indicators or anomalous firewall changes are collected/analyzed, but this is only a slice of the control's broader threat-intel scope rather than a dedicated detection mechanism.
T1686.003prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) is explicitly used as input to tune preventive technical controls such as firewalls, which can stop the adversary technique from succeeding; this is only a slice of the control's broader purpose and does not guarantee prevention in all cases or against all variants.
T1687detects — A.5.7's operational and tactical layers plus its explicit use as input to IDS, anti-malware, and test processes surface many exploitation attempts against defensive components, but the control stops at sharing/analyzing intel and does not itself instrument or guarantee detection of the technique in flight.
T1687prevents — Threat intelligence on attacker methodologies, tools, specific attacks and indicators (tactical/operational layers) is explicitly used as input to preventive technical controls (firewalls, IDS, anti-malware) and risk management, which can block the vulnerabilities or exploitation paths for T1687 before they succeed; this is a genuine but bounded slice because not all defensive-component vulns are known, shared, or mitigable via intel-driven prevention.
T1688detects — A.5.7 collects/analyzes/shares threat intel (including operational IOCs and attacker TTPs) that can feed detection tools and risk processes, but does not itself perform detection of T1688 executions.
T1688prevents — Threat intelligence on attacker methodologies/tools (tactical layer) and specific TTPs (operational layer) can be fed into risk processes, preventive controls (e.g. EDR/firewalls), and testing to block safe-mode abuse paths before they succeed.
T1689detects — A.5.7's operational and tactical threat intelligence layers, when fed into detective controls (IDS, anti-malware) and risk processes, can surface known downgrade patterns and indicators before or during execution, but this is scoped only to recognized threats and does not broadly detect novel or zero-day downgrade techniques.
T1689prevents — Threat intelligence on attacker methodologies, tools, downgrade patterns, and indicators (tactical/operational layers) is explicitly used to inform preventive controls, risk processes, and testing that can block known downgrade vectors before they succeed.
T1690detects — Threat intelligence activities include collecting/analysing operational indicators of specific attacks and feeding them into detective controls (IDS, anti-malware, etc.), which can surface the technique when it matches known TTPs or leaves detectable artifacts; this is limited to known patterns and does not guarantee detection of novel or in-memory variants.

Prevented OWASP Web Top 10 (2025) risks (12)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01→P A02→P A03→P A05→P A07←P →P A08→P A09→P

Why these map — AI rationale (under review)

A01mitigates — Threat intelligence feeds risk processes, technical controls (firewalls/IDS) and testing that can limit the blast radius or detect bypasses of authorization decisions, but does not change the authorization logic itself or bound most members (path traversal, IDOR, CSRF).
A02mitigates — Threat intelligence feeds risk processes, technical detective/preventive controls, and testing that can reduce the realized impact or blast radius of an exposed misconfiguration (e.g., by tuning IDS/firewalls or prioritizing scans), but does not itself limit or contain the weakness once present.
A03finds — A.5.7's analysis and integration of threat intelligence into risk processes and technical controls (e.g. IDS, anti-malware) can surface indicators of compromised supply-chain elements or known vulnerable dependencies after they are present, but this is only one slice of the broad A03 category (most supply-chain failures are found via scanning or code inspection, not threat intel).
A03mitigates — Threat intelligence feeds risk processes, technical detective/preventive controls, and testing that can bound the realized impact of a supply-chain compromise (e.g., via updated signatures or detection of anomalous builds), but does not itself limit consequences of an already-present vulnerable/outdated/compromised dependency or pipeline.
A05mitigates — Threat intelligence feeds risk processes, tuning of preventive/detective controls (firewalls, IDS, anti-malware), and testing, which can bound the blast radius or detect some injection payloads (esp. tactical/operational indicators), but does not limit the consequence of a realized injection that succeeds in-band.
A07mitigates — Threat intelligence feeds risk processes, technical controls (e.g. anti-malware, IDS) and testing that can limit the realized impact or blast radius of realized authentication failures (e.g. credential stuffing, session hijacking) without preventing the underlying identity-verification defects themselves.
A08mitigates — Threat intelligence supplies contextual awareness and indicators that can feed into detective/preventive controls (firewalls, IDS, anti-malware, testing) to limit the realized consequences of an integrity failure (e.g. detecting unsigned updates or anomalous CI/CD behavior), but does not itself bound or reduce the impact of every integrity-failure vector in the class.
A09finds — A.5.7's analysis and use of threat intelligence as input to detective controls (IDS, anti-malware) and security testing surfaces some logging/alerting failures when they match known threat patterns, but does not discover the absence of logging itself or most integrity failures.
A09mitigates — Threat intelligence feeds into detective controls (IDS, anti-malware, testing) and risk processes that can improve logging/alerting coverage or anomaly detection, thereby bounding the realized impact of undetected incidents without addressing the core absence of logging, alert firing, or log integrity.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.