Cyber Resilience

← ISO 27001 Annex A

A.6.3 People

Information security awareness, education and training

AttributesPreventive C·I·A Protect Human resource security Governance and Ecosystem

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (15)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AT-1←P AT-2←M →F AT-3←M →F AT-4←P AT-6←M PL-4←P

Why these map — AI rationale (under review)

AT-2fullcovers — The ISO control establishes a recurring, role-aware awareness program that directly fulfills the intent of AT-2 to ensure all users understand their security responsibilities.
AT-3fullcovers — By requiring targeted training for technical teams and skill-gap remediation, the ISO control satisfies AT-3’s mandate for role-based training aligned with job functions.
AT-4mostlyaligns with — The ISO control’s requirement to assess understanding after each activity supports the record-keeping and effectiveness-tracking objectives of AT-4.
PM-13partialaligns with — The ISO control’s emphasis on building and maintaining technical security skills across the workforce contributes to the broader workforce-development goal of PM-13.
AT-4covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PM-13covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (9)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

GV.RR-04→P ID.IM-01gov PR.AT-01gov PR.AT-02gov

Why these map — AI rationale (under review)

GV.RR-04mostlyaligns with — By embedding security awareness, education, and training into human-resources practices for new and transferring personnel, the ISO control supports the CSF outcome of integrating cybersecurity into HR processes.
GV.RR-04partialcovers — A.6.3's focus on awareness/education/training to fulfill security responsibilities accounts for the bulk of including cybersecurity in HR practices (onboarding, role-specific training, ongoing awareness), but leaves a residual of other HR practices (hiring screening, disciplinary processes, offboarding) that the control does not address.
ID.IM-01partialaligns with — The ISO control mandates post-activity assessments of personnel understanding and uses lessons learned from incidents to refine the programme, contributing to the CSF outcome of identifying improvements from evaluations.
PR.AT-01noneimplements — The ISO control establishes and operates a recurring awareness programme that ensures all personnel understand their security responsibilities and baseline controls, directly satisfying the CSF outcome of providing general awareness and training.
PR.AT-02noneimplements — The ISO control requires a targeted education and training plan for technical teams that need specialized skills, matching the CSF outcome of equipping individuals in specialized roles with the necessary knowledge and skills.
ID.IM-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.IM-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related weaknesses / CWE (9)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-200→P CWE-284→P CWE-356→P CWE-451←P →P CWE-522→P CWE-676→P CWE-732→P CWE-798→P

Why these map — AI rationale (under review)

CWE-200prevents — Awareness of data-handling obligations and incident-reporting procedures reduces the chance that staff will inadvertently disclose sensitive information.
CWE-284prevents — Personnel who understand their responsibilities and the baseline controls they must follow are less likely to grant or exercise access rights beyond what policy permits.
CWE-356prevents — Security awareness training can teach users to heed or demand warnings for unsafe actions.
CWE-451prevents — Security awareness training can teach users to recognize UI misrepresentation and phishing attempts.
CWE-522prevents — Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
CWE-676prevents — Developer security awareness training can teach safe alternatives to risky functions.
CWE-732prevents — Training on baseline controls and policy compliance helps staff avoid assigning overly permissive file or resource permissions that expose assets to unauthorized actors.
CWE-798prevents — Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.

Mitigated MITRE ATT&CK techniques (712)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.001←M T1001.002←M T1001.003←M T1003→P T1003.001→P T1003.002→P T1003.003→P T1003.005→P T1003.006→P T1003.008→P T1006←M T1010→P T1012→P T1014←M T1016.002→P T1020→P T1021→P T1021.001→P T1021.002→P T1021.003→P T1021.004→P T1021.005→P T1021.006→P T1021.007→P T1021.008→P T1027→P T1027.001←M T1027.002←M T1027.003→P T1027.004→P T1027.005←M T1027.006←M T1027.007←M T1027.008←M T1027.009←M T1027.010←M →P T1027.011←M T1027.014←M T1027.015→P T1027.016←M T1027.017→P T1027.018←M →P T1030←M T1036←M →P T1036.002→P T1036.003←M T1036.005←M T1036.006←M →P T1036.007←M →P T1036.008←M →P T1036.009←M T1036.010→P T1036.012←M T1037→P T1037.001→P T1037.002→P T1037.003→P T1037.004→P T1037.005→P T1040→P T1046→P T1047→P T1048→P T1048.001→P T1049→P T1052→P T1052.001→P T1053.002→P T1053.006→P T1055←M →P T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M T1055.005←M T1055.008←M →P T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1056→P T1056.001→P T1056.002→P T1056.004→P T1057→P T1059→P T1059.001→P T1059.002→P T1059.003→P T1059.004→P T1059.005→P T1059.006→P T1059.007→P T1059.008→P T1059.010→P T1059.011→P T1059.013→P T1068←M →P T1069→P T1069.003→P T1070←M T1070.008→P T1070.010←M T1071←M T1071.001←M T1071.004←M →P T1072→P T1074.001→P T1078→P T1078.001←P →P T1078.002→P T1078.003→P T1078.004→P T1080→P T1083→P T1087.003→P T1087.004→P T1090←M T1090.002←M T1090.003←M T1090.004←M T1091→P T1095←M T1098→P T1098.001→P T1098.002→P T1098.003→P T1098.004→P T1098.005←M →P T1098.006→P T1098.007→P T1102←M T1102.001→P T1102.002→P T1110→P T1110.001→M T1110.002→P T1110.003→P T1110.004→P T1111←M →P T1114→P T1114.001→P T1114.002→P T1114.003→P T1125→P T1127←M T1127.001←M →P T1127.002→P T1127.003←P T1129→P T1132←M T1132.001←M →P T1132.002←M T1133←M →P T1134←M T1134.003←M →P T1134.004←M T1136→P T1136.003→P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1140→P T1176→P T1176.001→P T1176.002→P T1185←M →P T1187→P T1189→P T1190→P T1195→P T1195.001→P T1197→P T1199→P T1201→P T1202←M T1203←P →P T1204→P T1204.001→P T1204.002→P T1204.003←P →P T1204.004→P T1204.005←P →P T1205.001→P T1205.002→P T1207←M T1210→P T1211←M T1212→P T1213→P T1213.001→P T1213.002→P T1213.003→P T1213.005→P T1216←M T1216.002→P T1218←M T1218.001→P T1218.002→P T1218.003→P T1218.004→P T1218.005←M →P T1218.007←M T1218.008←M →P T1218.009→P T1218.010←M T1218.011←M T1218.012→P T1218.013←M T1218.014→P T1219→P T1219.001→P T1219.002→P T1220→P T1221←M →P T1222←M T1222.001←M →P T1222.002←M T1480.001←M T1484←M →P T1484.001→P T1484.002←M T1485→P T1486→M T1491.001→P T1496→P T1496.001→P T1496.002→P T1496.003→P T1496.004→P T1497←M T1498.002→P T1499→P T1499.002→P T1499.003→P T1499.004→P T1505.002→P T1505.003→P T1518.001→P T1528→P T1529→P T1530→P T1531→P T1534→P T1535←M →P T1537←M T1538→P T1539←F →P T1542←M T1542.002←M T1543→P T1543.002→P T1543.003→P T1543.005→P T1546→P T1546.001→P T1546.002→P T1546.003→P T1546.004→P T1546.005→P T1546.007→P T1546.009→P T1546.012←P →P T1546.013→P T1546.015→P T1546.016→P T1546.017→P T1547.001→P T1547.002→P T1547.003→P T1547.004→P T1547.005→P T1547.006→P T1547.007→P T1547.010→P T1547.012→P T1547.014→P T1547.015→P T1548.002←M →P T1548.003→P T1548.004→P T1548.005→P T1548.006←M →P T1550←M →P T1550.001←F →P T1550.002←F T1550.003←F T1550.004←F →P T1552.001→P T1552.003→P T1552.004→P T1552.005→P T1552.006→P T1552.007→P T1552.008→P T1553→P T1553.001←M T1553.002←P T1553.003←M T1553.004←M →P T1553.005←M T1553.006←M →P T1555→P T1555.003→P T1555.004→P T1555.005→P T1555.006→P T1556←M →P T1556.001←M T1556.002→P T1556.005→P T1556.006←M T1556.007←M →P T1556.008→P T1556.009←M →P T1557.001→P T1557.002→P T1557.004←P →P T1558→P T1558.003→P T1558.004→P T1558.005→P T1559.002→P T1563→P T1563.001→P T1563.002→P T1564←M T1564.002→P T1564.003→P T1564.004←M T1564.008→P T1565→P T1565.002→P T1566→P T1566.001→P T1566.002→P T1566.003→P T1566.004→P T1567→P T1567.001→P T1567.002→P T1567.003→P T1567.004→P T1568←M T1568.002→P T1569→P T1569.002→P T1569.003→P T1571←M →P T1572←M →P T1574←M →P T1574.001←M →P T1574.004←M T1574.005→P T1574.006→P T1574.008→P T1574.009→P T1574.011→P T1574.013←M T1578←M T1578.001←M T1578.002←M T1578.003←M T1578.004←M T1578.005←M T1583.001→P T1583.008→P T1584.001→P T1585.001←M T1586→P T1586.001→P T1586.002←P →P T1586.003→P T1588.005→P T1588.007→P T1589→P T1589.001→P T1589.003→P T1590.003→P T1591→P T1591.002→P T1591.003→P T1591.004→P T1593→P T1593.001→P T1593.002→P T1593.003→P T1598→P T1598.001→P T1598.002→P T1598.003→P T1598.004→P T1599←M →P T1599.001←M T1601.002←M T1602.001→P T1602.002→P T1606.001←F T1606.002←M T1608.004→P T1608.005←P →P T1612←P T1613→P T1619→P T1620←M T1621→P T1647←P T1649→P T1651→P T1653←P T1657→P T1665→P T1666←M T1667→P T1671→P T1673→P T1677→P T1678←M T1683←M →P T1683.001←M →P T1683.002←M →P T1684→P T1684.001→P T1684.002←M →P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M T1685.004←M T1685.005←M →P T1686←F T1686.001→P T1686.003←M T1688←M

Why these map — AI rationale (under review)

T1003detects — awareness/education/training on recognizing and reporting suspicious activity (e.g. via 6.8 event reporting) can surface credential-dumping attempts after the fact, but the control's scope is limited to human knowledge transfer and does not instrument or monitor systems itself
T1003prevents — awareness, education and training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls (e.g. password security) can stop some credential-dumping techniques from being attempted or succeeding, but leaves the dominant technical methods (memory scraping, LSASS access, keychain dumping) untouched
T1003.001detects — awareness/education/training on recognizing and reporting security events (including anomalous credential access attempts) can surface some instances of this technique after the fact, but the control has no instrumentation, monitoring or detection capability and reaches only the human slice of a largely technical attack
T1003.001prevents — awareness, education and training on responsibilities, incident lessons, baseline controls (e.g. password security) and secure configuration can stop some LSASS dumping vectors (especially SSP registry changes or poor credential hygiene) but leaves the dominant in-memory dumping techniques by admin/SYSTEM untouched
T1003.002detects — awareness training on recognizing and reporting security events (including anomalous credential access attempts) can surface some instances of this technique after the fact, but the control's focus is on personnel knowledge and behavior rather than technical detection mechanisms
T1003.002prevents — awareness, education and training on responsibilities, incident lessons, password security and event reporting can reduce the chance an insider enables or performs SAM extraction, but does not stop a SYSTEM-level adversary technique once privileges are obtained
T1003.003prevents — awareness, education and training on responsibilities, incident lessons, password security, event reporting and technical skills can reduce the likelihood an insider or poorly trained admin enables or performs this credential-access technique, but does not stop a determined adversary who already has the needed privileges or exploits a misconfiguration
T1003.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security configurations can reduce the likelihood that cached domain credential stores are left accessible or extractable, but does not stop the technique when an adversary already has SYSTEM/sudo access
T1003.006detects — A.6.3's awareness/education programme can surface anomalous behaviour or incidents (e.g. via event reporting training in 6.8) that may indicate a DCSync attempt, but this is indirect, scope-limited by organisational requirements, and does not mandate technical detection of the technique itself.
T1003.006prevents — awareness/education/training on responsibilities, policies, incident lessons, password security and event reporting lowers the chance privileged users will enable or overlook the DCSync prerequisites (e.g. excessive group membership, poor credential hygiene), but does not stop the technique itself once those privileges exist
T1003.008detects — awareness/education/training can surface anomalous behaviors or incidents involving credential dumping (e.g. via event reporting in the programme), but only as an indirect, human-dependent slice rather than systematic detection of the technique
T1003.008prevents — awareness, education and training on responsibilities, password security, incident reporting and role-specific technical skills can stop some personnel from enabling or performing this technique, but cannot prevent a privileged adversary (or malware) that already has root or equivalent access from dumping the files
T1010detects — awareness/education/training on recognizing and reporting suspicious activity (including anomalous enumeration or security-tool discovery) can surface T1010 when performed by personnel, but the control has no instrumentation, monitoring, or detection capability of its own and reaches only the human-observable slice
T1012detects — awareness/education/training on security responsibilities, incident reporting, and baseline controls can surface anomalous registry queries when users or technical staff notice and report them, but this is limited to observable human-detectable cases and does not systematically detect the technique itself
T1016.002detects — awareness/education/training can surface anomalous Wi-Fi discovery behaviors (e.g. via incident reporting in the curriculum) when performed by personnel, but the control has no instrumentation or monitoring component and reaches only the human slice of an automated or scripted technique
T1016.002prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security) and incident lessons can reduce the chance an insider or user action enables the initial compromise that lets the technique run, but does not stop a post-compromise adversary from executing discovery commands on a Linux/Windows/macOS host
T1020detects — awareness/education/training on recognizing and reporting security events (including anomalous data transfers) can surface automated exfiltration when personnel notice it, but the control is scoped to human knowledge transfer and does not instrument or monitor for the technique itself
T1021detects — A.6.3 awareness/education/training can surface anomalous remote-login behaviors when built on lessons from prior incidents and includes reporting procedures, but this is indirect, human-dependent, and limited to what trained personnel notice and report rather than systematic technical detection of the technique.
T1021prevents — awareness, education and training on responsibilities, policies, incident lessons, password security and basic procedures can stop some misuse of valid accounts for remote service logins (e.g. via better credential hygiene or not falling for phishing), but leaves the dominant technical vectors (credential theft, domain compromise, protocol abuse) untouched
T1021.001detects — A.6.3's awareness/education programme (built on lessons from prior incidents and covering event reporting) can surface anomalous RDP usage by trained personnel, but this is limited to human observation rather than systematic technical detection of the technique.
T1021.001prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and technical configuration skills lowers the chance that valid accounts are obtained or that RDP is left enabled/accessible, but does not stop the technique when credentials already exist or misconfigurations remain
T1021.002detects — awareness/education/training on recognizing and reporting anomalous behavior or security events (e.g. via 6.8 event reporting) can surface suspicious SMB/admin share usage after the fact, but only for personnel who notice and act on it
T1021.003detects — awareness/education/training on recognizing and reporting suspicious security events (including anomalous remote activity) can surface DCOM lateral movement when users or technical staff notice or are trained to report it, but this is indirect, post-facto, and depends on human observation rather than systematic detection
T1021.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can reduce the likelihood of credential compromise or SSH misconfiguration that enables the technique, but does not stop an adversary who already holds valid accounts from using them
T1021.005detects — A.6.3's awareness/education programme can surface anomalous VNC usage (e.g. via incident reporting in its baseline controls or lessons-learned from events) when it reaches personnel who notice or are trained to report it, but this is indirect, human-dependent, and not a systematic detection mechanism.
T1021.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical configuration skills can stop some valid-account VNC abuse and misconfigurations but leaves the dominant technique (using already-compromised legitimate credentials) untouched
T1021.006detects — A.6.3's awareness/education programme can surface anomalous use of WinRM (e.g. via incident reporting in awareness materials or trained staff recognizing suspicious remote activity), but this is limited to human observation and does not systematically instrument or detect the technique itself.
T1021.006prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, basic procedures (e.g. event reporting) and password security lowers the chance valid accounts are obtained or misused via WinRM, but does not stop the technique when accounts are already compromised or when technical configuration gaps remain
T1021.007prevents — awareness, education and training on responsibilities, policies, incident lessons, password security, and technical skills for maintaining security configurations can reduce the likelihood of credential compromise or misconfiguration that enables T1021.007, but does not stop the technique when valid accounts are already available
T1021.008prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can reduce the likelihood of credential compromise or misuse that enables this technique, but does not stop the technique itself when valid accounts or misconfigurations already exist
T1027prevents — awareness/training on responsibilities, baseline controls (e.g. password security), and recognizing/reporting suspicious content or events can stop users from opening or executing obfuscated payloads that require user action, but does not stop adversary obfuscation techniques themselves or non-user-triggered cases
T1027.003detects — awareness/education/training on recognizing suspicious content, incident reporting, and technical skills for security teams can surface steganography use after the fact when it manifests in observable anomalies or known patterns, but the control does not mandate or perform detection itself and leaves the large majority of technical hiding techniques unreached
T1027.004detects — awareness/education/training on recognizing suspicious files, reporting events, and secure practices can surface some instances of delivered uncompiled source code (especially when tied to phishing or anomalous behavior), but does not systematically detect the technique itself
T1027.010prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can reduce the likelihood that personnel (or supplied personnel) will introduce or tolerate command obfuscation in delivered payloads, scripts, or interactive interpreters, but does not stop adversaries from using it themselves
T1027.015prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and recognizing suspicious attachments or self-extracting archives can stop users from extracting/launching compressed malicious payloads, but cannot stop adversary-side compression, concatenation, or fileless registry techniques
T1027.017detects — awareness training can surface anomalous SVG behaviors or incidents for reporting (per 6.8), but the control's focus is on personnel knowledge and does not mandate or perform technical detection of the technique
T1027.017prevents — awareness training on responsibilities, policy compliance, basic procedures (e.g. event reporting), and recognizing suspicious content can reduce the likelihood users introduce or fall for SVG-smuggled payloads, but does not stop adversaries from crafting or delivering the technique itself
T1027.018prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel introduce or overlook invisible Unicode concealment in scripts/files they create or review, but does not stop adversaries from applying the technique
T1036prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that users or admins fall for or enable masquerading tricks, but does not stop adversaries from performing the technique itself
T1036.002detects — awareness training on basic procedures, incident lessons, and recognizing social-engineering tricks (including disguised/malicious files) surfaces the RTLO technique for aware users and defenders, but the control does not instrument or monitor for the character itself and leaves unaware or non-trained personnel outside its reach
T1036.002prevents — awareness training on recognizing social-engineering tricks, anomalous file names, and basic security procedures (including lessons from incidents) lowers the chance users or defenders will be fooled by an RTLO disguise and execute the file, but does not stop the adversary from embedding the character or remove the technique itself
T1036.006detects — awareness training on recognizing suspicious file names/behaviors and reporting incidents can surface this technique when users notice or are taught to spot it, but the control does not mandate or perform any technical detection
T1036.006prevents — awareness training on basic procedures, personal accountability, and recognizing suspicious file behaviors (built on incident lessons) can stop users from double-clicking the disguised executable, but does not remove the OS-level technique itself
T1036.007prevents — awareness training on recognizing social-engineering lures, email attachments, and basic security procedures (including file-type risks) lowers the chance users will open a double-extension payload, but does not stop the technique from being executed or the file from being delivered
T1036.008prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration can reduce the chance users or admins introduce or accept masqueraded files, but does not stop adversaries from performing the technique itself
T1036.010prevents — awareness/training on responsibilities, policy compliance, basic procedures and recognizing suspicious account activity (built on incident lessons) can stop personnel from accepting/using the masqueraded account, but does not stop the adversary technique of creating or renaming it
T1037detects — awareness/education/training on recognizing anomalous scripts, reporting events (6.8), and keeping technical skills current can surface suspicious boot/logon initialization activity after the fact, but this is a minority slice of the technique's surface (most instances are not caught by human observation or training-driven detection)
T1037prevents — awareness/education/training on responsibilities, procedures and baseline controls (e.g. password security, event reporting) can stop personnel from introducing or tolerating malicious boot/logon scripts, but does not stop an already-privileged adversary from deploying them
T1037.001detects — awareness/education/training surfaces anomalous logon-script behavior to personnel who can then report it (6.8), but the control itself performs no instrumentation, monitoring or automated detection of the technique
T1037.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security) and incident lessons can reduce the chance users/admins introduce or tolerate malicious logon scripts, but does not stop the registry modification technique itself
T1037.002detects — A.6.3's awareness/education programme can surface anomalous login-hook modifications when built on lessons from prior incidents and when training covers baseline controls and event reporting, but this is limited to human observation rather than systematic detection and does not address the deprecated technique in modern macOS
T1037.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance an authorized admin introduces or tolerates a malicious login hook, but does not stop the technique itself
T1037.003detects — A.6.3's awareness/education programme can surface anomalous logon-script behaviours when built on lessons from prior incidents and includes reporting procedures, but this is limited to human observation rather than systematic technical detection of the technique.
T1037.003prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline procedures (incl. event reporting) can stop users/admins from deploying or tolerating malicious logon scripts, but does not block the technique when an adversary already has the necessary privileges to set the script via AD/GPO
T1037.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the odds an authorized insider (admin) introduces a malicious RC modification, but does not stop the root-privilege technique itself or block non-malicious misconfigurations
T1037.005detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (including event reporting) can surface anomalous startup-item creation or execution after the fact when users or admins notice and report it, but this is a narrow, human-dependent slice of the persistence technique
T1037.005prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance an insider or admin introduces or tolerates a malicious startup item, but does not stop an adversary who already has the privileges to create the required files at /Library/StartupItems
T1040prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can prevent the insecure unencrypted protocols and misconfigurations that make sniffed credentials or configuration data useful, but does not stop the passive capture technique itself on any listed platform
T1046detects — A.6.3 awareness/education/training can surface anomalous discovery activity via trained personnel recognizing and reporting it (e.g. via 6.8 event reporting), but this is indirect, human-dependent, and limited to observable behaviors rather than automated or comprehensive detection of the technique.
T1047detects — awareness/education/training on recognizing and reporting suspicious activity (including anomalous use of admin features like WMI) can surface the technique when performed by personnel, but the control does not mandate or implement any technical detection mechanism
T1047prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the likelihood that personnel enable or fail to block WMI abuse, but does not stop a determined adversary from abusing the built-in feature via scripting or APIs
T1048detects — awareness/education/training on recognizing and reporting anomalous behaviors or incidents (including exfiltration) can surface the technique when performed by personnel, but this is limited to human-observable cases and does not instrument or detect the network activity itself
T1048prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security, event reporting), and policy compliance can lower the chance an insider enables or performs this exfiltration technique, but does not stop the code-level or configuration defect that permits it
T1048.001detects — awareness/education/training on recognizing and reporting anomalous exfiltration behaviors (e.g. via incident reporting in the awareness programme) can surface the technique after it runs, but only for personnel who notice it and the control does not instrument or monitor networks itself
T1049detects — awareness/education/training on responsibilities, incident reporting, and recognizing anomalous behaviors can surface knowledge of network-discovery activity after it occurs, but the control is governance-oriented, does not mandate instrumentation or monitoring, and reaches only a minority slice of the technique's surface (human factors, not technical detection across all listed platforms and tools)
T1052detects — awareness/training on responsibilities, incident reporting, and baseline controls (e.g. removable media handling) can surface observable user behaviors or events tied to physical exfiltration, but this is limited to human-detectable slices and does not instrument or surface the technique itself
T1052prevents — awareness/training on responsibilities, baseline controls (e.g. 5.17 password security), incident lessons, and physical-medium handling reduces the chance users will introduce or use removable media for exfiltration, but does not stop a determined adversary or remove the technique's feasibility in air-gapped scenarios
T1052.001detects — A.6.3's awareness/education programme (built on lessons from incidents, covering event reporting and baseline controls) can surface anomalous USB usage or exfiltration indicators to trained personnel, but only as a human-facing slice with no instrumentation or automated detection required by the control.
T1052.001prevents — awareness/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls (e.g. password security) can reduce the likelihood of users introducing USB devices for exfiltration in air-gapped scenarios, but does not stop a determined adversary or technically capable insider from using removable media
T1053.002detects — awareness/training on recognizing and reporting suspicious scheduled tasks or anomalous at usage can surface the technique after it runs, but the control is governance-oriented and does not mandate or implement any detection mechanism
T1053.006detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous systemd timer creation or use when personnel notice and report it, but this is limited to human observation of a narrow slice and does not instrument or systematically detect the technique
T1055detects — awareness/education/training on recognizing and reporting security events (including anomalous process behavior) can surface some instances of process injection after the fact, but the control is scoped to personnel knowledge transfer rather than any systematic detection mechanism
T1055.001detects — awareness/education/training on recognizing anomalous behaviors or reporting security events can surface some in-flight or post-injection indicators (e.g. via user vigilance or admin training), but the control has no instrumentation, telemetry, or monitoring component and reaches only a narrow human slice of the technique
T1055.002detects — A.6.3 awareness/education/training on recognizing and reporting security events (including anomalous process behavior) can surface PE injection when personnel notice or are trained to report it, but this is limited to human-observable indicators and does not instrument or detect the technique at scale.
T1055.003detects — awareness/training on recognizing and reporting security events (including anomalous process behavior) can surface some instances of thread hijacking after the fact, but the control does not mandate or implement any detection mechanisms
T1055.003prevents — awareness, education and training on responsibilities, procedures, incident lessons, and secure configuration skills can reduce the likelihood that personnel (or suppliers) will introduce or permit the conditions that enable thread execution hijacking, but does not stop a determined adversary from performing the technique
T1055.008detects — awareness/education/training on security responsibilities, incident reporting, and technical skills can surface anomalous ptrace usage or injection attempts when personnel notice or are trained to monitor for it, but this is indirect, human-dependent, and does not systematically detect the technique itself
T1056detects — awareness training can surface anomalous input-capture behaviors when users are taught to recognize and report suspicious credential prompts or phishing-like interfaces, but the control itself only equips humans to notice and does not instrument any technical detection
T1056prevents — awareness training on responsibilities, basic procedures (e.g. event reporting, password security), and recognizing deceptive input prompts lowers the chance users fall for phishing-style or social-engineering slices of input capture, but cannot stop transparent technical mechanisms such as API hooking or keyloggers that require no user action or awareness
T1056.001detects — awareness/education/training on recognizing suspicious behavior, reporting events (6.8), and keeping technical skills current can surface keylogging indicators after the fact, but this is a minority slice of the technique's many implementation methods and does not systematically detect it
T1056.001prevents — awareness/education/training on responsibilities, procedures (e.g. event reporting, password security) and lessons from incidents can prevent some user behaviors that enable keylogging (e.g. falling for delivery vectors or failing to report anomalies), but does not stop the technical implementation methods (API hooks, drivers, registry mods, hardware reads) once the adversary is on the system
T1056.002detects — awareness training on recognizing suspicious credential prompts (via incidents, reporting, and education) can surface the technique when users notice and report it, but the control does not instrument or monitor for the technique itself
T1056.002prevents — awareness training on recognizing spoofed credential prompts, reporting suspicious dialogs, and understanding personal accountability lowers the chance users will fall for the mimicked GUI technique, but does not stop adversaries from executing it
T1056.004detects — awareness/education/training on recognizing suspicious behavior, reporting events (6.8), and keeping technical skills current can surface some hooking attempts (esp. via anomalies or known patterns), but does not systematically detect the low-level API/system-function hooking technique itself
T1057detects — awareness/education/training can surface anomalous process-discovery behaviors when they violate policy or when personnel are trained to recognize and report them (e.g. via event reporting in 6.8), but this is limited to human-observable cases and does not instrument or detect the technique at scale
T1057prevents — awareness/training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can reduce the likelihood an insider or social-engineered user enables or performs process discovery, but does not stop an external adversary from executing the technique via cmd, PowerShell, ps, /proc or native APIs once initial access is obtained
T1059prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can constrain some abuse of interpreters (e.g. via policy-mandated restrictions or reduced social-engineering success) but leaves the dominant technical abuse surface (built-in interpreters required by the platform) untouched, matching the cm-7 vs T1059 anchor
T1059.001detects — A.6.3 awareness/education/training can surface anomalous PowerShell usage via trained personnel recognizing and reporting suspicious activity (e.g. via event reporting in the curriculum), but this is indirect, human-dependent, and not a systematic detection mechanism.
T1059.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel enable or introduce opportunities for PowerShell abuse, but does not stop the technique itself when an adversary (or compromised account) runs it
T1059.002detects — awareness/training on recognizing/reporting suspicious scripts or behaviors (e.g. via 6.8 event reporting) can surface AppleScript abuse after the fact, but the control's scope is limited to human knowledge transfer and does not instrument or monitor for the technique itself
T1059.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can reduce the likelihood that users or admins enable or fall for AppleScript abuse vectors (e.g. via social engineering, misconfigured Mail/Automator rules, or unpatched execution paths), but cannot stop an adversary who already has code execution from directly invoking osascript/NSAppleScript
T1059.003detects — awareness/education/training on recognizing and reporting suspicious command-line activity or anomalous use of cmd.exe can surface the technique when performed by personnel, but this is limited to human-observable cases and does not instrument or detect the technique at scale
T1059.003prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills can stop some misuse of cmd.exe (especially by insiders or via poor configs) but leaves the dominant adversary-abuse path (post-compromise remote/local execution with legitimate privileges) untouched
T1059.004detects — A.6.3 awareness/education/training can surface anomalous shell usage or suspicious scripts when included in role-specific training content or incident-derived lessons, but the control's scope is limited to personnel knowledge transfer and does not mandate or perform technical detection of the technique.
T1059.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that users/admins enable or invoke Unix shell abuse, but does not stop an adversary who already has a foothold from abusing the shell
T1059.005detects — awareness/education/training on recognizing and reporting suspicious VB/VBA/VBScript activity (e.g. via incident reporting in the curriculum) can surface the technique when personnel notice it, but this is limited to human-observable cases and does not instrument or detect the technique at scale
T1059.005prevents — awareness/education/training on responsibilities, policies, basic procedures (e.g. event reporting, password security) and lessons from incidents can reduce the likelihood that users enable or execute malicious VB/VBA/VBScript payloads (e.g. via macros or attachments), but does not stop adversaries from abusing the technique in code or automated behaviors
T1059.006detects — awareness/education/training on security responsibilities and incident reporting can surface anomalous Python usage or suspicious scripts when personnel notice and report them, but this is limited to human-observable cases and does not systematically detect the technique itself
T1059.006prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security) and secure procedures lowers the chance that personnel will write, allow or run malicious Python scripts, but does not stop an adversary-introduced interpreter or compiled binary from executing
T1059.007detects — awareness/training on recognizing/reporting suspicious JS activity, incidents, or social-engineering vectors surfaces some technique use but does not instrument or monitor for actual execution
T1059.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration can reduce the likelihood that personnel introduce or allow environments enabling JavaScript abuse (e.g. via unsafe scripting, unpatched runtimes, or drive-by vectors), but does not stop adversaries from abusing JS implementations directly
T1059.008prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and secure configuration skills for technical teams lowers the chance that legitimate access is abused or that devices are left in a state where CLI abuse is possible, but does not stop an adversary who already has CLI access from using it
T1059.010detects — awareness/training on recognizing and reporting suspicious scripts, events, or behaviors (e.g. via 6.8 event reporting) can surface use of AHK/AutoIT for malicious automation after the fact, but only for the human-observable slice and not the underlying technique itself
T1059.010prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident reporting, and technical skills can reduce the likelihood that users or admins introduce, allow, or fail to detect AHK/AutoIT abuse, but does not stop adversaries from bringing or compiling the scripts themselves
T1059.011detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (incl. event reporting) can surface anomalous Lua script use by aware personnel, but this is limited to human observation/reporting and does not instrument or systematically detect the technique itself
T1059.013prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance that authorized users introduce or enable the CLI/API abuse, but does not stop a determined adversary who already has the necessary access or privileges
T1068prevents — awareness, education and training on responsibilities, procedures, and secure configuration can reduce the chance that vulnerable software/drivers are introduced or left exploitable, but does not stop adversaries from exploiting already-present vulnerabilities in OS components or third-party software
T1069detects — awareness/training surfaces anomalous permission-discovery behavior when it manifests as a detectable human action (e.g. via incident reporting or observable misuse), but the control has no instrumentation, monitoring, or technical detection capability for the technique itself
T1069prevents — awareness/training on responsibilities, policy compliance, incident lessons, and basic procedures (incl. password security) lowers the chance users will enable or expose permission groups that adversaries can discover, but does not stop the discovery technique itself once an account is compromised
T1069.003prevents — awareness, education and training on responsibilities, policies, incident lessons, and baseline controls (e.g. password security, event reporting) can reduce the chance an insider or compromised account performs or enables the discovery technique, but does not stop an already-authenticated adversary from running the listed tools/APIs
T1070.008detects — awareness/education/training on responsibilities, incident reporting, and recognizing suspicious activity (including via lessons learned) can surface indicators of mailbox-clearing tradecraft when performed by insiders or noticed by trained staff, but does not instrument or surface the technique itself at scale
T1070.008prevents — awareness, education and training on responsibilities, incident reporting, baseline controls and lessons from incidents can stop some users/admins from running mailbox-clearing commands or transport rules, but cannot stop all adversary techniques (especially automated or privileged ones) on all platforms
T1071.004detects — awareness/education/training on recognizing and reporting anomalous behaviors or security events (including unusual DNS activity) can surface knowledge of the technique when observed by trained personnel, but this is limited to human-dependent detection and does not systematically instrument or identify the technique at scale
T1072prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration/maintenance can stop some misuse of deployment tools by reducing credential compromise, misconfiguration, or failure to follow policy, but leaves the dominant technical access/abuse vector (admin accounts, integration into CI/CD, direct exploitation) untouched
T1074.001detects — A.6.3 awareness/education/training on recognizing and reporting security events (including anomalous data handling or staging activity) can surface knowledge of the technique when it is performed by insiders or is noticed by trained personnel, but this is limited to human observation rather than systematic technical detection and does not cover the bulk of adversary staging behaviors.
T1078detects — awareness/training on recognizing/reporting anomalous account use or security events surfaces some T1078 activity (esp. inactive-account abuse) but does not systematically detect credential abuse, pivoting, or legitimate-use evasion across the technique's full scope
T1078prevents — awareness/education/training on responsibilities, policy compliance, password security, incident reporting and technical configuration skills lowers the chance personnel will create, share, or leave exploitable accounts (including inactive ones), but cannot stop external compromise, phishing, or credential theft that still enables the technique
T1078.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and changing defaults lowers the chance personnel will leave default accounts unchanged or easily guessable, but does not guarantee they will be altered on all systems/devices (especially unmanaged, third-party, or post-integration defaults like vpxuser)
T1078.002detects — awareness/education/training surfaces anomalous behaviors or incidents (including credential abuse) to personnel who can then report them, but this is indirect, human-dependent, and limited to what the trained parties observe and choose to escalate
T1078.002prevents — awareness/education/training on responsibilities, policy compliance, password security, and incident reporting lowers the chance personnel will introduce or allow the credential-compromise vectors named in the technique (reuse, weak passwords, failure to report dumping), but cannot stop an already-compromised account from being abused or an external dump from succeeding
T1078.003prevents — awareness, education and training on responsibilities, password security, incident reporting and technical skills can stop some local-account abuse (e.g. weak/reused passwords, poor credential hygiene) but cannot prevent all vectors such as OS credential dumping, misconfigured service accounts or already-compromised credentials
T1078.004prevents — awareness, education and training on responsibilities, policies, procedures, incident lessons, password security, MFA implications and secure configuration lowers the chance that personnel introduce or fall for the account-compromise vectors named in the technique, but does not stop the class from arising via misconfigurations, technical flaws or external supply-chain compromise
T1080prevents — awareness/training on responsibilities, incident lessons, basic procedures (e.g. event reporting, password security) and management commitment can reduce the chance users introduce or execute tainted shared content, but does not stop adversaries from adding it to shares or repositories
T1083detects — awareness/training on recognizing and reporting anomalous behaviors or suspicious commands (e.g. via 6.8 event reporting) can surface file/dir discovery in flight for some users/roles, but the control does not mandate or implement any detection mechanism and leaves the bulk of technical discovery untouched
T1087.003detects — awareness/training on recognizing and reporting anomalous behavior (including suspicious account-enumeration activity) can surface the technique when performed by insiders or via observable user actions, but the control does not mandate or implement technical detection of the cmdlet or directory queries themselves
T1087.003prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline procedures (e.g. event reporting) can prevent the authenticated session or misuse that enables T1087.003, but leaves technical gaps such as misconfigured Exchange/Outlook permissions or unaddressed skill deficits in technical teams
T1087.004prevents — awareness, education and training on responsibilities, policies, procedures and baseline controls (e.g. password security, event reporting) can stop personnel from supplying the authenticated access the technique requires, but cannot stop an already-authenticated adversary or misconfigured service principal from enumerating accounts
T1091prevents — awareness/training on responsibilities, basic procedures (e.g. event reporting, password security), and lessons from incidents can reduce user execution of malicious removable media but does not stop the technique's core vectors such as Autorun, firmware modification, or air-gapped lateral movement
T1098detects — awareness/education/training surfaces anomalous account behavior via incident lessons and reporting procedures (6.8) but only for personnel who notice and report; it does not instrument or surface the technique itself
T1098prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and technical configuration skills lowers the chance that personnel will perform or allow the account manipulations described (e.g. weak credential hygiene, permission-group errors, subverting duration policies), but cannot stop an already-privileged adversary who chooses to execute them
T1098.001prevents — awareness, education and training on responsibilities, policies, incident lessons, password security and event reporting can stop some insider or privilege-abusing additions of credentials but does not stop an already-compromised administrator or external adversary who already possesses sufficient permissions from executing the technique
T1098.002detects — awareness/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous permission grants when personnel notice or are taught to report them, but this is limited to human-observable cases and does not instrument or detect the technique itself
T1098.002prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and basic procedures (incl. event reporting) can prevent users/admins from unwittingly or negligently granting the extra mailbox/folder permissions the technique relies on, but does not stop a determined adversary who already controls an account or bypasses human factors
T1098.003detects — awareness/education/training on responsibilities, incident reporting, and lessons from past incidents can surface anomalous role/permission changes when personnel notice or are trained to report them, but this is limited to human-observable slices and does not instrument or detect the API-driven technique itself
T1098.003prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and technical skills (incl. IAM configuration) lowers the chance personnel will perform or allow the account/role modifications the technique requires, but does not stop a determined adversary who already holds sufficient permissions
T1098.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop some SSH authorized_keys modifications (especially by insiders or via misconfigurations), but leaves the dominant adversary technique (direct file or API modification post-compromise) untouched
T1098.005prevents — awareness, education and training on MFA responsibilities, device enrollment rules, and recognizing anomalous registration can stop credential-compromised or post-access adversaries from successfully registering devices, but only reaches the human-factors slice of the technique (e.g. self-enrollment bypasses, policy violations) while leaving technical enrollment paths, automated abuse, and non-human vectors untouched
T1098.006prevents — awareness, education and training on responsibilities, policies, incident lessons, and secure configuration skills can stop personnel (including technical teams) from granting the extra roles/permissions the technique requires, but does not block a compromised privileged account or direct adversary action
T1098.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting) and lessons from incidents can lower the chance an insider or compromised account performs or enables this persistence technique, but does not stop a determined adversary who already controls an account from issuing net localgroup/usermod commands
T1102.001detects — awareness/education/training on recognizing suspicious external web service usage, incident reporting, and anomalous behaviors can surface dead-drop resolver activity when personnel notice or are trained to report it, but this is limited to human-observable slices and does not instrument or detect the technique at scale
T1102.002detects — awareness/education/training on recognizing anomalous behaviors, reporting events, and understanding responsibilities can surface indicators of web-service C2 (e.g. via incident reporting or trained monitoring staff), but only for a minority slice of the technique's stealthy, expected-traffic nature
T1110detects — awareness/training on recognizing and reporting suspicious login attempts or brute-force patterns (e.g. via event reporting in 6.8) can surface the technique in flight for some personnel, but the control's scope is limited to human awareness rather than automated or systematic detection mechanisms
T1110prevents — awareness/training on password security, personal accountability, and compliance with rules lowers the chance users choose weak/reused passwords or expose hashes, making brute-force less viable, but does not stop the technique when strong passwords are still guessable, when hashes are already obtained, or when MFA/lockouts are absent
T1110.001detects — A.6.3 awareness/education/training can surface knowledge of anomalous login patterns or failed attempts as part of incident reporting training, but the control itself only builds awareness and does not instrument, monitor or surface the guessing technique in flight
T1110.001prevents — awareness, education and training on password security, account lockout policies, and responsibilities directly lowers the success odds of password guessing by making both users and technical teams implement stronger baselines and configurations that stop the technique from succeeding
T1110.002prevents — A.6.3's awareness/education on password security, personal accountability, compliance with rules, and incident lessons directly lowers the chance users choose crackable passwords or mishandle credentials, preventing the technique at its root for the bulk of human-factor cases (per A.8.5 anchor); residual exists for technical cracking of strong hashes or non-user credentials.
T1110.003prevents — awareness and training on password security, personal accountability, compliance with rules, and incident lessons can reduce the likelihood that weak/default passwords or poor configs enable spraying, but does not stop the technique itself when run against services with any remaining valid credentials
T1110.004detects — awareness/education/training on recognizing phishing, reporting incidents, and understanding password hygiene can surface indicators of credential-stuffing attempts (e.g. via user-reported anomalies or failed-login patterns), but the control does not mandate or implement any detection mechanisms
T1110.004prevents — awareness training on password hygiene, personal accountability, and compliance with rules can reduce password reuse that credential stuffing exploits, but does not stop adversaries from obtaining breach dumps or attempting the technique against accounts that still reuse credentials
T1111prevents — awareness/education/training on MFA responsibilities, procedures, and incident lessons can reduce successful interception by improving user behaviors and reporting, but does not stop the technique itself (e.g. keyloggers, SMS compromise) from running
T1114detects — awareness/education/training surfaces anomalous behaviors or incidents (including suspicious email activity) via lessons learned, reporting procedures, and personnel vigilance, but only as a human-layer slice of detection rather than systematic technical coverage of the technique
T1114prevents — awareness/education/training on responsibilities, incident reporting, baseline controls and recognizing phishing lowers the chance users will allow or enable email collection (e.g. via credential compromise or malicious attachments), but does not stop server-side collection, forwarding rules or client-side exfiltration once access is obtained
T1114.001detects — awareness/training surfaces knowledge of email-collection risks and proper event-reporting (6.8) but does not instrument or surface the T1114.001 technique itself
T1114.002detects — awareness/education/training surfaces anomalous behaviors or policy violations (e.g. via incident lessons or reporting) that can reveal remote email collection, but only for the human slice and not the technical Exchange/Office 365 access itself
T1114.002prevents — awareness/training on responsibilities, policy compliance, event reporting, and credential hygiene (e.g. password security) can stop some credential-based or insider-enabled remote email collection but leaves technical vectors, external token abuse, and misconfigurations untouched
T1114.003detects — awareness/training on responsibilities, incident reporting, and recognizing anomalous behaviors (built on lessons from incidents) can surface suspicious forwarding-rule creation or hidden rules when users/admins notice or are trained to report them, but this is limited to human-observable indicators and does not systematically detect the technique itself
T1114.003prevents — awareness, education and training on responsibilities, policy compliance, incident lessons, and basic procedures (including event reporting) can stop users/admins from creating or allowing malicious forwarding rules, but does not reach technical enforcement, hidden MAPI rules, transport rules, or credentialed adversary actions
T1125detects — awareness/education/training on recognizing suspicious behavior, reporting events (6.8), and keeping technical skills current can surface some video-capture anomalies or malware after the fact, but the control is governance-oriented and does not mandate or perform technical detection mechanisms
T1127.001detects — awareness/education/training on security responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous use of trusted binaries like MSBuild when it deviates from expected developer/build workflows, but the control does not mandate or implement any technical detection mechanism
T1127.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. 5.17 password security), and lessons from incidents can reduce the likelihood that personnel enable or overlook MSBuild abuse, but does not stop a determined adversary from using a signed binary to proxy execution
T1127.002detects — awareness/training on recognizing suspicious ClickOnce prompts, disguised downloads, or anomalous startup-folder activity can surface the technique when users report it, but this is limited to observable user-facing indicators and does not instrument the underlying proxy execution
T1127.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and recognizing suspicious execution/install prompts can stop users from falling for the social-engineering or user-execution vectors that enable T1127.002, but cannot block the underlying trusted-utility abuse, rundll32 proxying, or startup-folder persistence once the technique is launched
T1129detects — awareness/education/training on responsibilities, incident reporting, and technical skills can surface anomalous module-loading behaviors when they align with covered topics, but the control's scope is limited to what the organization chooses to teach and assess, leaving most technical execution details of T1129 outside its direct view
T1132.001detects — awareness/education/training surfaces knowledge of indicators like anomalous encoded C2 traffic (via incident lessons and baseline controls) but only for personnel who receive and retain it; it does not instrument or surface the technique itself
T1133prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop some misuse or misconfiguration of external remote services (especially credential-related or exposed unauthenticated cases) but leaves the bulk of the technique (e.g. legitimate VPN use with stolen valid accounts, Tor hidden services, or exposed container APIs) untouched.
T1134.003detects — awareness/education/training surfaces knowledge of token-related events and reporting procedures (e.g. 6.8) but only for personnel who notice and act on observables; it does not instrument or surface the technique itself
T1136prevents — awareness, education and training on responsibilities, policies, procedures and incident lessons can reduce the chance an insider or privileged user creates a backdoor account, but does not stop a sufficiently-privileged adversary who already has access
T1136.003prevents — awareness, education and training on responsibilities, policies, incident lessons, and baseline controls (including account management and event reporting) can stop personnel from creating or allowing unauthorized cloud accounts, but does not stop a determined adversary who already has initial access or privileges
T1137detects — awareness/education/training surfaces knowledge of the technique (e.g. via incident lessons or secure-configuration training) so that misuse can be noticed, but the control's scope is limited to people and does not instrument or surface the Office startup artifacts themselves
T1137prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. macro handling) can stop users from enabling the Office persistence mechanisms, but does not guarantee removal of all technical vectors or cover every role
T1137.001detects — awareness/education/training surfaces knowledge of the technique (e.g. via incident lessons or macro policy) for some personnel but does not instrument or surface the persistence artifact itself
T1137.001prevents — awareness, education and training (including on macro security, policy compliance, and incident lessons) can stop users/admins from enabling or introducing malicious Office templates, but does not block the technique when macros are already permitted or the modification is performed by an already-compromised process
T1137.002detects — awareness/education/training on security responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous Office Test Registry entries or suspicious DLL loads when users are trained to notice and report them, but this is limited to human observation of a post-compromise artifact rather than any systematic or technical detection
T1137.002prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and basic procedures (including event reporting) can prevent users/admins from deliberately or accidentally adding the malicious Office Test registry key, but does not stop all technical vectors or skilled adversaries
T1137.003detects — awareness/education/training surfaces knowledge of the technique (e.g. via incident lessons or recognizing suspicious forms/behavior) for some personnel but does not systematically detect the persistence mechanism itself
T1137.003prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. event reporting) can prevent users from introducing or retaining malicious Outlook forms, but does not stop a technical exploit once the form is present or block all vectors
T1137.004detects — awareness training surfaces anomalous behavior and builds recognition of suspicious security events (including persistence techniques) but only when the implementer explicitly scopes it to cover this class of Office-based persistence
T1137.004prevents — awareness/education on responsibilities, policy compliance, incident lessons, and basic procedures (incl. event reporting) can prevent users from introducing or retaining malicious Outlook Home Page customizations, but does not stop a technical adversary who already has the needed mailbox access or code-execution foothold
T1137.005detects — awareness training can surface anomalous rules or suspicious emails as part of incident lessons and reporting procedures, but the control's focus is on personnel knowledge and responsibilities rather than systematic detection of the technique
T1137.005prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (incl. event reporting) can stop users from creating or retaining malicious Outlook rules, but does not reach the technical execution path once rules are present
T1137.006detects — awareness/education/training on recognizing suspicious add-ins, reporting events (6.8), and keeping technical skills current can surface some misuse after the fact, but the control does not mandate or perform detection mechanisms
T1137.006prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (incl. password security) can reduce the likelihood that users or admins introduce or tolerate malicious add-ins for persistence, but does not stop a skilled adversary from abusing them post-compromise or via technical means
T1140prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can reduce the chance users or admins introduce, tolerate or manually trigger deobfuscation steps, but does not stop malware or system utilities from performing T1140 autonomously
T1176detects — awareness/education/training on recognizing suspicious extensions, social engineering install vectors, and incident lessons can surface some T1176 abuse (especially user-installed or marketplace-sourced), but the control has no instrumentation or monitoring component and leaves most technical detection of installed/running extensions untouched
T1176prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for secure configuration can stop users from installing malicious extensions or abusing benign ones via social engineering or poor practices, but leaves intact marketplace compromises, supply-chain attacks, and technical bypasses that do not rely on unaware or unskilled personnel
T1176.001detects — awareness/education/training on recognizing suspicious extensions, social engineering install vectors, and reporting events can surface some T1176.001 activity (especially user-visible cases), but the control has no instrumentation or monitoring component and misses silent file-based or post-compromise installs
T1176.001prevents — awareness/education/training on responsibilities, policies, procedures, incident lessons, and baseline controls (e.g. password security) can stop users from installing malicious extensions via social engineering or app-store masquerading, but cannot stop file-based/silent installation after system compromise or manipulation of browser preference files
T1176.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance developers or users install or trust malicious IDE extensions, but does not stop the technique itself (installation side-loading, marketplace compromise, or benign-extension abuse)
T1185detects — awareness/education/training on recognizing and reporting suspicious browser behaviors, incidents, or anomalies (e.g. via 6.8 event reporting) can surface some session hijacking techniques after they are underway, but only for aware users and only where the technique produces observable indicators rather than fully silent pivoting
T1185prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can lower the chance that personnel introduce or fall victim to browser hijacking vectors, but does not stop the underlying code-injection or permission-abuse techniques
T1187detects — awareness/education/training on recognizing phishing attachments, suspicious links, and reporting security events can surface some T1187 delivery vectors (e.g. spearphishing or anomalous .LNK/.SCF behavior) but does not instrument or surface the core technique of forced SMB/WebDAV/EFSRPC authentication itself
T1187prevents — awareness/education/training on responsibilities, policies, incident lessons, and basic procedures (e.g. event reporting, password security) can reduce user susceptibility to opening spearphishing attachments or untrusted resources that trigger forced auth, but does not stop the underlying protocol behavior, crafted files, or EFSRPC abuse by adversaries
T1189prevents — awareness training on responsibilities, basic procedures (e.g. event reporting), recognizing suspicious sites, and not ignoring warnings can stop users from enabling scripting/notifications or visiting watering-hole sites, but cannot block all delivery vectors such as compromised legitimate sites or malvertising that require no user action beyond normal browsing
T1190prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can prevent some classes of public-facing misconfigurations or weak setups that adversaries exploit, but leaves the dominant technical bug and unpatched-vulnerability slices of T1190 untouched
T1195prevents — awareness/education/training on responsibilities, baseline controls, incident lessons, and secure development practices lowers the chance personnel will introduce or overlook supply-chain weaknesses (e.g. insecure dependencies, unverified updates), but cannot stop external supplier or upstream compromise stages
T1195.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. 5.17 password security), and lessons from incidents can prevent some developer behaviors that enable supply-chain compromise (e.g. failing to vet dependencies or falling for typosquatting), but does not stop upstream package or CI/CD component manipulation itself
T1197detects — awareness/education/training on responsibilities, incident reporting, and recognizing anomalous behaviors can surface suspicious BITS job activity when personnel notice or report it, but this is indirect, human-dependent, and does not systematically instrument or detect the technique itself
T1199prevents — awareness/education/training on responsibilities, policies, incident lessons, and secure practices for external parties and technical teams can stop some trusted-relationship abuses (e.g. via better vetting, limited access configs, or recognizing suspicious third-party behavior), but leaves the dominant technical vectors (compromised accounts, delegated admin, network co-location) untouched
T1201prevents — awareness/training on password security and policy compliance (including lessons from incidents) reduces the chance that weak policies are set or left discoverable, but does not stop an adversary who already has the needed privileges from running the discovery commands or API calls
T1203prevents — awareness/education/training on responsibilities, policies, basic procedures (e.g. event reporting, password security) and secure configuration lowers the chance users will open malicious attachments or visit exploit sites that trigger T1203, but does not stop unpatched client software vulnerabilities or drive-by browser exploits that require no user action
T1204prevents — Trained users are more likely to recognize and avoid executing malicious files, links, or images delivered through social engineering, thereby limiting user-driven execution of adversary payloads.
T1204detects — awareness/training surfaces user knowledge gaps and incident patterns that can flag social-engineering vectors leading to execution, but does not instrument or observe the technique in flight
T1204.001detects — awareness training can surface anomalous user behavior (e.g. via reported incidents or observed click patterns) but does not instrument or monitor for the technique itself
T1204.001prevents — awareness training on responsibilities, policies, incident reporting, and social engineering reduces the chance users will click malicious links, but does not stop the technique from being available or succeeding in all cases
T1204.002detects — awareness training on recognizing social engineering, reporting suspicious files/events, and lessons from incidents can surface user suspicion or anomalous file-opening behavior, but the control is not scoped to instrumentation, monitoring, or systematic detection of the technique itself
T1204.002prevents — awareness training on responsibilities, social engineering recognition, basic procedures and not opening suspicious attachments lowers the odds users will execute the malicious file, but does not stop the technique when social engineering or masquerading succeeds
T1204.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for configuring/maintaining secure images reduces the chance users will deploy backdoored ones, but does not stop the technique from succeeding when users still do so
T1204.004detects — awareness training on recognizing social engineering (including phishing, fake errors, and suspicious instructions) can surface the ClickFix tactic to users before they act, but the control does not instrument or monitor for the technique itself
T1204.004prevents — awareness training on social engineering, recognizing phishing/ClickFix lures, and not blindly copying/pasting commands directly lowers the chance users will fall for the technique, but does not stop determined adversaries or all users from executing it
T1204.005prevents — awareness/education on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance users install malicious libraries via typosquatting or unvetted package managers, but does not stop supply-chain compromise of popular libraries or guarantee users will recognize every malicious package
T1205.001detects — awareness/training on recognizing and reporting anomalous connection patterns or security events can surface port-knocking signals when they align with covered procedures (e.g. event reporting), but the control does not mandate or implement any technical detection mechanism
T1205.002prevents — awareness, education and training on responsibilities, procedures (including event reporting), baseline controls, and lessons from incidents can stop personnel from introducing or allowing socket filter backdoors, but does not reach the technical installation or elevated-privilege use of libpcap/setsockopt itself
T1210prevents — awareness/education/training on responsibilities, procedures, and secure configuration/maintenance lowers the chance that vulnerable remote services (unpatched, misconfigured) are present and exploitable, but does not guarantee they are absent
T1212detects — awareness/education/training surfaces knowledge of credential-exploitation techniques (e.g. via incident lessons or basic procedures) so personnel can recognize and report them, but only for the human-observable slice and not the technical exploitation itself
T1212prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills lowers the chance developers/admins introduce or leave exploitable credential-handling flaws, but does not stop the class of vulnerability from being written or exploited
T1213prevents — awareness/education/training on policy, responsibilities, baseline controls and incident lessons can reduce the human/configuration errors that leave repositories overly exposed, but does not stop deliberate abuse of legitimate access, external sharing features, or technical repository flaws
T1213.001prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. password security, event reporting) lowers the chance personnel will store sensitive items like credentials, diagrams, or policies in an exposed Confluence repository, but does not stop the technique when misconfigurations, product defaults, or non-personnel vectors are the root cause
T1213.002prevents — awareness/education/training on policy compliance, incident lessons, basic procedures and personal accountability lowers the chance that personnel will store or leave the listed sensitive items (diagrams, credentials, source code, etc.) in SharePoint, thereby preventing the technique from having anything valuable to mine
T1213.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills lowers the chance that credentials or sensitive data are left unsecured in repos and that access is granted in the first place, but does not stop an already-privileged adversary from collecting what is present
T1213.005detects — A.6.3's awareness/education programme (built on lessons from incidents, covering event reporting and IR discussions) can surface anomalous use of messaging apps or leaked sensitive chat content as part of training effectiveness checks and incident-derived content, but this is indirect, after-the-fact, and limited to what the organisation chooses to include in its programme rather than systematic detection of the technique.
T1213.005prevents — awareness/training on responsibilities, incident reporting, and basic procedures lowers the chance personnel will post credentials, source code, proprietary data or IR discussions into messaging apps, but does not stop the technique (e.g. misconfigured app permissions, external leaks, or non-personnel vectors remain unaddressed)
T1216.002detects — awareness/training on responsibilities, incident reporting, and recognizing suspicious activity can surface signs of living-off-the-land abuse (e.g. anomalous wscript.exe use of a signed script), but the control does not mandate or implement any technical detection mechanism and leaves most execution artifacts unreached
T1218.001detects — awareness/education/training on recognizing suspicious files, reporting events (6.8), and safe handling can surface anomalous .chm delivery or execution attempts when users notice and report them, but the control does not instrument or monitor for the technique itself
T1218.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and recognizing suspicious content lowers the chance users will open or execute malicious .chm files delivered via T1204, but does not stop the technique from running on systems where it is already present or when users ignore training
T1218.002detects — awareness training can surface anomalous user behaviors (e.g. opening suspicious .cpl files delivered by phishing) via reported incidents or observed deviations, but does not instrument or systematically detect the underlying proxy-execution technique itself
T1218.002prevents — awareness/education on responsibilities, phishing recognition, incident lessons, and baseline controls (e.g. password security, event reporting) can stop users from executing or falling for malicious CPL items delivered via phishing or multi-stage malware, but cannot stop all abuse vectors such as direct command-line/programmatic execution or registry-based DLL loading by already-compromised code
T1218.003detects — awareness/education/training on recognizing suspicious activity, reporting events (6.8), and understanding baseline controls can surface anomalous use of CMSTP.exe when personnel notice or are trained to flag it, but this is limited to human-observable cases and does not instrument or detect the technique at scale
T1218.004detects — A.6.3's awareness/education programme can surface anomalous use of InstallUtil via trained personnel recognizing and reporting suspicious activity (e.g. via event reporting in awareness content), but this is limited to human observation rather than systematic detection and does not address the technique's core execution path.
T1218.005detects — awareness/education/training on recognizing suspicious activity, reporting events (6.8), and understanding baseline controls can surface anomalous use of mshta.exe when it deviates from expected behavior, but this is limited to human observation rather than systematic detection and does not cover all instances (e.g., fully automated or stealthy executions)
T1218.005prevents — awareness/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel introduce or fall for mshta.exe abuse vectors, but does not stop the technique itself from running on a compromised or misconfigured Windows endpoint
T1218.008detects — A.6.3 awareness/education/training on incident reporting, baseline controls and lessons from incidents can surface anomalous use of signed binaries like odbcconf.exe when users or technical staff recognize and report it, but this is indirect, human-dependent and does not systematically instrument or detect the technique at scale.
T1218.009detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous use of signed binaries like Regsvcs/Regasm when it aligns with covered topics, but the control does not mandate or perform technical detection of the technique itself
T1218.012detects — awareness/education/training on security responsibilities and incident reporting can surface anomalous use of verclsid.exe when users or technical staff recognize and report it, but the control does not mandate or implement any detection mechanism
T1218.014detects — awareness/training on recognizing and reporting suspicious security events or anomalous admin tool use (e.g. via 6.8 event reporting) can surface this technique when observed by trained personnel, but the control does not mandate or implement any technical detection
T1219prevents — awareness/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security levels can reduce the likelihood of users/admins installing or enabling remote access tools (or failing to restrict them), but does not stop post-compromise abuse of legitimate/E DR tools or built-in modules
T1219.001detects — A.6.3's awareness/education programme can surface anomalous IDE tunneling behaviors when built on lessons from prior incidents and when technical staff are trained to recognize suspicious remote-development or auto-reconnect activity, but the control's scope is limited to knowledge transfer and does not mandate instrumentation or monitoring.
T1219.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills for technical teams can stop some developer misuse of IDE tunneling but leaves the dominant technical abuse vector (extensions, auto-reconnect, proprietary protocols on compromised machines) untouched
T1219.002prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel will install or allow unauthorized remote desktop tools, but does not stop an adversary from bringing their own or exploiting already-permitted RMM software
T1220detects — awareness/training on recognizing and reporting suspicious activity (e.g. unusual binaries, events, or phishing vectors that deliver XSL abuse) can surface the technique after it runs, but the control does not mandate or perform detection instrumentation
T1221prevents — awareness/training on responsibilities, policy compliance, incident lessons, basic procedures (e.g. event reporting) and recognizing phishing/shared-content delivery vectors can stop users from opening or propagating template-injected documents, but does not block the adversary's core act of creating/modifying template references or RTF control words
T1222.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), policy compliance and incident lessons can reduce the likelihood an insider or authorized user performs or enables T1222.001, but the control does not stop an adversary who already has code execution from running icacls/takeown/etc.
T1484detects — awareness/training on recognizing and reporting security events (including anomalous policy changes or GPO abuse) can surface the technique when performed by insiders or via observable indicators, but the control's scope is limited to human knowledge transfer and does not mandate or implement technical detection mechanisms
T1484.001prevents — awareness, education and training on responsibilities, policy compliance, incident lessons, and baseline controls (including access-related topics) can prevent the human actions that enable GPO modification (e.g. unsafe delegation or credential compromise), but does not stop technical exploitation paths or guarantee correct behavior in all cases
T1485detects — awareness/training on recognizing and reporting security events (including destructive incidents) surfaces knowledge of the technique after or during execution but does not instrument or guarantee detection of the act itself
T1485prevents — awareness, education and training on responsibilities, incident lessons, basic procedures and technical skills can stop some insider or configuration-driven data destruction but does not block the dominant external/adversary malware, credentialed propagation or cloud deletion paths
T1486recovers — A.6.3's awareness/education on responsibilities, incident lessons, event reporting (6.8) and backup implicitly enables post-ransomware recovery of encrypted data; extent is mostly because the control itself only trains people and does not directly perform or guarantee the recovery action (see A.8.13 anchor).
T1491.001detects — awareness training on recognizing and reporting anomalous internal changes (e.g. via incident reporting in 6.8) can surface defacement after it occurs, but the control's focus is on personnel behavior rather than technical detection mechanisms
T1491.001prevents — awareness training on responsibilities, incident reporting, and basic procedures can reduce the likelihood or success of post-compromise internal defacement by improving user vigilance and faster response, but does not stop the adversary technique itself once access is obtained
T1496detects — awareness/education/training on recognizing and reporting anomalous resource usage or security events (e.g. via 6.8 event reporting) can surface some hijacking indicators after the fact, but the control's human-focused scope leaves most technical detection (e.g. of cryptomining or proxy traffic) to monitoring tools outside its boundary
T1496prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills for technical teams can stop some hijacking vectors (e.g. weak credentials or misconfigurations enabling cryptojacking) but leaves many others (e.g. supply-chain compromise, unpatched vulnerabilities, or insider abuse) untouched
T1496.001detects — awareness/education/training on recognizing anomalous resource consumption, reporting events (6.8), and keeping technical skills current can surface compute hijacking (esp. in endpoints/servers), but the control is governance-oriented, does not mandate monitoring instrumentation, and leaves many deployment vectors (cloud/containers via exposed APIs) outside its direct view
T1496.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop personnel from introducing the exposed APIs, weak credentials, or misconfigurations that enable initial access for compute hijacking, but leaves the dominant post-compromise execution vector and many technical vectors untouched
T1496.002detects — awareness/education/training surfaces anomalous bandwidth consumption or related indicators (e.g. via incident reporting in 6.8) when personnel notice or are trained to recognize them, but only for the human-observable slice and not the underlying malware, botnet, proxyjacking or scanning behaviors themselves
T1496.002prevents — awareness/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can stop users from enabling or ignoring the initial compromise that leads to bandwidth hijacking, but does not reach the dominant technical vectors (malware, botnets, proxyjacking, scanning) once systems are co-opted
T1496.003detects — awareness/education/training on recognizing and reporting anomalous SMS/OTP traffic or abuse of public forms can surface the technique when performed by internal personnel or when lessons from incidents are incorporated, but the control has no instrumentation, monitoring or detection capability of its own and reaches only a narrow human-observation slice of the SaaS technique
T1496.004detects — awareness/education/training surfaces anomalous behavior or policy violations (e.g. via incident lessons or reporting) that can reveal hijacking, but only for aware personnel and only after the fact, leaving the bulk of technical detection to monitoring tools
T1496.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security level can stop some hijacking vectors (e.g. credential compromise or misconfiguration enabling the service) but leaves intact others (e.g. post-compromise abuse of already-authorized SaaS quotas or LLM reverse-proxy techniques)
T1498.002detects — awareness/education/training on recognizing and reporting security events (including anomalous network traffic or DoS symptoms) can surface the technique after it begins, but the control is scoped only to personnel knowledge transfer and does not itself instrument or monitor for the attack
T1499prevents — awareness/education/training on responsibilities, incident lessons, basic procedures and technical skills can stop some insider or misconfigured endpoint DoS vectors (e.g. resource exhaustion from poor config or unpatched services) but leaves the dominant external/botnet/spoofing techniques untouched
T1499.002detects — awareness/education/training on recognizing and reporting security events (including anomalous service behavior or floods) can surface some instances of the technique in flight, but the control's scope is limited to personnel knowledge transfer and does not mandate or implement technical detection mechanisms
T1499.003detects — awareness/education/training on recognizing and reporting security events (including anomalous resource usage or DoS symptoms) can surface the technique after it begins, but the control's scope is limited to personnel knowledge transfer and does not mandate or implement technical detection mechanisms
T1499.004detects — awareness/education/training on recognizing and reporting security events (including crashes from exploitation) surfaces some instances of the technique after the fact, but the control does not mandate or perform detection of exploitation itself
T1505.002detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (including event reporting) can surface anomalous transport-agent registration or behavior when personnel notice or are trained to report it, but this is limited to human-observable slices and does not instrument or detect the technique itself
T1505.003prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and secure configuration lowers the chance personnel will introduce or overlook a web shell, but does not stop a determined adversary from placing one via unpatched vulnerabilities, supply-chain compromise, or other technical vectors
T1518.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident reporting, and keeping technical skills current can reduce the likelihood an insider or user-assisted adversary performs or succeeds at security software discovery, but does not stop the technique itself from running on compromised systems
T1528detects — awareness/training on recognizing phishing, reporting incidents, and basic procedures (e.g. event reporting) can surface social-engineering paths to token theft but has no view of technical token theft from compromised containers, CI/CD, IMDS, or service accounts
T1528prevents — awareness/training on responsibilities, phishing recognition, secure practices and incident lessons can stop users from falling for OAuth/social-engineering token-theft paths and from misconfiguring service accounts, but cannot stop post-compromise token extraction from already-breached containers, VMs or CI/CD pipelines
T1529detects — awareness/training on recognizing and reporting anomalous shutdown/reboot events (e.g. via 6.8 event reporting) surfaces the technique in some cases, but the control does not mandate or implement detection mechanisms
T1530prevents — awareness/education/training on responsibilities, policy compliance, baseline controls (e.g. password security), and lessons from incidents can stop some misconfigurations and credential leaks that enable T1530, but does not reach the dominant technical causes (IAM policy errors, public bucket settings) or guarantee correct application by all parties
T1531prevents — awareness, education and training on responsibilities, incident reporting, password security and management commitment can stop some insider or social-engineering-enabled account manipulations but does not stop the dominant technical execution paths (e.g. compromised admin accounts using net, PowerShell, passwd, esxcli or Group Policy)
T1534detects — awareness/education/training on recognizing phishing, reporting events, and handling suspicious internal messages (e.g. via Teams or impersonation) surfaces some instances of the technique in flight or after the fact, but only for the human-observable slice and only where the trained user actually notices and acts; the control has no instrumentation or detection capability for the automated or non-human portions of the multi-staged campaign
T1534prevents — awareness/education/training on responsibilities, policies, procedures, incident lessons, and recognizing phishing lowers the chance users fall for internal spearphishing lures or impersonation, but does not stop the initial account compromise stage or guarantee error-free behavior
T1535detects — A.6.3's awareness/education programme can surface knowledge of unused-region risks and the need to monitor all regions (via lessons from incidents or training on cloud responsibilities), but only for personnel and does not itself instrument or perform detection of the technique.
T1538detects — awareness/training surfaces knowledge of anomalous dashboard use or credential misuse via incident lessons and reporting procedures, but only for personnel who notice and act on it
T1538prevents — awareness training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and policy compliance can reduce the likelihood of credential compromise or subsequent dashboard misuse, but does not stop the technique when credentials are already stolen
T1539detects — awareness/training surfaces knowledge of cookie-theft risks, phishing vectors, and incident reporting but does not instrument or surface the technique itself when it runs
T1539prevents — awareness/training on responsibilities, basic procedures (e.g. event reporting, password security), phishing recognition, and not falling for social engineering lowers the odds of user actions that enable cookie theft (e.g. running malicious JS, falling for phishing/AitM proxies), but does not stop malware, JS injection, or technical acquisition methods
T1543detects — awareness/education/training on responsibilities, incident lessons, event reporting and baseline controls can surface anomalous service creation/modification when personnel notice and report it, but this is limited to human-observable cases and does not instrument or systematically detect the technique
T1543.002prevents — awareness, education and training on responsibilities, procedures, incident lessons, and secure configuration skills for technical teams can stop some personnel from creating or modifying malicious systemd services, but does not block the technique itself (e.g. via compromised accounts, automation, or insiders who ignore training)
T1543.003prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident reporting, and technical skills for secure configuration can stop some insiders or less-sophisticated actors from creating/modifying malicious services, but leaves the dominant technical attack surface (Registry edits, API abuse, driver loading, privilege escalation, hiding) untouched
T1543.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for configuring/maintaining secure container services can stop some misuse that leads to this technique but does not prevent the code/config defects or privileged access that enable it
T1546detects — awareness/education/training on recognizing and reporting suspicious events, baseline procedures, and lessons from incidents can surface some T1546 abuse (e.g. via anomalous triggers or event reporting) but does not systematically detect the technique itself
T1546prevents — awareness/education/training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls lowers the chance that personnel will create or tolerate the malicious event triggers that enable T1546, but does not stop a determined adversary who already has initial access from abusing or installing them
T1546.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), policy compliance, and incident lessons can lower the chance an insider or user-assisted change to file associations occurs, but does not stop the technique itself (especially when performed by malware with registry access)
T1546.002detects — awareness/education/training on recognizing and reporting suspicious activity (including anomalous screensaver behavior or registry changes) can surface the technique after it is set, but the control is governance-oriented, does not mandate technical detection, and leaves most instances undetected
T1546.003detects — awareness/education/training on security responsibilities and incident reporting can surface anomalous WMI subscriptions or related events when personnel notice and report them, but this is indirect, human-dependent, and reaches only a minority slice of the technique
T1546.003prevents — awareness/education/training on responsibilities, incident reporting, and baseline controls can lower the chance an insider or admin introduces or tolerates a malicious WMI subscription, but does not stop the technique itself
T1546.004prevents — awareness/education/training on responsibilities, policy compliance, basic procedures (incl. event reporting) and secure configuration lowers the chance users/admins will insert or tolerate malicious shell config changes, but does not stop the technique outright (especially root-level or skilled-adversary modifications)
T1546.005detects — awareness/education/training on responsibilities, incident reporting, and lessons from past incidents can surface anomalous trap-based persistence when it manifests as observable user or admin behavior, but does not instrument or surface the underlying shell registration itself
T1546.007detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (incl. event reporting) can surface anomalous netsh helper DLL registrations or related suspicious activity when personnel recognize and report it, but this is limited to human observation rather than systematic detection and does not address the technical persistence mechanism itself
T1546.009detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous AppCert DLL behavior to trained personnel, but the control does not mandate or perform technical detection of the technique itself
T1546.012prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop some IFEO registry abuse by informed admins and developers, but leaves the dominant technical persistence/privilege-escalation vector in place
T1546.013detects — awareness training that covers incident reporting, basic procedures, and lessons from past incidents can surface anomalous PowerShell profile activity when users notice or are trained to report it, but the control does not mandate or implement any technical detection mechanism for the technique itself
T1546.013prevents — awareness/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance users/admins introduce or overlook malicious profile modifications, but does not stop the technique itself
T1546.015detects — awareness/education/training on recognizing anomalies, reporting events (6.8), and keeping technical skills current can surface COM hijacking indicators after the fact in some roles, but the control's scope is limited to personnel knowledge transfer and does not mandate or perform technical detection
T1546.015prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can reduce the likelihood that personnel introduce or overlook COM hijacking Registry changes, but does not stop a determined adversary from performing the technique
T1546.016prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the likelihood that users or admins install tampered packages or grant elevated permissions to malicious installers, but does not stop modified legitimate installers or root-running maintainer scripts from executing
T1546.017detects — awareness, education and training on responsibilities, incident lessons, event reporting and baseline controls can surface anomalous udev rules or related persistence behaviors when personnel recognize and report them
T1547.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can lower the chance an insider or admin adds a malicious run-key or startup item, but does not stop the configuration technique itself
T1547.002detects — awareness/education/training on recognizing anomalies, reporting events (6.8), and lessons from incidents can surface suspicious LSA/authentication package changes post-boot, but does not instrument or guarantee detection of the registry abuse itself
T1547.003detects — awareness/education/training on responsibilities, incident reporting, and lessons learned from incidents can surface anomalous time-provider registrations or related persistence behaviors when personnel recognize and report them
T1547.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the chance an insider with admin rights registers a malicious time-provider DLL, but does not stop the technique itself
T1547.004detects — awareness/education/training surfaces knowledge of the technique (e.g. via incident lessons or baseline controls) for those who receive it, but the control's scope is limited to personnel awareness and does not mandate or perform technical detection of the registry abuse itself
T1547.004prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can lower the chance an insider or admin introduces or tolerates the malicious Registry modification, but does not stop a determined adversary who already has the needed privileges
T1547.005detects — A.6.3's awareness/education programme can surface anomalous SSP modifications or suspicious DLL loads when built on lessons from prior incidents and includes reporting procedures, but this is indirect, human-dependent, and limited to what personnel notice or are trained to flag.
T1547.006prevents — awareness, education and training can lower the chance that personnel (admins, developers) will introduce, approve or fail to detect malicious kernel modules, but does not stop a determined adversary from loading one
T1547.007detects — A.6.3's awareness/education programme can surface anomalous login-window plist modifications when built on lessons from prior incidents and includes reporting procedures, but this is limited to human-driven detection and does not systematically instrument or monitor the technique itself.
T1547.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills for technical teams can stop users/admins from enabling or adding malicious persistence via the reopen plist, but leaves many other persistence vectors and non-aware actors untouched
T1547.010detects — awareness/education/training on incident reporting, baseline controls and lessons from incidents can surface anomalous port monitor changes or boot DLL loads when users or technical staff notice and report them, but this is limited to human-observable anomalies and does not instrument or detect the technique itself
T1547.012detects — awareness/education/training on recognizing and reporting anomalous events or suspicious configurations can surface indicators of this technique after it has been deployed (e.g. via incident reporting in 6.8), but the control does not mandate or perform any technical detection
T1547.012prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security, event reporting), and lessons from incidents can reduce the likelihood an insider or privileged user performs the SeLoadDriverPrivilege-enabled installation steps, but does not stop the technique itself
T1547.014detects — A.6.3's awareness/education programme can surface anomalous behaviours or incidents (including persistence via Active Setup) through trained personnel reporting, but this is indirect, human-dependent, and limited to what users notice rather than systematic detection of the technique.
T1547.015prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration skills can stop users/admins from adding malicious login items, but does not address the underlying macOS mechanisms or block all adversary use of AppleScript/Native API
T1548.002prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and secure procedures (e.g. password security, event reporting) can prevent some user-driven or misconfiguration-enabled UAC bypasses but leaves technical bypass methods (DLL injection, auto-elevated COM, eventvwr.exe, etc.) untouched
T1548.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), policy compliance, and lessons from incidents can stop users/admins from creating the poor sudo/sudoers configurations that the technique abuses, but does not guarantee correct configurations or block all abuse vectors
T1548.004prevents — awareness/education/training on responsibilities, policy compliance, basic procedures (e.g. event reporting, password security), and lessons from incidents can reduce the likelihood that users fall for the social-engineering or masquerading aspects of this technique, but cannot stop the deprecated API from functioning or prevent malicious code that abuses it without user interaction
T1548.005prevents — awareness, education and training on responsibilities, policies, baseline controls and lessons from incidents can reduce the likelihood of the misconfigurations that enable this technique, but does not guarantee correct permission configurations or remove the underlying mechanisms
T1548.006prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and incident lessons can reduce the likelihood of users or admins granting excessive TCC permissions or disabling SIP, but does not stop the technique when SIP is already off, when abusing already-granted permissions via injection, or when the adversary has write access to the TCC database
T1550prevents — awareness/training on responsibilities, incident lessons, password security, and secure configuration lowers the chance of alternate auth material (e.g. tickets/hashes) being mishandled or exposed, but does not stop the technique itself
T1550.001prevents — awareness/training on responsibilities, policies, incident lessons, password security, and event reporting lowers the chance users will fall for the social-engineering or misconfiguration vectors that commonly lead to token theft or misuse, but cannot stop all technical compromise paths (e.g., direct credential theft, misconfigured IAM permissions, or refresh-token persistence) described in the technique
T1550.004detects — awareness/education/training on recognizing and reporting suspicious activity, incidents, or anomalies (including malware or unusual session behavior) can surface indicators of cookie theft or misuse after the fact, but only for the human-observable slice and not the technical execution itself
T1550.004prevents — awareness/training on responsibilities, MFA bypass risks, incident lessons, and secure practices (e.g. cookie hygiene) can stop users from enabling cookie theft or reuse, but does not block the technique itself once a cookie is obtained
T1552.001detects — awareness/education/training on responsibilities, incident lessons, event reporting and baseline controls (e.g. password security) can surface knowledge of insecure credential files when personnel notice or report them, but this is indirect, human-dependent, and does not systematically detect the technique at scale
T1552.001prevents — awareness/education/training on responsibilities, password security, and incident lessons can stop users from creating/storing insecure credential files and can stop admins from configuring systems to do so, but cannot reach all adversary paths (e.g. third-party software defaults, container logs, or already-embedded credentials)
T1552.003detects — awareness training on incident reporting, basic procedures and lessons from past incidents can surface anomalous history-file access or credential exposure after the fact, but the control does not mandate or implement any technical detection mechanism for the technique itself
T1552.003prevents — awareness/training on responsibilities, password security, and incident lessons can reduce the chance users type credentials in command lines that end up in shell history, but does not stop the technique itself or eliminate the history files
T1552.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel create or leave private keys insecurely stored, but does not stop the technique once a system is already compromised nor reach all vectors (e.g. device keys, network device export)
T1552.005detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous access to the metadata API when it is recognized as suspicious, but this is limited to human observation and does not instrument or detect the technique itself
T1552.006detects — awareness/education/training surfaces knowledge of the GPP credential-exposure risk (and of event-reporting procedures) so that personnel can recognize and report the technique when it occurs, but the control does not itself perform detection
T1552.006prevents — awareness/education/training on responsibilities, policy compliance, incident lessons, and baseline controls (e.g. password security) can prevent administrators from embedding plaintext credentials in GPP in the first place, but does not stop the technique when it is performed by already-compromised accounts or external discovery of legacy GPP files
T1552.007detects — A.6.3's awareness/education programme can surface anomalous behaviours or incidents involving credential access via container APIs when built on lessons learnt from prior incidents and includes event reporting, but this is indirect, governance-level, and depends on human observation rather than systematic technical detection of the technique.
T1552.007prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for configuring/maintaining secure container environments lowers the chance of the misconfigurations that expose Docker/Kubernetes APIs, but does not guarantee their prevention
T1552.008detects — awareness/education/training surfaces knowledge of the risk (e.g. via incident lessons or reporting procedures) so that personnel can recognize and report suspicious credential sharing in chat, but does not itself instrument or surface the adversary technique
T1552.008prevents — awareness/training on responsibilities, policy compliance, basic procedures (e.g. event reporting, password security) and not sharing credentials can stop users from posting them in chat, preventing the technique at its human-error root, but this is only a slice of the class (technical collection paths, compromised integrations, admin portals remain unaddressed)
T1553prevents — awareness/education/training on responsibilities, policies, procedures and baseline controls (e.g. password security, event reporting) can reduce the likelihood that users or admins will perform the configuration changes or certificate misuse that enable T1553, but does not stop an adversary who already has the needed privileges or skills
T1553.004detects — awareness/education/training on recognizing suspicious certificates, reporting events, and keeping technical skills current can surface some instances of this technique (especially supply-chain or anomalous certs) but does not systematically detect the post-compromise installation action itself
T1553.004prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security configuration can reduce the chance personnel introduce, overlook or fail to remediate a malicious root certificate, but does not stop an already-compromised system or supply-chain insertion
T1553.006prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can lower the chance that authorized insiders (admins/developers) will intentionally or accidentally modify code-signing policies, but does not stop an adversary who already has elevated access from doing so via registry, kernel memory, or recovery-mode changes
T1555detects — awareness/education/training on password security, incident reporting, and recognizing suspicious activity can surface signs of credential theft attempts or post-compromise behavior, but only for the human-observable slice and not the underlying technical search technique itself
T1555prevents — awareness, education and training on password security, responsibilities, and incident lessons can stop some users/admins from creating weak stores or exposing credentials, but cannot stop the adversary technique itself once a vulnerable store exists on the system
T1555.003detects — awareness/training on recognizing and reporting suspicious activity (e.g. via 6.8 event reporting) can surface browser-credential theft after it occurs, but the control is governance-oriented, does not mandate specific detection mechanisms, and leaves the bulk of technical detection (process memory, file access anomalies) outside its scope
T1555.003prevents — awareness, education and training on responsibilities, password security, incident lessons, and secure configuration can stop users/admins from storing reusable browser credentials or from leaving extractable plaintext, but cannot stop all adversary extraction methods (e.g. memory scraping, unpatched browser flaws, or already-stored credentials on compromised hosts)
T1555.004detects — awareness/education/training on recognizing and reporting suspicious activity (e.g. credential access attempts or use of tools like vaultcmd.exe/Mimikatz) can surface the technique when performed by personnel, but this is limited to human-observable indicators and does not instrument or detect the technique at the system level
T1555.005detects — awareness/training on password security, incident reporting, and recognizing suspicious activity can surface signs of password-manager tampering or credential extraction after the fact, but the control is scoped to personnel education and does not mandate or perform technical detection mechanisms
T1555.005prevents — awareness, education and training on password security, responsibilities, and incident lessons can reduce the likelihood users choose weak master passwords or engage in behaviors that enable memory scraping or brute-force, but cannot stop all extraction techniques or technical flaws in the password manager itself
T1555.006detects — awareness/education/training on responsibilities, incident reporting, and recognizing anomalous behavior can surface signs of credential access from secrets managers (e.g. via reported events or trained staff noticing suspicious API calls), but only for a minority slice of the technique that depends on human observation rather than automated detection
T1556detects — awareness/education/training on recognizing and reporting anomalies (e.g. via incident reporting in the guidance) can surface signs of authentication tampering after the fact, but the control's scope is limited to human knowledge transfer and does not instrument or monitor technical processes
T1556.002detects — awareness/training on recognizing/reporting anomalies or incidents (e.g. via 6.8 event reporting) can surface suspicious password-filter registration or related auth behavior after the fact, but this is a narrow slice of the technique's full scope
T1556.005detects — awareness/education/training surfaces knowledge gaps or policy violations (e.g. via assessments or incident lessons) that could flag reversible-encryption settings, but only for personnel-driven cases and not the underlying AD property change itself
T1556.005prevents — awareness, education and training on responsibilities, policy compliance, password security and incident lessons can stop personnel (including admins) from enabling reversible encryption, but does not block an already-privileged adversary who sets the property directly via PowerShell, FGPP or GPO
T1556.007prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining authentication components can lower the chance of the initial compromise or misconfiguration that enables this backdooring technique, but does not stop a determined adversary who already has sufficient privileges
T1556.008detects — awareness/education/training can surface anomalous behaviors or incidents that reveal the technique (e.g. via lessons learned or event reporting), but the control's scope is personnel knowledge transfer and does not mandate or perform technical detection of Registry-based DLL registration or credential capture
T1556.008prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance an insider or admin registers a malicious network provider DLL, but does not stop the technique itself from being available or executed by a determined adversary
T1556.009prevents — awareness/education/training on responsibilities, policy compliance, MFA/password basics, and incident lessons can reduce the chance an insider or compromised account holder modifies conditional access policies, but does not stop a technical adversary who already has sufficient privileges from doing so
T1557.001detects — awareness/education/training on recognizing and reporting suspicious network events or phishing-like name-resolution behaviors can surface the technique after it runs, but only for the human-observable slice and not the automated poisoning/relay itself
T1557.001prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. password security) can stop personnel from falling for or enabling the poisoning/relay (e.g. by disabling LLMNR/NBT-NS/mDNS or not using weak NTLM), but does not stop the network-level technique itself when run by an already-present adversary
T1557.002detects — awareness/education/training on recognizing anomalous behavior or reporting suspicious network events (e.g. via 6.8 event reporting) can surface ARP poisoning when observed by trained personnel, but this is limited to human-detectable indicators and does not instrument or detect the technique at scale
T1557.004detects — awareness training can surface anomalous Wi-Fi behavior (e.g. via user reporting of suspicious captive portals or unexpected connections) but does not instrument or systematically detect the technique itself
T1557.004prevents — awareness/education on responsibilities, recognizing phishing-like Wi-Fi tricks, reporting events, and safe connection practices can stop users from connecting to evil twins, but does not block the adversary technique itself (e.g. rogue AP deployment) and leaves technical vectors like device auto-connect or PNL responses untouched
T1558detects — awareness/education/training on recognizing and reporting suspicious security events (including anomalous authentication behavior) can surface some instances of Kerberos ticket theft or forgery after the fact, but the control does not mandate or implement any detection mechanism, tooling, or monitoring
T1558prevents — awareness/education/training on responsibilities, incident lessons, password security, and technical skills for maintaining authentication systems can reduce the likelihood of misconfigurations or user actions that enable Kerberos ticket theft/forgery, but does not stop a determined adversary from exploiting the technique
T1558.003detects — awareness/education/training on recognizing and reporting suspicious Kerberos/SPN activity or anomalous credential use can surface the technique when performed by personnel, but the control's scope is limited to human knowledge transfer and does not mandate or implement technical detection mechanisms
T1558.003prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), incident lessons, and technical skills for maintaining security level can reduce likelihood of weak service accounts or RC4 usage that enable Kerberoasting, but does not stop the technique itself
T1558.004detects — awareness/education/training on recognizing and reporting suspicious authentication events or anomalies can surface AS-REP roasting attempts after the fact, but the control is governance-oriented and does not mandate or implement any technical detection mechanism
T1558.004prevents — awareness, education and training on responsibilities, policies, password security, and incident lessons can reduce the chance that accounts are left with pre-authentication disabled or that weak RC4 usage is tolerated, but does not stop the technique itself when such accounts exist
T1558.005detects — awareness/education/training on recognizing and reporting suspicious activity (e.g. via 6.8 event reporting) can surface indicators of ccache theft after it occurs, but the control's scope is limited to human knowledge transfer and does not instrument or monitor for the technique itself
T1558.005prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration of systems/devices can reduce the likelihood of ccache files being left exposed on disk or in memory, but cannot stop an adversary who already has session access or can reach the files via other means
T1559.002detects — awareness/education/training on recognizing and reporting suspicious documents, phishing vectors, and anomalous behavior can surface DDE-based execution attempts (especially those tied to Office/CSV files or events), but the control does not mandate or perform technical detection of the technique itself
T1559.002prevents — awareness, education and training on responsibilities, baseline controls (e.g. 5.17 password security), incident lessons, and technical skills can reduce the likelihood of users enabling DDE, opening poisoned Office/CSV documents, or falling for delivery vectors, but does not stop the technique itself when it is used by a compromised account or invoked via DCOM/Remote Services
T1563detects — awareness/education/training on recognizing and reporting anomalous sessions or security events can surface session hijacking when observed by personnel, but this is limited to human-detectable indicators and does not systematically instrument or monitor for the technique itself
T1563prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure configuration/maintenance for technical teams lowers the chance that sessions are left exposed or hijackable, but does not stop an adversary who already has valid access from commandeering an established session
T1563.001detects — A.6.3's awareness/education programme can surface anomalous SSH-agent or session behaviour when included in role-specific training or incident-derived awareness materials, but the control's scope is limited to knowledge transfer and does not mandate or implement detection mechanisms.
T1563.001prevents — awareness, education and training on responsibilities, baseline controls (e.g. password/SSH key security), incident lessons, and technical skills for configuring/maintaining secure SSH can stop users/admins from creating the weak agent-socket or key-trust conditions the technique exploits, but cannot reach all root-compromise paths or every implementation gap
T1563.002detects — A.6.3's awareness/education programme can surface anomalous RDP session behavior (e.g. via incident reporting training in 6.8) when users notice hijack prompts or unexpected session changes, but this is limited to human-observable slices and does not instrument or detect the tscon.exe technique itself.
T1564.002prevents — awareness/education/training on responsibilities, policies, procedures and incident lessons can reduce the chance that legitimate admins or users will create hidden accounts (or leave the configuration that enables the technique), but does not stop a malicious adversary who already has the needed privileges from performing the technique
T1564.003prevents — awareness training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can reduce the likelihood that personnel (including admins) will introduce or tolerate hidden-window techniques, but does not stop adversaries from abusing the underlying OS/scripting/Registry/APIs
T1564.008detects — awareness/training on recognizing/reporting suspicious activity (including phishing/incident emails) can surface the technique's effects when rules hide alerts, but the control does not instrument or monitor for rule creation itself
T1565prevents — awareness/education/training on responsibilities, procedures, and technical skills (incl. secure configuration and incident lessons) lowers the chance that personnel enable or fail to stop data manipulation, but does not stop a skilled adversary who already has the needed access or expertise
T1565.002detects — awareness/education/training on recognizing and reporting security events (including anomalous transmitted-data behavior) can surface the technique when performed by personnel, but only for the human-observable slice and not the core network/process interception
T1566prevents — Personnel who regularly receive awareness training on phishing indicators and reporting procedures are less likely to open malicious attachments or click malicious links, reducing the success rate of phishing campaigns.
T1566detects — awareness training on recognizing phishing (via incidents, reporting procedures, and basic security practices) enables personnel to detect and report suspicious messages, but the control itself is not a detection mechanism and leaves technical detection (e.g., email filtering) untouched
T1566.001detects — awareness training on recognizing phishing, reporting events, and baseline controls surfaces the technique when users notice and report it, but the control does not instrument or guarantee detection of delivery or execution
T1566.001prevents — awareness/education/training on responsibilities, policies, basic procedures (e.g. event reporting, password security), and recognizing social engineering lowers the odds users open malicious attachments or fall for the lures, but does not stop the technique from being attempted or executed by those who ignore it
T1566.002detects — awareness training on recognizing phishing, reporting events, and understanding social engineering can surface some spearphishing-link attempts (especially when users notice and report them), but the control does not instrument, monitor, or systematically detect the technique itself
T1566.002prevents — awareness/training on recognizing phishing, reporting events, and baseline procedures (e.g. password security) lowers the chance users will click malicious links or fall for social engineering, but does not stop the technique from being attempted or succeeding against untrained, non-compliant, or technically exploited users
T1566.003detects — awareness training on recognizing spearphishing (including via social media/webmail) and reporting suspicious contacts surfaces the technique when the recipient notices it, but the control only equips human detection and does not instrument or guarantee discovery of the messages themselves
T1566.003prevents — awareness/education/training on recognizing social engineering, reporting suspicious contacts, and handling unexpected messages via personal/third-party channels directly lowers the chance the technique is successful against trained personnel
T1566.004detects — awareness training on recognizing social engineering (including vishing indicators, reporting events, and MFA tricks) surfaces the technique when users notice and report it, but the control only equips human detection and does not instrument or guarantee discovery of calls, prompts, or downstream execution
T1566.004prevents — awareness/education/training on recognizing social engineering (including vishing indicators, urgency, impersonation, and reporting) directly lowers the chance users fall for T1566.004, but cannot stop determined adversaries or all variants as it relies on human behavior change rather than technical blocking
T1567detects — awareness/education/training on recognizing and reporting anomalous behaviors or incidents (including unusual exfiltration) can surface knowledge of the technique when it occurs, but the control is governance-oriented, not a technical detection mechanism, and only reaches personnel who notice and act on it
T1567prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security, event reporting), and policy compliance can reduce the likelihood that an insider or compromised account enables or performs web-service exfiltration, but does not stop the technique itself when executed by an adversary who already has the necessary access or foothold
T1567.001detects — awareness/education/training on recognizing and reporting anomalous behaviors or incidents (including unusual data movements to code repos) can surface the technique when performed by insiders or via observable user actions, but does not instrument or detect the exfiltration itself
T1567.002detects — awareness/education/training on recognizing and reporting anomalous data transfers or cloud usage can surface the technique when performed by insiders or via observable user actions, but does not instrument or detect the exfiltration itself
T1567.003detects — A.6.3's awareness/education programme can surface anomalous use of text storage sites (e.g. via incident-reporting training or lessons-learned modules) when that use is recognized by trained personnel, but the control is governance-oriented and does not itself instrument, monitor, or detect the exfiltration technique.
T1567.003prevents — awareness, education and training on responsibilities, incident lessons, baseline controls (e.g. password security, event reporting) and secure configuration can stop some insider or developer misuse of text storage sites for exfiltration, but leaves the dominant external-adversary technique (post-compromise outbound transfer) untouched
T1567.004detects — awareness/education/training on recognizing and reporting anomalous behaviors or incidents (including unusual SaaS/webhook activity) can surface the technique when personnel notice it, but this is limited to human-observable slices and does not instrument or detect the exfiltration itself
T1567.004prevents — awareness/training on responsibilities, incident reporting, and baseline controls (e.g. password security) can prevent some webhook exfiltration vectors that rely on user actions or misconfigurations, but leaves the bulk of the technique (SaaS linking, direct HTTPS posts, blending with normal traffic) untouched
T1568.002detects — awareness/education/training on recognizing suspicious network behaviors or reporting anomalies can surface DGA-driven C2 as part of broader monitoring awareness, but the control itself only indirectly enables detection knowledge and does not perform or mandate any actual detection activity
T1569detects — A.6.3's awareness/education programme can surface anomalous service-related behaviour when included in topic-specific training for technical teams (e.g. via incident lessons or monitoring guidance), but the control's scope is set by organisational policy and role relevance, leaving most service-abuse detections outside its mandated coverage.
T1569.002detects — A.6.3's awareness/education programme can surface anomalous service-control activity when built on lessons from prior incidents and includes reporting procedures, but this is limited to human observation rather than systematic detection of the technique.
T1569.003detects — A.6.3's awareness/education programme (built on lessons from incidents, covering event reporting and baseline controls) can surface anomalous or unauthorized systemctl use when included in training for technical staff, but this is indirect, scope-limited by organizational choices, and far from systematic detection of the technique.
T1571detects — awareness/education/training on security responsibilities, incident lessons, and baseline controls (e.g. event reporting) can surface anomalous non-standard port usage as suspicious behavior when it is recognized by trained personnel, but this is indirect, human-dependent, and reaches only a minority slice of the technique
T1572detects — awareness/education/training on recognizing anomalous behaviors, reporting events, and understanding baseline controls can surface tunneling when it manifests as suspicious traffic or policy violations, but this is limited to human-observable indicators and does not instrument or automate detection of the encapsulated protocol technique itself
T1574prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance that personnel introduce or overlook the configurations that enable execution-flow hijacking, but does not stop an adversary from exploiting such weaknesses once present
T1574.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that personnel introduce or overlook the insecure configurations and practices that enable DLL sideloading/search-order hijacking, but does not stop an adversary from exploiting the technique once those conditions exist
T1574.005prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance that developers or admins introduce or tolerate the insecure permissions that enable this technique, but does not itself enforce correct permissions or stop the weakness from being written into installers
T1574.006prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the chance that personnel (esp. developers/admins) will leave exploitable environment variables or debugging configurations in place, but does not stop an adversary who can already set LD_PRELOAD/DYLD_INSERT_LIBRARIES on a compromised account or process
T1574.008detects — awareness training on incident reporting, basic procedures, and lessons from past incidents can surface anomalous behavior tied to search-order hijacking after it occurs, but the control does not mandate or perform technical detection of the technique itself
T1574.008prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood that developers or admins introduce or tolerate vulnerable search-order behavior, but does not stop the technique from being available in deployed software
T1574.009detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous executables or path-related incidents after they occur, but does not systematically detect the unquoted-path condition itself
T1574.009prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security) and lessons from incidents can lower the chance developers or admins introduce unquoted paths, but does not stop the code/config defect itself
T1574.011prevents — awareness/education/training on responsibilities, policy compliance, baseline controls (e.g. password security) and incident lessons can reduce the chance that misconfigurations in service Registry permissions are introduced or left in place, but does not itself enforce correct ACLs or prevent the technique
T1583.001prevents — awareness/education/training on policy, responsibilities, incident lessons, and baseline controls (e.g. event reporting) can prevent some insider-enabled or policy-violating domain acquisitions but does not stop external adversaries from purchasing, typosquatting, or registering domains in compromised environments
T1583.008prevents — awareness training on responsibilities, policies, incident lessons, and baseline controls (e.g. recognizing spoofed ads or reporting events) can stop users from falling for malvertising lures, but the technique itself is an adversary purchase and placement that training does not block at source
T1584.001prevents — awareness, education and training on responsibilities, incident lessons, password security, event reporting, and social engineering reduce the likelihood of the human-enabled vectors (email compromise, help-desk social engineering, renewal gaps) but do not stop technical subdomain hijacking, cloud-service compromise, or deprovisioned-resource gaps
T1586prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and social-engineering vectors (e.g. phishing for credentials) lowers the chance that employees or partners will fall for or assist the compromise methods listed in T1586, but cannot stop all vectors (e.g. external credential purchases, brute-force of non-organizational accounts, or adversary reconnaissance)
T1586.001prevents — awareness/training on responsibilities, password security, incident reporting, and social-engineering basics lowers the chance personnel will fall for credential theft or reuse that enables account compromise, but does not stop reconnaissance, credential purchase, or adversary-controlled external accounts
T1586.002prevents — awareness, education and training on responsibilities, policies, incident reporting, password security, and recognizing phishing lowers the chance that employees, suppliers or partners will fall for credential-theft lures or willingly hand over access, directly blocking the human-targeted compromise vectors named in the technique; it leaves technical brute-force, purchased credentials, and reconnaissance-driven selection of high-reputation accounts untouched
T1586.003prevents — awareness, education and training on responsibilities, policies, password security, incident reporting and phishing lowers the chance that personnel will fall for credential-theft vectors (phishing, password spraying, token theft) that lead to cloud-account compromise, but cannot stop external purchase of credentials, reconnaissance-driven targeting of provider accounts, or technical exploits outside human factors
T1588.005prevents — awareness/education/training on responsibilities, policies, incident lessons, and secure practices can reduce the likelihood that an insider (or unwitting personnel) will introduce, share, or fail to report acquired exploits, but does not stop external adversaries from buying/stealing/downloading them independently
T1588.007prevents — awareness/education/training on responsibilities, policies, incident lessons, phishing/social-engineering recognition, and secure development lowers the chance that personnel introduce or fall for AI-assisted techniques (e.g. phishing content, obfuscated payloads, impersonation), but does not stop adversaries from obtaining and using public LLMs themselves
T1589prevents — awareness training on responsibilities, policies, incident reporting, password security, and social engineering lowers the chance personnel will leak identity data via elicitation or misconfiguration, but does not stop passive collection from public leaks, active scanning, or technical enumeration of MFA configs
T1589.001prevents — awareness training on responsibilities, policy compliance, password security, incident reporting, and recognizing elicitation/phishing directly lowers the chance users expose credentials via personal reuse, weak practices, or falling for gathering techniques, but cannot stop technical collection from breaches, dark web markets, or compromised sites
T1589.003prevents — awareness training on personal accountability, incident reporting, phishing recognition, and not exposing staff details lowers the chance employees publish or leak names online, preventing the easy public gathering step in the technique
T1590.003prevents — awareness training on responsibilities, policy compliance, incident reporting, and phishing elicitation reduces the chance personnel will inadvertently expose or confirm network trust details (e.g. via social engineering or misconfigured disclosures), but cannot stop passive/public data exposure or adversary research that does not involve trained personnel
T1591prevents — awareness training on responsibilities, incident reporting, phishing recognition, and social engineering lowers the chance personnel will disclose org details via elicitation or oversharing, but cannot stop passive public data exposure or non-human sources
T1591.002prevents — awareness training on responsibilities, incident lessons, phishing recognition, and rules for handling external parties (contractors/suppliers) reduces the chance personnel will inadvertently expose business-relationship details via elicitation or public data sets, but cannot stop passive OSINT or adversary actions outside the organization
T1591.003prevents — awareness training on responsibilities, policy compliance, incident reporting, and social engineering (e.g. phishing elicitation) reduces the chance personnel will leak business-tempo details via inadvertent disclosure or failure to protect public data, but cannot stop passive collection from already-public sources or non-human leaks
T1591.004prevents — awareness training on responsibilities, policy compliance, incident reporting, and social engineering recognition (built on lessons from incidents) reduces successful elicitation via phishing-for-information and lowers the chance personnel expose role data on social media or websites, but cannot stop passive public data exposure or all reconnaissance vectors
T1593prevents — awareness training on responsibilities, policy compliance, incident lessons, and basic procedures (e.g. event reporting) can prevent personnel from posting or leaking victim information on open websites/domains that adversaries search, but does not stop external public data or adversary searches themselves
T1593.001prevents — awareness training on social media risks, personal accountability, incident lessons, and not sharing roles/locations/interests lowers the chance staff will post targetable data that adversaries can harvest, but does not stop all such information (e.g. official business announcements) from appearing
T1593.002prevents — awareness training on responsibilities, incident lessons, basic procedures and not leaking sensitive data (e.g. credentials, network details) lowers the chance personnel will create the spillages that T1593.002 harvests, but does not stop public indexing of non-leaked information or adversary queries against it
T1593.003prevents — awareness training on responsibilities, secure coding, and not leaking credentials/secrets can stop some accidental exposures in public repos that enable the technique, but cannot stop all public code (e.g. intentional open-source projects) or adversary searches of them
T1598prevents — Security awareness reduces the chance that employees will disclose sensitive organizational information when targeted by information-gathering phishing attempts.
T1598detects — awareness training on recognizing phishing, reporting events, and handling suspicious messages (explicitly referenced in the control) surfaces T1598 attempts to personnel, enabling detection and reporting; this is limited to human-observable social engineering vectors and does not instrument or detect the technique at scale or in evasive forms
T1598.001detects — awareness training on recognizing social engineering, incident reporting, and suspicious messages (including via third-party services) equips personnel to detect and report spearphishing attempts, but the control does not itself perform detection
T1598.001prevents — awareness training on social engineering, phishing recognition, and reporting lowers the chance targets will engage with or divulge information to spearphishing lures, but does not stop the adversary from sending the messages or guarantee every recipient will recognize and ignore them
T1598.002detects — awareness training on recognizing phishing lures, reporting events, and handling suspicious attachments surfaces the technique when recipients notice and report it, but the control's scope is limited to human recognition and does not instrument or detect the electronic delivery itself
T1598.002prevents — awareness training on recognizing social engineering, reporting suspicious attachments/emails, and understanding responsibilities directly lowers the chance personnel will open/respond to the lure, but does not stop the adversary from sending it or guarantee every recipient will act correctly
T1598.003detects — awareness training on recognizing phishing lures, reporting events, and spotting suspicious links/QR codes surfaces some instances of the technique in flight or after receipt, but the control is silent on instrumentation, monitoring, or automated detection mechanisms and leaves the bulk of technical detection (e.g. email scanning, web beacons, BitB) untouched
T1598.003prevents — awareness/education/training on recognizing social engineering, phishing lures, suspicious links/QR codes, and reporting reduces the chance users will fall for T1598.003, but does not stop the technique from being attempted or guarantee every recipient will avoid it
T1598.004detects — awareness training on recognizing social engineering (including vishing indicators, reporting events, and handling urgent calls) surfaces the technique when it reaches personnel, but the control is scoped only to human recipients and does not instrument or surface automated/robocall attempts, spoofed numbers at scale, or pre-delivery reconnaissance
T1598.004prevents — awareness/education/training on recognizing social engineering (including vishing indicators, reporting, and personal accountability) lowers the chance the technique succeeds against trained personnel, but does not stop adversaries from executing the call or guarantee universal resistance
T1599prevents — awareness, education and training on responsibilities, baseline controls (e.g. password security), incident lessons, and secure device configuration can stop some personnel from introducing the misconfigurations or credential issues that enable boundary-device compromise, but cannot prevent all paths (e.g. zero-days, supply-chain compromise of the device itself, or non-human error)
T1602.001detects — awareness/education/training on responsibilities, incident lessons, and reporting (e.g. 6.8) can surface anomalous SNMP queries or MIB access as suspicious behavior when it aligns with the program's scope, but this is indirect, role-dependent, and does not mandate instrumentation or monitoring of the technique itself
T1602.001prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security), and lessons from incidents can reduce the likelihood of SNMP misconfigurations that enable MIB dumping, but does not stop the technique when SNMP is required and left exposed
T1602.002detects — A.6.3's awareness/education programme can surface anomalous user or admin behaviour (e.g. via incident lessons or reporting training) that precedes or accompanies a configuration dump, but does not instrument or monitor the actual technique on the network device itself.
T1608.004prevents — awareness training on responsibilities, incident lessons, basic procedures (e.g. event reporting) and baseline controls can reduce the chance some personnel enable drive-by staging (e.g. via insecure web content management or falling for watering-hole setup), but leaves the dominant adversary-side staging, infrastructure acquisition, and technical injection untouched
T1608.005prevents — awareness training on phishing, social engineering, suspicious links, reporting obligations, and recognizing cloned/malicious sites directly lowers the chance users will click or be deceived by T1608.005-prepared link targets, but cannot stop adversaries from setting up the infrastructure itself
T1613detects — awareness/training on recognizing and reporting security events (including anomalous discovery activity) can surface the technique when performed by personnel, but the control has no instrumentation, monitoring, or detection mechanism for automated or API-based container discovery
T1619detects — awareness/training surfaces knowledge of the technique (e.g. via incident lessons or basic procedures) so personnel can recognize and report suspicious enumeration, but does not instrument or surface the API calls themselves
T1621detects — awareness training on recognizing and reporting suspicious MFA push/SMS bombardment or fatigue attempts (via incident reporting in 6.8) surfaces the technique for some users but does not instrument or guarantee detection of the generation or bombardment itself
T1621prevents — awareness/education/training on MFA responsibilities, fatigue risks, and reporting suspicious requests lowers the chance users will approve adversary-generated MFA prompts, but does not stop the technique from running or guarantee users will always refuse
T1649detects — awareness/education/training on responsibilities, incident lessons, and basic procedures (e.g. event reporting) can surface anomalous certificate-related behaviors when personnel notice and report them, but this is limited to human-observable slices and does not instrument or detect the technique itself
T1649prevents — awareness/education/training on responsibilities, baseline controls (e.g. password security, event reporting), and lessons from incidents lowers the chance personnel will enable certificate theft (via poor key handling or misconfigs) or abuse enrollment rights, but does not stop technical forging, root-CA compromise, or the technique itself
T1651detects — awareness/education/training on responsibilities, incident lessons, event reporting and anomalous behaviour can surface signs of cloud admin command abuse (especially by insiders or after compromise), but only for the human-observable slice and not the underlying technique itself
T1657detects — awareness/education/training on recognizing social engineering, reporting incidents, and spotting anomalies (e.g. BEC, phishing for financial theft) surfaces some instances of the technique in flight or post-facto, but leaves the bulk of technical theft, ransomware extortion, and cryptocurrency exploitation undetected as these are outside the human-focused scope of A.6.3
T1657prevents — awareness/education/training on responsibilities, policies, incident reporting, social engineering recognition, and baseline controls (e.g. password security) lowers the probability that personnel fall for the social-engineering, BEC, impersonation, or ransomware-payment vectors that enable most financial theft, but cannot stop technical theft, account compromise, or post-breach extortion once the adversary is inside
T1665detects — awareness/education/training on recognizing suspicious traffic patterns, reporting events (6.8), and keeping technical skills current can surface some adversary hiding behaviors (e.g., anomalous filtering or domain masking) but does not systematically detect the technique itself
T1667detects — awareness training on recognizing/reporting security events (incl. spam floods, harassment, or anomalous inbox activity) can surface email bombing when it occurs, but the control is scoped to personnel education rather than technical detection mechanisms and does not mandate coverage of this specific precursor technique
T1667prevents — awareness training on responsibilities, incident reporting, phishing/social engineering, and recognizing suspicious sign-up patterns can stop some email bombing vectors (especially the precursor social-engineering follow-on), but does not block automated bot-driven newsletter signups or inbox flooding itself
T1671prevents — awareness/education/training on responsibilities, policies, procedures, and incident lessons can lower the chance users or admins will consent to, create, or fail to review malicious OAuth integrations, but does not stop a determined adversary who already has a high-privileged account or who bypasses consent entirely
T1673detects — awareness/education/training on recognizing and reporting anomalous activity (including hypervisor/VM enumeration) can surface the technique when performed by personnel, but the control is scoped to human awareness rather than automated or technical detection mechanisms
T1677prevents — awareness/education/training on responsibilities, secure practices, and incident lessons can reduce the likelihood that insiders or developers introduce or overlook poisoned pipeline code (e.g. via unsafe PR handling or weak config), but does not stop external supply-chain or public-pipeline attacks that require no insider action
T1683prevents — awareness/education/training on responsibilities, policies, incident lessons, and social-engineering basics lowers the chance personnel will fall for or assist generated-content pretexts (e.g., phishing, impersonation), but does not stop adversaries from independently creating the content itself
T1683.001prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline procedures (e.g. event reporting, password security) can stop some personnel from falling for or propagating the written-content lures that target them, but does not stop adversaries from creating or tailoring the materials themselves
T1683.002prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. recognizing phishing or social engineering) lowers the chance personnel fall for or propagate synthetic A/V content used in those downstream techniques, but does not stop adversaries from creating or manipulating the content itself
T1684detects — A.6.3's awareness/training on recognizing social engineering (e.g. via incidents, reporting procedures, and role-specific education) surfaces some instances of the technique when users notice and report it, but does not instrument or guarantee detection of the broad range of channels, narratives, or AI-enabled variants in the class.
T1684prevents — awareness/education/training on responsibilities, policy, procedures, incident lessons, and baseline controls (e.g. event reporting, password security) lowers the odds users fall for social-engineering lures, but does not stop the technique from being attempted or succeeding in all cases
T1684.001detects — awareness training on recognizing impersonation (via social engineering indicators, incident lessons, and reporting procedures) surfaces the technique when personnel notice and report it, but the control's scope is limited to human observers and does not instrument or detect the preceding reconnaissance, infrastructure, or non-reported instances
T1684.001prevents — awareness training on responsibilities, policies, incident reporting, and recognizing social engineering (including impersonation via phishing) lowers the chance victims fall for the technique, but does not stop adversaries from executing it or guarantee all personnel will recognize every instance
T1684.001responds — A.6.3's awareness/education programme (built on lessons from incidents, covering event reporting, and training on recognizing social engineering) equips personnel to recognize and report an impersonation campaign once underway, enabling organizational response, but does not itself perform containment or eradication.
T1684.002detects — awareness/training surfaces knowledge of spoofing risks, reporting procedures, and incident lessons but does not instrument or surface the technique in flight
T1684.002prevents — awareness/education/training on responsibilities, policies, incident lessons, and baseline controls (e.g. event reporting, password security) can reduce successful social engineering via spoofed emails but does not stop the technical technique of header modification or weak DMARC/SPF/DKIM configurations
T1685prevents — awareness, education and training on responsibilities, baseline controls, incident reporting and keeping technical skills current can reduce the likelihood that personnel (or insiders) will disable/modify tools, but does not stop determined adversaries from using the many technical methods described
T1685.001detects — A.6.3's awareness/education programme built on lessons learnt from incidents can surface anomalous disabling of Event Log (via training on event reporting and incident patterns), but this is indirect, governance-level, and depends on human observation rather than any mandated instrumentation or monitoring.
T1685.001prevents — awareness/education/training on responsibilities, incident reporting, and baseline controls (including audit policy) can stop some users from running disable/modify techniques, but does not block admins or technically skilled insiders who already know the commands
T1685.002prevents — awareness/education/training on responsibilities, incident lessons, event reporting and baseline controls (e.g. 6.8, 5.17) can stop some insiders or permission-holders from choosing to disable/modify logging, but does not block technical abuse by determined adversaries who already possess sufficient privileges
T1685.005detects — awareness/training on event reporting and incident lessons can surface anomalous log-clearing when personnel notice or report it, but the control does not mandate or implement any technical detection mechanism
T1686.001detects — A.6.3's awareness/education programme can surface anomalous firewall changes when built on lessons from prior incidents and includes reporting procedures, but this is indirect, governance-level, and depends on human factors rather than systematic detection of the technique.

Prevented OWASP Web Top 10 (2025) risks (2)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A02←P A09←M

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.