Cyber Resilience

← ISO 27001 Annex A

A.8.12 Technological

Data leakage prevention

AttributesPreventive Detective C Protect Detect Information protection Protection Defence

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (19)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-4←F →P MP-7←M SC-26←P SC-28←P SC-30←P SC-7←M →M SI-4←M →P

Why these map — AI rationale (under review)

AC-4mostlyaligns with — Both enforce controls on information flows to prevent sensitive data from moving to unauthorized recipients or external systems.
SC-7mostlyaligns with — Both controls focus on preventing unauthorized exfiltration of sensitive data at network and system boundaries through monitoring and blocking mechanisms.
SI-4mostlyaligns with — Both emphasize continuous monitoring of information flows and user actions to detect and respond to unauthorized disclosure of sensitive data.
AC-21partialaligns with — Both require controls and approvals before sensitive information is shared or exported outside organizational boundaries.
MP-7partialaligns with — Both address restrictions on the use of external media and devices to prevent unauthorized copying or removal of sensitive information.
SC-8partialaligns with — Both protect sensitive information during transmission by preventing unauthorized disclosure through monitoring and blocking of data in transit.
SI-4partialcovers — A.8.12's focus on detecting/preventing data leakage (exfiltration) addresses only a narrow slice of SI-4's broad system monitoring objectives that also include attack detection, unauthorized connections, and general unauthorized use
AC-21covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
AC-4covers — A.8.12's DLP mechanisms (monitoring, filtering, blocking) for preventing unauthorized extraction implement a concrete slice of ac-4's information-flow enforcement policy, but ac-4's broader approved-authorization model, parameter-driven policy scope, and system-internal flows sit mostly outside A.8.12.
MP-7covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
SC-8covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (22)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

DE.CM-01gov DE.CM-03gov DE.CM-09gov ID.AM-07gov PR.AA-05gov PR.DS-01gov PR.DS-02gov PR.DS-10gov PR.PS-04gov

Why these map — AI rationale (under review)

PR.DS-01mostlyaligns with — The ISO control's use of DLP tools to identify, monitor, and block unauthorized disclosure of sensitive data directly supports protecting the confidentiality of data-at-rest.
PR.DS-02mostlyaligns with — Monitoring and blocking data exfiltration over email, file transfers, and uploads implements controls that protect the confidentiality of data-in-transit.
DE.CM-03partialaligns with — DLP monitoring of user actions and data movements on endpoints and networks fulfills the outcome of detecting potentially adverse events through personnel and technology usage monitoring.
ID.AM-07partialaligns with — Classifying and identifying sensitive information to protect against leakage presupposes an inventory of data and metadata for designated data types.
PR.AA-05partialaligns with — Requiring data-owner approval for exports and holding users accountable for actions outside organizational control enforces access permissions and authorizations.
PR.PS-04partialaligns with — The requirement to monitor channels and detect disclosure events generates log records that feed continuous monitoring and incident detection capabilities.
DE.CM-03implements — A.8.12's detection function directly operationalizes the monitoring of personnel activity and technology usage that DE.CM-03 names as its end-state, within the same adverse-event detection domain (though the CSF outcome does not name DLP specifically)
ID.AM-07implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.DS-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.DS-02implements — A.8.12's technical mechanisms for preventing unauthorized extraction and disclosure of information give operational effect to protecting confidentiality of data-in-transit within PR.DS-02's domain (though the CSF outcome does not name DLP specifically)
PR.PS-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (10)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V1.3.6←P V13.2.4←P →P V14.2.1←M →P V14.2.2←M V14.2.3←F →M V3.4.5←M V5.4.3→P

Why these map — AI rationale (under review)

V14.2.3mostlyaligns with — Both require controls that stop sensitive data from leaving the organization to untrusted external parties.
V13.2.4partialaligns with — Both rely on allow-listing permitted destinations to prevent unauthorized transmission of data.
V14.2.1partialaligns with — Both emphasize keeping sensitive data out of URLs and other locations where it could be inadvertently disclosed.
V5.4.3partialaligns with — Both call for scanning or blocking content that could carry sensitive or malicious data before it leaves the system.

Related weaknesses / CWE (41)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-591nonemitigates — DLP can detect leakage of sensitive data from swap, yet does not prevent the data from being written there.
CWE-1230finds — DLP solutions can detect and block metadata leakage, yet are not designed solely for this weakness.
CWE-1323prevents — DLP mechanisms can detect and block exfiltration of trace data.
CWE-200finds — By continuously inspecting data flows and blocking transmissions that contain classified sensitive content, the control stops the unauthorized release of information that would otherwise occur through missing or bypassed access-control checks.
CWE-201mitigates — DLP controls inspect and block outbound flows that contain sensitive information.
CWE-202finds — DLP can detect and block queries or result sets that risk exposing sensitive information.
CWE-212mitigates — DLP policies can block or sanitize sensitive data before it leaves the system.
CWE-213mitigates — DLP can block unintended disclosure arising from policy mismatches.
CWE-284mitigates — Enforcing egress rules on channels such as email and removable media reduces the impact of overly permissive access-control configurations by preventing data from leaving the authorized boundary even when access was granted.
CWE-312finds — When clear-text sensitive data is detected leaving controlled storage, the control can block the transfer, thereby limiting the exposure that would result from unencrypted storage on external media or cloud services.
CWE-313finds — DLP can detect and block attempts to write sensitive data in cleartext.
CWE-314mitigates — DLP can detect leakage of registry-stored secrets but does not prevent the storage itself.
CWE-315mitigates — Implements data leakage prevention that can block exfiltration of sensitive cookie data but does not stop the storage itself.
CWE-316mitigates — DLP tooling can monitor and block processes that leave sensitive data unencrypted in memory.
CWE-359prevents — Monitoring and quarantining outbound messages that contain personal or private data directly reduces the chance that such information will be disclosed to unauthorized recipients.
CWE-402finds — Data-leakage-prevention technologies specifically block unintended transmission of sensitive resources.
CWE-499mitigates — DLP can detect serialized sensitive data in transit but does not prevent the coding weakness itself.
CWE-515finds — DLP can detect or block covert storage flows but does not address all covert storage techniques.
CWE-524prevents — Data leakage prevention can block unauthorized access to cached sensitive information.
CWE-526mitigates — DLP policies can detect and block the placement of sensitive data into environment variables.
CWE-528mitigates — DLP can detect or block leakage of core-dump contents, yet is not the primary control for file placement.
CWE-532mitigates — DLP inspection of logs and file transfers can detect and block the inadvertent placement of sensitive tokens or credentials into externally accessible log files before they are written or transmitted.
CWE-539mitigates — Data leakage prevention controls can block or encrypt sensitive information in cookies.
CWE-598mitigates — DLP solutions can detect and block sensitive data in URLs.
CWE-612mitigates — Data leakage prevention can block unauthorized index exposure but is supplementary.
CWE-921mitigates — DLP can detect leakage but does not implement access controls on the storage mechanism itself.
CWE-927mitigates — DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.

Mitigated MITRE ATT&CK techniques (1161)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M →P T1001.001←M →P T1001.002←M →P T1001.003←M →P T1003←M →M T1003.001←M →P T1003.002←M →P T1003.003←M →P T1003.004←M →P T1003.005←M →P T1003.006→P T1003.007←M →M T1003.008←M →P T1005→P T1006←M →P T1007→P T1008←M →M T1010→P T1011←M →P T1011.001←M →P T1012→P T1014←M T1016→P T1016.001→P T1016.002→P T1018→P T1020←M →P T1020.001←M →P T1021→P T1021.001→P T1021.002←M →P T1021.003→P T1021.004→P T1021.005←M →P T1021.006→P T1021.007←M →P T1021.008→P T1025←M →P T1027→P T1027.001←M T1027.002←M →P T1027.003←M →P T1027.004←M →P T1027.005←M →P T1027.006←M →P T1027.007←M →P T1027.008←M T1027.009←M →P T1027.010←M →P T1027.011←M →P T1027.012←M →P T1027.013←M →P T1027.014←M T1027.015←M →P T1027.016←M T1027.017←M →P T1027.018←M →P T1029←M →P T1030←M →P T1033→P T1036←M →P T1036.001→P T1036.002←M →P T1036.003←M →P T1036.004←M →P T1036.005←M T1036.006→P T1036.007←M →P T1036.008←M →P T1036.009←M →P T1036.010→P T1036.011←M →P T1036.012←M →P T1037→P T1037.001→P T1037.002→P T1037.003→P T1037.004→P T1037.005→P T1039←M →P T1040←M →P T1041←M →P T1046→P T1047→P T1048←M →P T1048.001←M →P T1048.002←M →P T1048.003←M →P T1049→P T1052←M →P T1052.001←M →P T1053→P T1053.002→P T1053.003→P T1053.005→P T1053.006→P T1053.007→P T1055←M →P T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M →P T1055.005←M →P T1055.008←M →P T1055.009←M →P T1055.011←M →P T1055.012←M →P T1055.013←M →P T1055.014←M →P T1055.015←M →P T1056←M →P T1056.001→P T1056.002←M →P T1056.003→P T1056.004←M →P T1057→P T1059→P T1059.001→P T1059.002→P T1059.003→P T1059.004→P T1059.005→P T1059.006→P T1059.007→P T1059.008→P T1059.009→P T1059.010→P T1059.011→P T1059.012→P T1059.013→P T1068→P T1069→P T1069.001→P T1069.002→P T1069.003→P T1070←M →P T1070.003←M →P T1070.004→P T1070.005→P T1070.006←M →P T1070.007→P T1070.008←M →P T1070.009→P T1070.010→P T1071←M →P T1071.001←M →P T1071.002←M →P T1071.003←M →P T1071.004←M →P T1071.005←M →P T1072→P T1074←M →P T1074.001→P T1074.002←M →P T1078←P →P T1078.001→P T1078.002→M T1078.003→P T1078.004←M →P T1080→P T1082→P T1083→P T1087→P T1087.001→P T1087.002→P T1087.003→M T1087.004→P T1090←M →P T1090.001←M →P T1090.002←M →P T1090.003←M →P T1090.004←M →P T1091←M →P T1092←M →P T1095←M →P T1098→P T1098.001←M →P T1098.002←M →P T1098.003→P T1098.004→P T1098.005←M →P T1098.006→P T1098.007→P T1102←M →P T1102.001←M →P T1102.002←M →P T1102.003←M →P T1104←M →M T1105←M →P T1106→P T1110→P T1110.001→P T1110.002→P T1110.003→P T1110.004→P T1111→P T1112→P T1113→P T1114→P T1114.001←M →P T1114.002←M →P T1114.003←M →P T1115←M →P T1119←M →P T1120→P T1123←M →M T1124→P T1125←M →P T1127←M →P T1127.001←M →P T1127.002→P T1127.003←P →P T1129→P T1132←M →P T1132.001←M →P T1132.002←M →P T1133←M →P T1134←M →P T1134.001←M →P T1134.002←M T1134.003←P →P T1134.004←P →P T1134.005←P →P T1135→P T1136→P T1136.001→P T1136.002→P T1136.003→P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005←M →P T1137.006→P T1140→P T1176←M →P T1176.001←P →P T1176.002→P T1185←M →M T1187←M →P T1189→P T1190→P T1195←P T1195.001→P T1197←M →P T1199←P →P T1200←M →P T1202←M →P T1203←M →P T1204←M →P T1204.001←M →P T1204.002←M →P T1204.003→P T1204.004←M →P T1204.005←M →P T1205←M →P T1205.001→P T1205.002←M →P T1207←M →P T1210→P T1211←M →P T1212←M →P T1213←M →P T1213.001←M →P T1213.002←M →P T1213.003←P →P T1213.004←P →P T1213.005←M →P T1213.006←P →P T1216←M →P T1216.001←M →P T1216.002→P T1217→P T1218←M →P T1218.001←P →P T1218.002→P T1218.003←M →P T1218.004←M →P T1218.005←M →P T1218.007←M →P T1218.008←M →P T1218.009→P T1218.010←M →P T1218.011←M →P T1218.012←M →P T1218.013←M →P T1218.014→P T1218.015→P T1219←M →M T1219.001←M →P T1219.002←M →M T1219.003←M →P T1220←P →P T1221←M →P T1222←P →P T1222.001←M →P T1222.002←M →P T1480→P T1480.001←M T1482→P T1484←M →P T1484.001→P T1484.002←P →P T1485→P T1485.001→P T1486→P T1489→P T1490→P T1491.001→P T1496→P T1496.001→P T1496.002→P T1496.003→P T1496.004→P T1497←M T1497.001←M T1498→P T1499.002→P T1505→P T1505.001→P T1505.002←M →P T1505.003→P T1505.004→P T1505.005→P T1505.006→P T1518→P T1518.001→P T1518.002→P T1525→P T1526→P T1528←M →P T1530→P T1534←M →P T1535←M →P T1537→P T1538←M →P T1539←F →P T1542←M T1542.002←M →P T1542.003←M →P T1542.004→P T1542.005→P T1543→P T1543.001→P T1543.002→P T1543.003→P T1543.004→P T1543.005→P T1546→P T1546.001→P T1546.002→P T1546.003→P T1546.004→P T1546.005→P T1546.006→P T1546.007→P T1546.008→P T1546.009→P T1546.010→P T1546.011→P T1546.012→P T1546.013→P T1546.014→P T1546.015→M T1546.016→P T1546.017→P T1546.018→P T1547→P T1547.001→P T1547.002→P T1547.003→P T1547.004→P T1547.005→P T1547.006→P T1547.007→P T1547.008→P T1547.009→P T1547.010→P T1547.012→P T1547.013→P T1547.014→P T1547.015→P T1548←M →P T1548.001→P T1548.002←P →P T1548.003→P T1548.004→P T1548.005→P T1548.006←M →P T1550←M →P T1550.001←M →P T1550.002←F T1550.003←F →P T1550.004←F →P T1552←M →P T1552.001←M →P T1552.002→P T1552.003←M →P T1552.004→P T1552.005←M →P T1552.006←M →P T1552.007→P T1552.008→P T1553←P →P T1553.001←M →P T1553.002←P →P T1553.003←M →P T1553.004←P →P T1553.005←M →P T1553.006←M →P T1554→P T1555←P →P T1555.001→P T1555.002←M →P T1555.003←M →P T1555.004←M →P T1555.005→P T1555.006←M →P T1556←M →P T1556.001→P T1556.002→P T1556.003→P T1556.004→P T1556.005→P T1556.006←M →P T1556.007←M →P T1556.008→P T1556.009←M →P T1557←M →P T1557.001←M →P T1557.002←M →P T1557.003←M →P T1557.004←M →P T1558←P →P T1558.001→P T1558.002←M →P T1558.003→P T1558.005←P →P T1559→P T1559.001→P T1559.002→P T1559.003→P T1560←M →P T1560.001←M →P T1560.002→P T1560.003←P →P T1561→P T1561.001→P T1561.002→M T1563→P T1563.001→P T1563.002←M →P T1564→P T1564.001→P T1564.002→P T1564.003→P T1564.004→P T1564.005→P T1564.006→P T1564.007→P T1564.008→P T1564.009→P T1564.010→P T1564.012→P T1564.014→P T1565→M T1565.001→M T1565.002←P →M T1565.003→P T1566→P T1566.001→P T1566.002←M →P T1566.003←M →P T1566.004←M →P T1567→P T1567.001→P T1567.002→M T1567.003←M →P T1567.004←M →P T1568←P →P T1568.001→P T1568.002←M →P T1568.003←P →P T1569→P T1569.002→P T1569.003→P T1570←M →P T1571←M →M T1572←M →P T1573←M →P T1573.001←M →P T1573.002←M →P T1574←M →P T1574.001←M →M T1574.004←M →P T1574.005→P T1574.006←M →P T1574.007→P T1574.008→P T1574.009→P T1574.010→P T1574.011→P T1574.012→P T1574.013←M →P T1574.014→P T1578←M →P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005←P →P T1580→P T1583.002→P T1583.006←M T1583.007←M →P T1583.008→P T1584←M →P T1584.001←M →P T1584.002→P T1584.003←M →P T1584.004→P T1584.005→P T1584.006←M →P T1584.007←M →P T1584.008→P T1585→P T1585.002→P T1585.003←M →P T1586.001→P T1586.002←M →P T1586.003←M →P T1587.001→P T1587.002→P T1587.003→P T1588→P T1588.001→P T1588.002→P T1588.003→P T1588.004→P T1588.005→P T1588.006→P T1588.007→P T1589→P T1589.001←M →P T1589.002→P T1589.003→P T1590→P T1590.001→P T1590.002→P T1590.003→P T1590.004→P T1590.005→P T1590.006→P T1591→P T1591.002→P T1591.004→P T1592→P T1592.001→P T1592.002→P T1592.004→P T1593.002→P T1593.003→P T1594→P T1595→P T1595.002→P T1595.003→P T1596.004→P T1597→P T1597.001→P T1598←M →P T1598.001←M →P T1598.002←M →P T1598.003←M →P T1598.004←M →P T1599←M →P T1599.001←M →P T1600←M →P T1600.001←P →P T1601→P T1601.001←P →P T1601.002←M →P T1602→P T1602.001→P T1602.002←M →P T1606←M →P T1606.001←F →P T1606.002←M →P T1608→P T1608.001→P T1608.002→P T1608.003→P T1608.005←M →P T1609→P T1610←P →P T1611←M →P T1612←M →P T1613→P T1614→P T1614.001→P T1615→P T1619→P T1620←M →P T1621←M →P T1622←P T1647←P T1648←P →P T1649→P T1651→P T1652→P T1654→P T1657→P T1659←M →P T1665←M →P T1666←M →P T1667→P T1671←M →P T1673→P T1674←M →P T1675→P T1677←P →P T1678←P T1679→P T1680→P T1681→P T1683→P T1683.002→P T1684←M →P T1684.001←M →P T1684.002←M →P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M →P T1685.004←M →P T1685.005←M →P T1685.006←M →P T1686←M →P T1686.001→P T1686.002←M →P T1686.003←M →P T1687←P →P T1688←M T1689←P →P T1690←P →P

Why these map — AI rationale (under review)

T1001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (including via network transmissions or untrusted services), which surfaces some forms of obfuscated C2 traffic when it carries or exposes sensitive information; however, the control is scoped to data leakage of classified/sensitive assets rather than arbitrary adversary C2 obfuscation techniques such as junk data or protocol impersonation that do not involve exfiltrating organizational data.
T1001.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (including in network transmissions and to untrusted services), which surfaces junk-data C2 obfuscation when it traverses monitored channels; partial because the clause's scope is set by what the organization classifies/monitors as sensitive, leaving non-sensitive or unmonitored C2 outside that boundary.
T1001.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in transfers, uploads, emails, and unstructured data), which surfaces steganographic hiding of C2 data when it matches monitored sensitive patterns or channels; partial because detection is scoped to organization-defined sensitive information and channels rather than all stego uses.
T1001.002prevents — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information in transfers (including to untrusted services), and blocking transmissions that expose it; this directly stops steganographic C2 embedding in files or messages from successfully exfiltrating hidden data, but only for data the organization has identified/classified as sensitive and only where DLP tooling or equivalent is deployed — a genuine slice rather than the bulk of all possible stego uses.
T1001.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent via network services or to untrusted cloud endpoints), which surfaces disguised C2 traffic that blends with or impersonates legitimate protocols/services when it carries or exposes sensitive data.
T1003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when extracted/uploaded), and auditing; credential material qualifies as sensitive data at risk of unauthorized disclosure or espionage, so the control surfaces the T1003 action in most cases (network, email, exfil, endpoint DLP) though local in-memory dumping without observable channel may remain unseen.
T1003.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when extracted and exfiltrated via email, file transfer, cloud upload or portable media), which surfaces LSASS credential dumping when the resulting material is handled or moved, but does not observe the in-memory access or dump creation itself.
T1003.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including credential material like SAM hashes) via email, file transfers, uploads, or exfiltration, which covers the post-extraction transmission or processing steps of T1003.002 even if initial in-memory/registry access is not always instrumented.
T1003.002prevents — A.8.12's DLP tools and monitoring can block extraction/transmission of the SAM file or hashes when they match sensitive-data patterns (e.g. via registry/file channels or exfil), but this is only a slice: the technique runs in-memory at SYSTEM level before any file or transmission occurs, and credential material is not reliably identifiable as 'sensitive' by pattern-based DLP.
T1003.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in backups and unstructured data), and auditing, which surfaces the NTDS copy/exfiltration attempt in most covered channels and data states.
T1003.003prevents — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information (including in backups), and blocking transmissions or user actions that expose it, which stops many NTDS.dit extraction paths such as email/file-transfer of copies or unapproved exports; it reaches only a slice because the technique can succeed entirely in-memory or locally on a domain controller without ever triggering a monitored channel or DLP rule.
T1003.003responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which bounds an in-progress NTDS copy/extraction once underway, but only for the subset of techniques that trigger detectable leakage channels rather than all listed methods (e.g. offline backup access or ntdsutil).
T1003.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; this surfaces the exfiltration of credential material such as LSA secrets but only for cases where the organization has pre-classified those secrets as sensitive and the extraction uses a monitored channel, leaving the dominant in-memory/registry SYSTEM-level dump outside that scope.
T1003.004prevents — A.8.12's DLP tools and monitoring can block extraction/transmission of identified sensitive credential material (including LSA secrets treated as such) via channels like email, file transfer or clipboard, but do not stop the initial local SYSTEM-level registry or memory access that realises the technique on-host.
T1003.005detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; cached credential extraction via SYSTEM-level tools can be surfaced as anomalous sensitive-data movement or access, but this is only a slice of the technique's stealthy local dumping behaviors.
T1003.006detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including credential-like data), and auditing; this surfaces some DCSync realizations when they transit monitored channels or trigger DLP rules, but the core in-memory API abuse on a DC is outside typical DLP scope.
T1003.007detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, email), and acting on it; credentials in /proc memory match the sensitive-data patterns these tools target on Linux systems, though coverage is not exhaustive for all in-memory credential patterns or non-monitored processes.
T1003.008detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when files are read/exfiltrated), and auditing; this surfaces the T1003.008 action on Linux systems where the files or their contents match monitored sensitive patterns, but only a slice (not most) because the control is scoped to organization-defined sensitive data and channels rather than all credential-dumping attempts.
T1003.008prevents — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information (including credential files), and blocking transmissions or user actions that would exfiltrate it; this stops the technique for non-privileged users on monitored Linux endpoints, but the control's scope is data-leakage tooling and policy rather than universal enforcement of file permissions or privilege boundaries, leaving a genuine remainder where root-level access or unmonitored vectors succeed.
T1005detects — A.8.12 explicitly requires monitoring channels, identifying/monitoring sensitive information at risk, and detecting its disclosure (including on local/unstructured data and before exfil), which surfaces T1005 activity on local systems; the remainder is purely passive collection that leaves no observable channel or disclosure event.
T1005prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, transfers, copy-paste, uploads) can stop exfiltration of discovered local data, but the control does not prevent the local search/collection step itself (T1005's core) and leaves many on-system discovery vectors (CLI, scripts, process memory) untouched.
T1006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; this surfaces T1006's direct volume reads of sensitive data in some channels but leaves the bulk of low-level bypasses (raw disk, shadow copies, non-monitored exfil) outside its defined scope.
T1007detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information; while this can surface anomalous service-discovery commands that exfiltrate or leak service data, the control is scoped to sensitive-information channels rather than general discovery behaviors, leaving most of T1007 (local enumeration without leakage) unreached.
T1008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including uploads, email, file transfers), which surfaces fallback-channel C2 traffic when it exfiltrates or crosses monitored boundaries.
T1010detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data on user systems), and auditing (e.g. of screenshots), which would surface T1010 when the discovered windows reveal or enable leakage of classified/sensitive data; this is a genuine but minority slice of the technique's total scope (any window enumeration, on any platform, for any purpose).
T1011detects — A.8.12 explicitly requires monitoring channels of data leakage (including email, file transfers, mobile devices, portable storage and network transmissions) and using DLP tools to detect disclosure of sensitive information, which directly surfaces T1011 exfiltration attempts over alternate media such as WiFi, Bluetooth, cellular or RF when those channels are in scope.
T1011prevents — A.8.12 explicitly requires monitoring channels of data leakage (incl. portable devices, wireless), blocking transmissions that expose sensitive data, and restricting copy/paste or uploads to external media/services, which directly stops exfiltration over alternate mediums such as WiFi, Bluetooth, cellular or RF before it succeeds; partial because the control is scoped to identified/classified sensitive information and approved export paths rather than all possible exfiltration of any data over any alternate medium.
T1011responds — A.8.12 explicitly requires monitoring channels, detecting disclosures, blocking transmissions that expose sensitive data, and acting on events (quarantine, DLP tools, honeypots as response), which contains or eradicates an exfiltration event once underway over alternate media; partial because it is scoped to monitored/identified sensitive information and approved channels rather than all possible exfiltration media or adversary-chosen paths.
T1011.001detects — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices and mobile devices) plus DLP tools that detect disclosure of sensitive information, which covers Bluetooth exfiltration as an out-of-band channel when in scope of the monitoring policy.
T1011.001prevents — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices and mobile devices) and blocking transmissions or user actions that expose sensitive information; Bluetooth exfiltration is a named channel that can be monitored and blocked when DLP tooling or configuration is applied to it, but the control's scope is limited to what the organization classifies/monitors and does not universally reach all Bluetooth use on all platforms.
T1012detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including in unstructured data or exfiltration attempts), which surfaces some Registry queries that expose or transmit sensitive data but leaves the bulk of local, non-exfiltrating T1012 queries (e.g., purely internal discovery of config/software) outside its scope.
T1016detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, portable devices) and using DLP tools to detect disclosure of sensitive information, which can surface network-configuration discovery commands or exfiltration of the resulting data when it traverses a monitored channel; this is a genuine but minority slice of the technique itself (most T1016 executions stay local and never trigger outbound DLP).
T1016.001detects — A.8.12 explicitly requires monitoring channels of data leakage (including network transmissions) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent), which surfaces Internet connectivity checks that exfiltrate or test C2 reachability; this is only a slice of all discovery methods, as many are local and non-networked.
T1016.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; Wi-Fi credentials stored on hosts qualify as classifiable sensitive information whose extraction via discovery commands or file reads can be surfaced by such monitoring, but the clause's scope is limited to data-leakage channels and does not broadly instrument all discovery behaviors on all platforms.
T1018detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this can surface T1018 when the discovery enumerates or exfiltrates host/network data that matches sensitive patterns, but most passive/local discovery (ping, ARP cache, hosts file reads) produces no detectable sensitive-data event.
T1020detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure events such as uploads to untrusted clouds or email transmission of sensitive information, which directly surfaces automated exfiltration of gathered data.
T1020prevents — A.8.12 explicitly requires monitoring channels, detecting disclosure events, and blocking transmissions or user actions that would exfiltrate sensitive data (including via DLP tools that quarantine or stop automated outbound transfers), which stops most automated exfiltration before it succeeds; the named remainder is exfiltration that evades the chosen monitoring scope or uses channels outside the DLP's coverage.
T1020responds — A.8.12 explicitly includes acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration in flight) and adversary-oriented responses such as honeypots or disinformation once intelligence-gathering actions are recognized, which matches the `responds` verb for an already-underway automated exfiltration; it is only partial because the clause is primarily oriented toward prevention/detection and the response slice is narrower than the full technique surface (e.g., post-exfiltration eradication or C2-specific containment is not addressed).
T1020.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and acting on it, which surfaces traffic-duplication-based exfiltration of that information in the monitored channels.
T1020.001prevents — A.8.12 explicitly requires monitoring channels of data leakage, detecting disclosure (including network transmissions and uploads), and blocking those transmissions or user actions that would expose sensitive information, which directly stops the automated exfiltration step of traffic duplication on monitored paths; partial because the control is scoped to sensitive/classified data and chosen monitoring/enforcement points rather than universally blocking all mirroring configurations or device-level abuses.
T1021detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile/portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud or email), which surfaces some T1021 abuse when it involves exfiltration or sensitive data movement over those channels, but the bulk of T1021 (credentialed remote logins via SSH/RDP/VNC for lateral movement or RCE without data leakage) lies outside DLP scope.
T1021.001detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces anomalous RDP sessions or data exfiltration that may follow legitimate-looking RDP logins; this is a genuine but minority slice of the technique itself (which is primarily about using valid accounts to establish the session).
T1021.002detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent), which surfaces SMB-based file copy/exfiltration of classified data but does not broadly instrument or surface the lateral movement technique itself across all uses.
T1021.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted services), which surfaces some DCOM lateral-movement activity when it involves observable data exfiltration or anomalous remote COM calls, but leaves the bulk of DCOM technique execution (registry ACL use, shellcode via Office objects, WMI interaction) outside DLP scope.
T1021.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), and auditing; this surfaces some SSH-based exfiltration of classified data but does not broadly detect the login technique itself or non-sensitive uses.
T1021.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent), and auditing (including screenshots), which surfaces VNC-based exfiltration or collection of sensitive data in flight or after the fact; this is only a slice of the technique because VNC can be used for non-sensitive actions like running commands or pivoting without triggering data-oriented detection.
T1021.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces WinRM-based exfiltration or lateral actions that move or expose data, but only for the data-leakage slice of the technique rather than all WinRM usage.
T1021.007detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services), which surfaces the T1021.007 technique when it involves exfiltration or access to cloud-hosted resources containing such data, but this is scoped only to sensitive-data flows rather than all logins or management actions via valid accounts.
T1021.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent to untrusted cloud services), and acting on it; this surfaces the adversary's use of a cloud VM connection to exfiltrate or interact with sensitive data on IaaS, but only for the data-leakage slice rather than the login/pivot technique itself.
T1025detects — DLP policies can detect and block the transfer of classified data onto removable media, directly preventing collection via USB or other portable devices.
T1025prevents — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices and removable media) plus blocking transmissions or user actions that expose sensitive information, which stops the adversary's collection from removable media before exfiltration in the cases covered by DLP tooling or configuration.
T1027detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces some obfuscated payloads or encoded content when they traverse monitored vectors, but does not address on-system obfuscation, command obfuscation, or non-sensitive-file cases that dominate T1027.
T1027.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosure or exfiltration attempts (including to untrusted services), which surfaces packed malware artifacts or outbound packing-related activity in a minority of cases but does not broadly detect the in-memory packing technique itself.
T1027.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure (including exfiltration of images or files containing hidden data), but does not guarantee detection of all steganography variants especially when the carrier is not flagged as sensitive or the technique is novel.
T1027.003prevents — A.8.12's DLP tools and monitoring explicitly target detection and blocking of unauthorized disclosure/extraction of sensitive information (including via email, file transfers, uploads to untrusted services, or exfiltration of hidden data in media), which directly stops many steganography-based exfiltration cases before they succeed; partial because it does not address all in-memory stego uses, non-sensitive data, or pre-exfil hiding steps like Invoke-PSImage for local execution.
T1027.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in files, email, uploads, and unstructured data), which surfaces some instances of delivered source-code payloads that contain or embed sensitive material, but does not address the technique's core obfuscation or compilation steps for non-sensitive payloads.
T1027.005detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosures (e.g. uploads or emails of sensitive data), which surfaces the presence of modified tools that carry or exfiltrate indicators; this is a genuine but minority slice of the class, as the bulk of T1027.005 is about post-quarantine code changes that are not themselves disclosures of sensitive organizational data.
T1027.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent or in unstructured data), which surfaces HTML smuggling attempts that exfiltrate or deliver hidden payloads; partial because it is scoped to sensitive/identified information and monitored channels rather than all possible HTML smuggling instances.
T1027.006prevents — A.8.12 explicitly requires monitoring channels (email, file transfers, web uploads) and blocking transmissions or user actions that expose sensitive information, which directly stops many HTML-smuggling delivery vectors that rely on benign-looking HTML/JS reaching the victim; it reaches only a slice because the technique can still succeed via non-monitored vectors, local generation after initial delivery, or non-sensitive-data payloads that DLP rules ignore.
T1027.007detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in files, email, uploads, and unstructured data on user systems), which surfaces dynamic API resolution artifacts when they involve exfiltration or leakage of sensitive data, but the control does not address the core technique of runtime API obfuscation itself.
T1027.009detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosure of sensitive information (including in files, email, uploads, and unstructured data on user systems), which surfaces some embedded-payload cases when the carrier is treated as sensitive or the extraction/transfer is monitored; it does not broadly instrument or flag the embedding act itself across all file formats and adversary techniques.
T1027.010detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces obfuscated command content when it traverses those channels or involves exfiltrated data; this is a genuine but minority slice of T1027.010's full scope of impeding detection during local command execution.
T1027.011detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, email), and auditing; this surfaces some fileless storage of collected/staged data that would otherwise be concealed, but the control is scoped to sensitive/organizational data leakage rather than arbitrary adversary payloads or persistence artifacts in registry/WMI/shared memory, leaving most of the technique's concealment use-cases outside its view.
T1027.012detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in files, email, uploads, and unstructured data), which would surface LNK icon smuggling when it exposes or exfiltrates sensitive payloads, but only for the subset of uses involving detectable sensitive data rather than all instances of the technique.
T1027.013detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosure of sensitive information (including in files on user systems or during exfiltration), which surfaces some instances of this obfuscation technique when it involves exfiltrating or exposing encoded/encrypted malicious files; however, it does not broadly detect the core technique of adversaries creating/using such files for local obfuscation on victim hosts.
T1027.015detects — A.8.12 explicitly requires monitoring channels (email, file transfers, portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), which surfaces compressed malicious payloads in those vectors but does not address compression of shellcode, registry storage, or non-sensitive-file obfuscation on Linux/macOS.
T1027.017detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in unstructured data, email, uploads, file transfers); SVG smuggling is a file-based exfiltration vector that can be surfaced by content inspection or anomaly detection on those channels, but the technique's stealth (benign-looking image format, embedding in HTML/PDF, script-based payloads) leaves substantial coverage gaps that DLP tools often miss without specific SVG/XML parsing rules.
T1027.017prevents — A.8.12 explicitly requires monitoring channels, detecting disclosures, and blocking transmissions or user actions that expose sensitive information (including via DLP tools that quarantine or stop outbound data), which directly stops SVG smuggling of malicious payloads past content filters in email, file transfers, uploads, or copy/paste; partial because the control is scoped to sensitive/identified data and does not address all SVG forms (e.g., local assembly or non-sensitive vectors).
T1027.018detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in unstructured data, emails, uploads), which surfaces some Unicode-hidden payloads when they cross monitored vectors, but the control is scoped to sensitive/organizational data leakage rather than arbitrary malicious concealment and does not address the technique in code/scripts at rest or non-sensitive uses.
T1029detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email, uploaded to untrusted cloud services, or exfiltrated), which surfaces scheduled exfiltration events once they trigger a transfer.
T1029prevents — A.8.12's DLP tools and channel monitoring can block scheduled exfiltration transmissions (e.g. by detecting and quarantining sensitive data uploads or transfers at the monitored time), but this is only a slice: the technique's core (scheduling to blend with normal activity) and many transfer vectors remain unaddressed, and the clause is silent on timing-based evasion.
T1030detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded), and acting on it; this surfaces the exfiltration attempt even if chunked to evade size thresholds, but only where the content or channel is in scope for the DLP ruleset rather than all possible transfers.
T1030prevents — A.8.12 explicitly requires monitoring channels, detecting disclosures, and blocking transmissions that expose sensitive information (including via DLP tools), which stops many size-limited exfiltration attempts that would otherwise succeed; it is only partial because the control is scoped to identified/classified sensitive data and monitored channels, leaving unclassified data, unknown channels, or sub-threshold transfers that evade the configured thresholds as a genuine remainder.
T1033detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via email, file transfers, uploads, and unstructured data), which can surface T1033 when it involves exfiltrating or exposing user/system ownership details through those channels, but does not broadly detect local command-based discovery like whoami or environment variable reads.
T1036detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces masquerading artifacts when they carry or expose protected information; this is a genuine but minority slice of T1036's broad evasion surface across any artifact type or platform.
T1036.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads or transmissions), which can surface an adversary's use of an invalid-signature binary if it carries or exfiltrates monitored data; however, the control is scoped to data-leakage events rather than to code-signature anomalies themselves, leaving most instances of T1036.001 undetected.
T1036.002detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in files, email, uploads), which surfaces the disguised benign-looking file that would otherwise evade notice; partial because the control is scoped to sensitive/classified data and chosen monitoring channels rather than all RTLO abuse anywhere (e.g. non-sensitive files or registry use outside DLP scope).
T1036.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads, emails or exfiltration), which surfaces renamed/masqueraded utilities when they are used to move or transmit monitored data; this is a genuine but minority slice of the technique (most renaming occurs without data movement and evades name/path-based detection).
T1036.004detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads/emails), which can surface masquerading tasks/services when they trigger data-leakage observables, but this is only a slice of the technique's core naming/description manipulation that does not require exfiltration.
T1036.006detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via file transfers or user actions), which would surface the anomalous executable disguised as a benign file type in monitored channels, but the control is scoped to data-leakage contexts rather than all instances of this filename trick on Linux/macOS endpoints.
T1036.007detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or attachments), which surfaces double-extension masquerading when it involves exfiltration or email-borne payloads, but leaves most local filename-based deception (non-sensitive files, non-monitored channels, pre-disclosure) unreached.
T1036.008detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk of disclosure, and using DLP tools to detect when information is uploaded/sent; this surfaces masquerading attempts that rely on benign-looking file types during transfer or exfiltration, but only for data classified as sensitive and only where DLP coverage is implemented.
T1036.008prevents — A.8.12's DLP tools and monitoring explicitly block network transmissions, email, file uploads, and copy/paste of sensitive data that would otherwise allow masqueraded payloads to be transferred or stored without detection, but the control is scoped only to identified/classified sensitive information and does not address all masquerading vectors (e.g., polyglots, non-sensitive benign-looking files, or local filesystem changes).
T1036.009detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information; while this is not aimed at process-tree evasion, the broad monitoring of anomalous user/system actions (including process anomalies that could signal leakage or espionage) surfaces a genuine but minority slice of T1036.009 behaviors on Linux/macOS.
T1036.010detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in backups or exfiltration), which surfaces masquerading service accounts tied to data backups or similar when they trigger leakage events, but this is only a slice of the technique's account-creation/renaming behaviors across all platforms and contexts.
T1036.011detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which can surface the anomalous process-name spoofing that T1036.011 produces in tools like ps or logs; this is a genuine but minority slice of the technique's Linux in-memory focus, not its full scope.
T1036.012detects — A.8.12 explicitly requires monitoring channels (email, file transfers, network transmissions, cloud uploads) and using DLP tools to detect disclosure of sensitive information; browser fingerprinting via crafted HTTP headers or user-agent spoofing can be surfaced as anomalous when it deviates from established baselines or triggers outbound channel monitoring, but this is only a minority slice of the technique (most fingerprinting occurs via passive collection or non-sensitive channels outside DLP scope).
T1037detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when sent to untrusted services or via email); boot/logon scripts that send information to an internal logging server or exfiltrate data match this detection surface, but the technique's core persistence and privilege-escalation aspects (local/remote script execution without data movement) lie outside DLP's scope.
T1037.001detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information, which can surface anomalous logon-script activity when it involves exfiltration or sensitive data movement, but the control does not target registry writes, logon initialization, or persistence behaviors themselves.
T1037.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via file transfers, uploads, and system-level actions), which would surface the plist modification or script execution if it involves exfiltrating or exposing sensitive data, but the core technique is local persistence via admin-level plist edit with no inherent data leakage or disclosure
T1037.003detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions), which can surface anomalous logon-script activity that exfiltrates or references sensitive data, but this is only a slice of the persistence technique itself and does not broadly detect script assignment or execution absent data movement.
T1037.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers or uploads), and auditing; this surfaces the act of modifying/adding to RC scripts when it involves exfiltrating or leaking the sensitive payload, but does not broadly detect the persistence mechanism itself on non-sensitive or non-monitored paths.
T1037.005detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via file transfers, uploads, and system-level actions), which would surface the creation or presence of a root-level StartupItems persistence artifact when it involves exfiltrating or exposing monitored sensitive data, but this is only a slice of the technique's core persistence behavior on macOS.
T1039detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when accessed or moved from network shares), and auditing, which surfaces the T1039 collection activity on monitored paths.
T1039prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, transfers, uploads, copy-paste) can stop exfiltration of discovered data from network shares, but do not stop the initial search/gather step on already-accessible shares, leaving a large slice of the technique untouched.
T1040detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud or email), which surfaces some sniffing-derived exfiltration of cleartext credentials or data; this is a genuine but minority slice of T1040's passive capture mechanics across platforms, with the bulk (e.g. on-wire promiscuous mode, span ports, cloud mirroring, network device CLI captures) outside DLP's typical vantage.
T1040prevents — A.8.12 explicitly requires monitoring channels of data leakage (incl. network), detecting disclosure of sensitive information in transit (incl. to untrusted services), and blocking transmissions that expose it, which stops passive sniffing from successfully capturing/exfiltrating sensitive data when DLP tools or configs are applied; partial because it depends on identifying/classifying the sniffed data as sensitive, does not address unencrypted non-sensitive traffic or non-DLP sniffing on network devices, and the control's espionage/honeypot elements are unrelated.
T1041prevents — By inspecting traffic on common exfiltration channels such as email or web uploads, DLP can interrupt data being sent over established C2 channels.
T1041detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded to untrusted services), which surfaces exfiltration of stolen data over a C2 channel as anomalous outbound traffic; the remainder is non-sensitive or non-monitored channels.
T1041responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration) and responding to adversary intelligence actions (e.g. honeypots, disinformation), which bounds an in-progress T1041 exfil once underway, but only for channels and data types the organization has instrumented and classified.
T1046detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which would surface many network service discovery scans that transmit probes or exfiltrate results; however, purely local reconnaissance (e.g. mDNS queries or offline port scans with no sensitive data movement) falls outside its scope.
T1047detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, uploads, or exfiltration), and this surfaces some but not most WMI abuse since WMI is a general local/remote execution mechanism whose data-leakage subset (e.g. exfiltrating results of discovery or commands) is only a minority slice of the technique.
T1048detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or via email), which directly surfaces T1048 exfiltration over alternate protocols such as FTP/SMTP/HTTP/S/DNS/SMB.
T1048prevents — A.8.12 explicitly requires monitoring channels and blocking transmissions (including via DLP tools that stop uploads, email, file transfers, and copy actions) that would realize exfiltration over alternate protocols such as FTP/SMTP/HTTP/S/SMB; the named remainder is adversary use of encryption/obfuscation, cloud console/API downloads inside authorized sessions, or non-monitored channels.
T1048responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which engages containment/eradication once T1048 exfiltration is underway; partial because it is scoped to monitored channels/sensitive data and does not address all alternate-protocol cases (e.g. DNS, SMB, or IaaS console downloads outside DLP scope).
T1048.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including uploads to untrusted services or email), which surfaces T1048.001 exfiltration events when they involve identifiable sensitive data over non-C2 protocols.
T1048.001prevents — A.8.12's DLP tools and monitoring explicitly detect and block network transmissions or uploads of sensitive data (including to untrusted services), which stops the exfiltration technique from succeeding even when symmetric encryption is layered on otherwise-unencrypted protocols.
T1048.001responds — A.8.12 explicitly requires monitoring channels, detecting disclosures (including uploads and email), blocking transmissions that expose sensitive data, and acting on detected leakage (quarantine, DLP tools), which directly contains and eradicates an exfiltration event once underway; partial because the control is scoped to sensitive/classified information and monitored channels rather than all symmetric exfil over non-C2 protocols.
T1048.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services or sent via email), which directly surfaces T1048.002 exfiltration events over asymmetric encrypted protocols such as HTTPS/TLS.
T1048.002prevents — A.8.12 explicitly requires monitoring channels, detecting disclosure (e.g. uploads to untrusted cloud or email), and blocking transmissions or user actions that expose sensitive data, which directly stops exfiltration of that data over asymmetric encrypted protocols such as HTTPS/TLS.
T1048.002responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration in flight) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which matches the `responds` verb of containing/eradication once the exfiltration technique is underway; partial because the clause is scoped to sensitive/identified data channels and does not address all asymmetric exfil paths or post-realization cleanup.
T1048.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including uploads to untrusted services or email), which surfaces T1048.003 exfiltration over unencrypted non-C2 protocols such as HTTP/FTP; the named remainder is obfuscated or non-sensitive data outside the DLP policy scope.
T1048.003prevents — A.8.12 explicitly requires monitoring channels and using DLP tools to detect and block transmissions (including to untrusted cloud/email) that expose sensitive data over unencrypted protocols such as HTTP/FTP, directly stopping the exfiltration technique in most cases; the named remainder is obfuscated/embedded data or non-monitored channels that evade detection.
T1048.003responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which engages the containment/eradication core of `responds` once unencrypted exfiltration is underway; partial because the clause is scoped to sensitive/identified data channels and does not address all protocol variants or post-exfiltration artifacts across every platform.
T1049detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions), which can surface network-discovery commands when they exfiltrate or expose connection data, but the control is scoped to sensitive-information flows rather than all discovery activity and does not address local-only enumeration or non-sensitive network queries.
T1052detects — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices and file transfers) plus DLP tools that detect disclosure of sensitive information, which directly surfaces T1052 attempts when removable media is the exfiltration vector; the remainder is air-gapped systems or offline media outside monitored channels.
T1052prevents — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices), blocking transmissions/actions that expose sensitive information, and restricting copy/paste or upload to external media/devices via DLP tools or configurations, which directly stops most T1052 exfiltration over removable physical media (with named remainder for air-gapped or non-monitored edge cases).
T1052responds — A.8.12 explicitly requires monitoring channels (incl. portable storage devices), detecting disclosure, blocking transmissions/actions that expose sensitive data, and quarantining, which directly acts on an ongoing exfiltration event once underway to contain/eradicate it; partial because physical-medium hops in fully air-gapped scenarios and post-copy screenshots/photographs fall outside the tool-based blocking emphasis.
T1052.001detects — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices and file transfers) plus DLP tools that detect disclosure of sensitive information, which directly surfaces T1052.001 exfiltration attempts over USB; the remainder is non-technical or non-monitored channels such as screenshots/photographs addressed only by policy/training.
T1052.001prevents — A.8.12 explicitly requires monitoring channels such as portable storage/USB, detecting sensitive data movement to such devices, and blocking transmissions or user actions (including copy to removable media via DLP tools or config), directly stopping most T1052.001 exfiltration paths; the named remainder is physical insertion on fully air-gapped systems without any monitoring or policy enforcement.
T1052.001responds — A.8.12 explicitly requires monitoring channels (incl. portable storage/USB), detecting disclosure, blocking transmissions or user actions that expose sensitive data, and quarantining — which directly contains and eradicates an in-progress USB exfiltration once underway.
T1053detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads, emails), and auditing; this surfaces some T1053 abuse when the scheduled job triggers observable leakage, but most T1053 executions (persistence, initial access, privilege escalation without exfil) fall outside DLP scope.
T1053.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces some scheduled malicious executions that involve exfiltration or leakage of sensitive data, but the bulk of T1053.002 (persistence, local execution, privilege escalation, lateral movement without data disclosure) lies outside DLP scope.
T1053.003detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via file transfers and uploads), which surfaces cron-based persistence when it involves exfiltrating or staging sensitive data through monitored vectors, but this is only a slice of cron abuse since most cron jobs for persistence do not inherently trigger data-leakage detection.
T1053.005detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which can surface scheduled-task abuse when it triggers observable exfiltration or anomalous data movement, but the technique's core creation/execution steps (schtasks, registry changes, hidden tasks) are not themselves data-leakage events and fall outside the control's defined detection scope.
T1053.006detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which can surface systemd-timer-based persistence when the scheduled malicious code triggers exfiltration or other observable leakage events; however this is only a slice of the technique because many timer-based executions (e.g., purely local non-exfiltrating payloads) produce no detectable leakage.
T1053.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which can surface anomalous container-orchestration jobs that exfiltrate or stage data, but the clause's scope is limited to data-movement channels and does not broadly instrument scheduling or job-creation primitives themselves.
T1055detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk, and detecting its disclosure (including via tools that surface uploads, emails, or exfiltration), which surfaces many process-injection behaviors that move or access sensitive data across process boundaries.
T1055.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, and exfiltration), which surfaces some in-process or memory-resident DLL injection artifacts when they trigger observable data-movement events, but the bulk of T1055.001 (API call sequences, reflective loading, module stomping) is invisible to data-leakage-focused tooling.
T1055.002detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, emails), which can surface PE injection when it involves exfiltrating or moving sensitive data, but this is only a slice of the technique's core in-memory execution and evasion behaviors that do not trigger data-leakage observables.
T1055.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, or transmissions), which can surface anomalous process behavior or exfiltration tied to hijacked threads, but only for a slice of cases involving data movement rather than the injection act itself.
T1055.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which surfaces some in-process or exfiltration behaviors that APC injection may trigger when it enables access to memory/resources, but the control has no view of the injection technique itself or most of its stealthy execution variants.
T1055.005detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, and transmissions), which can surface anomalous process behavior or data exfiltration tied to TLS callback injection on Windows; however, this is scoped to data-leakage patterns rather than the memory-manipulation technique itself, leaving most in-process injection variants outside the primary detection surface.
T1055.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and auditing; this surfaces some ptrace-based injection events when they involve observable exfiltration or anomalous data movement on Linux, but the core technique (attaching via ptrace to modify memory/registers for in-process execution) is not a data-leakage event and can occur without triggering DLP channels or tools.
T1055.009detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and monitoring for anomalous behaviour that can surface proc-memory injection as it occurs; this is a genuine but minority slice of the Linux-specific technique whose dominant observables (enumeration of /proc/[pid]/maps, dd-based overwrite of stack) sit outside typical DLP scopes focused on data exfiltration rather than in-process memory manipulation.
T1055.011detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including in unstructured data or exfiltration attempts); this surfaces some in-process anomalous behaviors that result in data movement, but EWM injection itself is a stealthy memory-resident technique that evades process-based defenses and is not a data-leakage event until exfiltration occurs, leaving most of the technique undetected.
T1055.012detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, or transmissions), which can surface process-hollowing activity when it involves exfiltration or anomalous data movement, but the control does not address in-process memory manipulation or the core evasion of process-based defenses described in T1055.012.
T1055.013detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in memory/unstructured data and network transmissions), which surfaces the in-memory execution and evasion aspects of process doppelganging when it risks exfiltrating or exposing data, but this is only a slice as the technique itself is fileless memory manipulation that does not inherently involve data leakage or monitored channels.
T1055.014detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and broader monitoring for anomalous behaviour that can surface process-injection techniques like VDSO hijacking when they trigger observable data exfiltration or espionage-related leakage; this is only a slice of the Linux-specific technique, which primarily evades detection while running in-process without necessarily causing immediate leakage.
T1055.015detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and acting on detected events; this surfaces some ListPlanting activity when it involves observable data movement or exfiltration of sensitive information, but the core in-memory code injection, window-message passing, and callback execution are not data-leakage events and remain unseen by DLP-focused mechanisms.
T1056detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces many forms of input capture once the captured data moves; this is a genuine but minority slice of T1056 because transparent in-memory hooking (the dominant sub-technique) has no outbound data to detect and the clause's scope is limited to organization-defined channels rather than all possible capture.
T1056.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via user actions like copy/paste or uploads), which surfaces keylogging when it transmits captured keystrokes but does not broadly instrument for all in-memory/hooking/driver-based methods on all platforms.
T1056.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), and auditing; this surfaces credential-capture prompts that transmit harvested data but does not broadly detect the local GUI-mimic technique itself across all platforms and variants.
T1056.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted services or email), which surfaces credential capture on an external portal when it involves transmission or exfiltration of the captured data; this is a genuine but minority slice of the technique's full scope (which also includes silent local installation and non-transmitting capture).
T1056.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including credentials) in transit or exfiltration, but this covers only the post-hook leakage event and not the in-process API hooking itself
T1057detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information, which can surface process-discovery commands (e.g. tasklist, ps, Get-Process) when they transmit or exfiltrate process lists containing classified data, but this is scoped only to leakage of protected information rather than all instances of the technique.
T1059detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), and auditing; this surfaces some T1059 abuse when it involves exfiltrating or transmitting sensitive data but does not broadly detect interpreter abuse for arbitrary command execution.
T1059.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or exfiltration), which surfaces some PowerShell-based discovery or download actions when they involve monitored sensitive data or channels, but does not broadly detect arbitrary PowerShell execution, in-memory abuse, or non-data-leakage uses.
T1059.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or exfiltration), which surfaces some AppleScript-driven behaviors when they trigger observable data-movement events, but the technique's core local execution, keystroke, or in-memory AppleEvent actions have no required detection surface in the clause.
T1059.003detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information, which can surface cmd.exe abuse when it results in exfiltration or leakage over those channels, but the control does not broadly detect all Windows command shell execution (local or non-leakage uses).
T1059.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. via email, file transfers, uploads), which surfaces some Unix shell abuse when it involves exfiltration or leakage but does not broadly detect all shell command or script execution.
T1059.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. via email, file transfers, uploads), and auditing; this surfaces some VB-based execution (e.g. macro/VBA in Office docs or VBScript in files) when it triggers leakage but does not broadly instrument or detect arbitrary VB abuse for command execution.
T1059.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. via email, file transfers, uploads), which surfaces Python-based exfiltration or download behaviors when they involve monitored sensitive data channels; this is only a slice of all Python abuse (T1059.006) since not all script execution or malicious behaviors trigger data-leakage observables.
T1059.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or via email), and acting on it; this surfaces some JS-based execution when it involves exfiltration or leakage of sensitive data, but the bulk of T1059.007 (arbitrary JS execution for behaviors like payload running or drive-by) is outside DLP's data-centric scope.
T1059.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions), and monitoring for adversary intelligence actions; this surfaces some CLI abuse on network devices when it involves exfiltrating, manipulating, or leaking data, but the bulk of T1059.008 (arbitrary command execution, config changes, disabling logging) has no disclosure or leakage artifact for DLP to observe.
T1059.009detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or via email), which surfaces some abuse of cloud APIs when it involves exfiltration of monitored data but does not broadly detect command execution or other non-leakage API abuse across IaaS/SaaS tenants.
T1059.010detects — A.8.12 explicitly requires monitoring channels (email, file transfers, portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces some AHK/AutoIT script or compiled payload activity when it involves exfiltration or monitored channels, but the technique's core local execution, keylogging, or automation leaves the bulk undetected by data-leakage focused controls.
T1059.011detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which would surface many Lua-based execution events that exfiltrate or act on sensitive data, but leaves a large remainder of Lua interpreter abuse that never touches monitored leakage vectors.
T1059.012detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which would surface hypervisor CLI abuse when it results in exfiltration or leakage patterns, but the technique's core (executing management commands on the hypervisor) has no direct monitoring tie and much of it occurs without triggering data-leakage observables.
T1059.013detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, uploads, or extraction), which surfaces some uses of container CLI/API that result in data exfiltration or discovery but does not broadly instrument or detect all malicious container command execution.
T1068detects — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information, and using DLP tools to identify/monitor at-risk data and block actions, which surfaces exploitation attempts that involve data movement or leakage but does not broadly detect the core vulnerability exploitation or BYOVD behavior described in T1068.
T1069detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces reconnaissance activity that extracts or transmits permission/group data but only for the subset that qualifies as sensitive or crosses monitored exfiltration channels, leaving the bulk of local discovery (e.g. whoami, dsquery, BloodHound on compromised hosts) unreached.
T1069.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information, which can surface reconnaissance commands that exfiltrate or transmit local group data (e.g. via email, uploads, or copy operations), but does not broadly instrument or detect the local enumeration itself on the host.
T1069.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which would surface many instances of T1069.002 commands that exfiltrate or transmit domain group data; however, purely local reconnaissance commands with no transmission or copy action fall outside its scope.
T1069.003detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services), which surfaces the reconnaissance technique in flight for some cloud-group/permission-enumeration vectors; it does not instrument or surface the majority of the technique's API/cmdlet calls (Get-MsolRole, az ad, ListRolePolicies, GetBucketAcl) across SaaS/IaaS/identity platforms.
T1070detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces T1070 actions that delete/modify logs, histories or metadata as anomalous artifacts on monitored channels.
T1070.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when files are uploaded, sent, or manipulated), and auditing; command-history files and their deletion/editing are a form of sensitive audit data whose removal can be surfaced by those monitoring and detection mechanisms on covered channels, but the control's scope is limited to data-leakage vectors rather than every possible local log-clearing action, leaving a genuine remainder.
T1070.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information, and auditing (including screenshots), which can surface file-deletion activity when it involves exfiltrated or sensitive artifacts, but this is only a minority slice of general post-intrusion cleanup of arbitrary dropped files.
T1070.005detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers and network activity) and using DLP tools to detect disclosure of sensitive information, which would surface anomalous share-connection removal as part of post-exfiltration cleanup on monitored Windows systems; the extent is partial because the control's scope is limited to channels carrying or exposing sensitive data rather than all possible share removals.
T1070.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information, and auditing (including of screenshots), which can surface timestomping when it affects monitored files or backup channels, but the control's focus is data exfiltration rather than timestamp manipulation itself.
T1070.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which surfaces the clearing or modification of network connection artifacts/logs when they involve monitored sensitive data flows; this is only a slice of the technique's scope (e.g., non-sensitive or non-monitored artifacts, local registry edits, or non-data-leakage tampering remain unreached).
T1070.008detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email or uploaded), which surfaces the mailbox-clearing actions that remove logs/artifacts/metadata of prior malicious email activity; this is only a slice of the technique because the control is scoped to sensitive/identified data and does not broadly instrument all mailbox modifications or deletions.
T1070.009detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads or emails), which surfaces cleanup activity that touches monitored data or channels, but the control is scoped to data-leakage vectors rather than general persistence-cleanup artifacts like service deletion or registry changes on non-sensitive objects.
T1070.010detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including file transfers, uploads, and copying actions on a victim's system), which surfaces the file-copying behavior central to T1070.010 relocation; it is only partial because the control is scoped to sensitive/identified information rather than arbitrary malware payloads and does not guarantee detection of all relocation variants (e.g. purely in-memory or on network devices).
T1071detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some T1071 abuse when it carries exfiltrated data; this is only a slice because the technique is not limited to data leakage events and many protocol uses (command, internal enclave traffic like SMB/SSH/RDP) fall outside DLP scope.
T1071.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services or sent via email), and acting on it; this surfaces T1071.001 C2 blending in web traffic when it exfiltrates or embeds sensitive data, with the bounded remainder being non-sensitive or non-monitored channels.
T1071.001prevents — A.8.12's DLP tools and monitoring can block exfiltration of sensitive data over web protocols (e.g. via email/upload/cloud), which directly stops the embedded-command C2 from succeeding when it carries sensitive information, but this is only a slice of the technique (which also covers non-sensitive command traffic, non-DLP-monitored channels, and mimicry that evades detection).
T1071.002detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent), which surfaces abuse of file transfer protocols to exfiltrate or embed data.
T1071.002prevents — A.8.12's DLP tools and monitoring explicitly block network transmissions and data exfiltration (including via file-transfer channels like email or uploads), which stops many instances of T1071.002 exfiltration-in-disguise, but leaves legitimate/common use of the same protocols (SMB/FTP/etc.) and non-sensitive traffic untouched.
T1071.003detects — A.8.12 explicitly requires monitoring channels of data leakage (including email), using DLP tools to detect disclosure of sensitive information when sent via email, and acting on it, which surfaces the embedded-command C2 traffic when it carries or exfiltrates sensitive data.
T1071.003prevents — A.8.12 explicitly requires monitoring email channels, detecting sensitive data in emails, quarantining/blocking transmissions that expose it, and restricting copy-paste/upload, which stops adversaries from successfully exfiltrating via SMTP/IMAP/POP3 by embedding in mail traffic; partial because it is scoped to sensitive/identified data only (not all C2) and relies on classification/implementation choices rather than blocking the protocol outright.
T1071.003responds — A.8.12 explicitly requires monitoring email channels for leakage, detecting disclosure (e.g. when sensitive info is sent via email), quarantining/blocking such transmissions, and acting on detected events, which responds to an in-flight T1071.003 exfiltration once underway; partial because it is scoped only to sensitive data and does not address non-leakage C2 uses of mail protocols.
T1071.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted via untrusted services or protocols), and acting on it; this surfaces DNS tunneling that exfiltrates data even if the administrative DNS traffic itself blends in.
T1071.004prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, file transfers, uploads, copy-paste) can block exfiltration of sensitive data tunneled via DNS when it matches identifiable patterns or policies, but this is a minority slice against the technique's blending with common traffic, infrequent beacons, and non-sensitive command embedding that evades data-centric detection.
T1071.005detects — A.8.12 explicitly requires monitoring channels of data leakage (including network transmissions) and using DLP tools to detect disclosure of sensitive information, which would surface anomalous or policy-violating use of pub/sub protocols when they carry embedded exfil or C2; this is a genuine but minority slice of the technique because the control is scoped to sensitive data only and does not broadly instrument or flag all protocol abuse.
T1072detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which would surface anomalous use of deployment tools for exfiltration or lateral movement in many cases, but the control is scoped only to sensitive-data flows and does not broadly instrument or detect abuse of management suites for RCE, lateral movement, or command execution absent a data-leakage artifact.
T1074detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure (including uploads and email), which surfaces staging activity when it involves monitored exfiltration precursors or data movement to central locations.
T1074prevents — A.8.12's DLP tools and monitoring can block actions that would stage sensitive data for exfiltration (e.g. copy, upload, or transfer to staging locations), but this is limited to monitored channels and identifiable sensitive data, leaving many staging methods (e.g. local archiving, unmonitored cloud instances, or non-sensitive data) untouched.
T1074responds — A.8.12 explicitly acts on detected leakage (quarantine, block transmissions, DLP tools that respond to disclosure events) and includes adversary-oriented responses like honeypots or disinformation once intelligence-gathering is underway; this bounds the staging technique's downstream exfiltration but does not address the bulk of local/centralized staging activity itself.
T1074.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (including local unstructured data and actions that could precede exfiltration), which surfaces local staging activity on monitored systems.
T1074.001prevents — A.8.12's DLP tools and monitoring can block copy/paste, uploads, or transfers that would stage sensitive data for exfil, but this is limited to monitored channels and classified data while local staging (e.g. via shell commands to files, registry, or unmonitored locations) can still occur without triggering prevention.
T1074.001responds — A.8.12's DLP tools and monitoring can detect and block (quarantine, block transmissions, restrict copy/paste) data staging actions that expose sensitive information once underway, acting as a response to contain the technique in flight, but this is limited to monitored channels and does not address all local staging methods (e.g., registry, unmonitored shells, or non-sensitive data).
T1074.002detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces remote staging activity when it involves exfiltration-bound sensitive data on monitored channels or systems.
T1074.002prevents — A.8.12's DLP tools and monitoring can block sensitive data from being copied/moved into a staging location (or detect and quarantine it), but only for data the organization has classified and instrumented; the technique's core (local file copies via shell commands on any system, including adversary-created cloud instances) is only partially reached.
T1074.002responds — A.8.12's DLP tools detect and block (quarantine, prevent copy/paste/upload/transmission) data movement that can realize or follow staging, and its response-oriented actions (e.g. honeypots, reverse social engineering, confusing adversary decisions) act once the technique is underway, but this is only a slice of T1074.002's local/remote staging behaviors across platforms.
T1078detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud or email), and auditing; this surfaces some abuse of valid accounts when it involves exfiltration of identified/classified sensitive data, but the bulk of T1078 (credential abuse for initial access, persistence, privilege escalation, lateral movement, or evasion without data movement) lies outside DLP's scope.
T1078.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces default-account abuse when it involves exfiltration or observable leakage of credentials/data, but this is only a slice of the technique's scope across initial access, persistence, and privilege escalation on diverse platforms.
T1078.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and acting on it; domain account abuse frequently produces observable data exfiltration or anomalous credential use that such monitoring surfaces.
T1078.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information, which would surface anomalous use of local accounts when it involves exfiltration or dumping of credentials/data, but this is only a slice of the technique's broader abuse for initial access, persistence, or privilege escalation without data movement.
T1078.004detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted cloud services or via email), which surfaces some T1078.004 abuse such as data harvesting or lateral movement from compromised cloud accounts, but leaves the bulk of account compromise, credential creation, privilege assumption, and initial access vectors outside its telemetry scope.
T1080detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or shared to untrusted locations), and auditing; this surfaces tainted shared content carrying sensitive payloads on monitored channels but does not address non-sensitive binaries, non-monitored shares, or adversary-oriented deception slices like honeypots.
T1082detects — A.8.12 explicitly requires monitoring channels for data leakage and using DLP tools to detect disclosure of sensitive information, which can surface T1082 when system details (e.g. version/patch data) are exfiltrated via monitored vectors like email, uploads or file transfers, but does not broadly instrument or detect local discovery commands, CLI queries or API calls themselves.
T1083detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk of disclosure, and detecting when such information is exposed (e.g. via uploads or email), which surfaces T1083 activity when it involves sensitive files/directories but only for a scoped subset of discovery rather than all file/directory enumeration.
T1087detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; account names/email addresses are a named sensitive data type that can be monitored when they leak via files, email, cloud interfaces or command output, but this is only a slice of the many discovery methods (e.g. built-in commands on unmonitored hosts, cloud IAM APIs) and does not guarantee detection of all instances.
T1087.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), which surfaces the local-account enumeration technique when it involves sensitive data exfiltration but does not broadly instrument or surface all instances of account listing.
T1087.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), which would surface domain-account enumeration performed via LDAP, email, file transfer or similar monitored vectors, but does not broadly instrument or detect all local command-line or in-memory enumeration methods on every platform.
T1087.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces attempts to enumerate or exfiltrate email accounts/addresses via those vectors; the remainder is non-email vectors such as direct API or memory-resident enumeration outside monitored channels.
T1087.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), which surfaces the account-enumeration technique when it involves exfiltrating or exposing account data; this is only a slice of the technique because most executions stay inside authenticated sessions without triggering leakage detection.
T1090detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded to untrusted cloud services), which surfaces some proxy-based C2 traffic that carries or exfiltrates sensitive data; this is only a slice of T1090 because the technique is not inherently about sensitive data and many proxy uses (e.g. non-sensitive C2, internal pivoting, CDN routing) fall outside DLP scope.
T1090.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which would surface anomalous internal proxy traffic when it carries or exposes sensitive data, but this is scoped only to data-leakage events rather than all internal proxy usage for C2.
T1090.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded to untrusted cloud services), which surfaces anomalous outbound C2 proxy traffic when it carries or exposes sensitive data, but this is scoped only to data-leakage events rather than all external-proxy usage.
T1090.003detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage, uploads to untrusted clouds) and using DLP tools to detect disclosure of sensitive information, which surfaces some multi-hop proxy traffic when it carries or exfiltrates monitored data, but the technique's core (chaining proxies to disguise C2 source) operates at the network/routing layer outside DLP's data-centric focus and can use non-monitored protocols or paths.
T1090.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and acting on it; this surfaces domain fronting when the tunneled traffic carries or exposes monitored sensitive data, but the technique's core (SNI/Host mismatch to obfuscate any destination) is not itself a sensitive-data event and can succeed without triggering DLP.
T1091detects — A.8.12 explicitly requires monitoring channels of data leakage including portable storage devices and removable media, and using DLP tools to detect disclosure or exfiltration of sensitive information (including when copied or transferred), which surfaces the malware-copying or autorun-triggering action on removable media for most cases on Windows platforms.
T1091prevents — A.8.12's DLP tools and monitoring/blocking of channels (including portable storage, USB, file transfers, copy/paste to removable media) can stop malware from being written to or executed from removable media in monitored environments, but this is only a slice: air-gapped/manual/firmware/lateral modification paths, unmonitored devices, and non-sensitive-data vectors remain outside its core leakage focus.
T1092detects — A.8.12 explicitly requires monitoring channels of data leakage (including portable storage devices and file transfers) plus DLP tools that detect disclosure of sensitive information, which surfaces the use of removable media to exfiltrate or relay commands/files in T1092.
T1092prevents — A.8.12's monitoring, blocking of transfers to removable media, and DLP tools directly stop the exfiltration/relay step of T1092 on monitored channels; partial because the technique can still succeed on unmonitored media, pre-compromised hosts, or when screenshots/photographs bypass technical controls.
T1095detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces non-application-layer C2 hiding in protocols like ICMP/UDP/VMCI when those carry or exfiltrate sensitive data; this is only a slice of T1095 because the technique is not inherently about sensitive data and many protocol uses (e.g., non-sensitive C2 or lateral movement) fall outside DLP scope.
T1098detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some account manipulation actions (e.g. credential changes or permission updates that trigger exfiltration of sensitive data) but leaves the bulk of T1098's stealthy, non-data-leakage manipulations (e.g. local permission-group edits or password policy subversion with no observable disclosure) unreached.
T1098.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including credentials) via email, uploads, file transfers, and similar exfiltration paths; while adding cloud credentials is not itself an outbound disclosure act, many documented instances of T1098.001 involve subsequent use of those credentials to access/export sensitive data that DLP tooling would surface, forming a genuine but minority slice of the technique.
T1098.002detects — A.8.12 explicitly requires monitoring channels of data leakage (e.g. email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email or uploaded), which surfaces the anomalous permission grants and mailbox access that realize T1098.002 in BEC/persistence scenarios; partial because the clause's scope is set by identified/classified sensitive data and chosen monitoring, leaving email permission changes outside that scope undetected.
T1098.003detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including uploads to untrusted cloud services), which surfaces the data-access and exfiltration consequences of added cloud roles, but does not address the IAM/policy modification act itself or non-data actions.
T1098.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers, uploads, or unauthorized extractions), which surfaces adversary modification of authorized_keys files when those actions involve exfiltrating or handling sensitive SSH-related data, but only for a slice of cases rather than the technique in general.
T1098.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some T1098.005 instances that transmit or expose registration data but leaves the majority (credential compromise, silent Entra ID/Intune registration, or non-data-leakage enrollment) unreached.
T1098.006detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), and auditing; this surfaces the permission/role changes when they cause exfiltration of classified container data, but the technique itself is a local Kubernetes RBAC/ABAC mutation with no necessary data movement or leakage, leaving most instances outside DLP scope.
T1098.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces the command-line or configuration changes that add groups when they involve exfiltration or leakage of credentials/tokens, but the core local usermod/net localgroup action itself is not a data-leakage event and is outside the control's defined scope.
T1102detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure events such as uploads to untrusted third-party cloud services or email exfiltration, which directly surfaces T1102's use of legitimate web services for C2 data relay.
T1102prevents — A.8.12 explicitly requires monitoring channels (incl. uploads to untrusted third-party cloud services) and blocking transmissions that expose sensitive information, which stops many common T1102 exfiltration-over-web-service patterns before data leaves; it is only partial because the control is scoped to identified/classified sensitive data and does not block all possible web-service C2 that an adversary might choose outside those channels or without detectable sensitive payloads.
T1102.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted cloud services) and using DLP tools to detect disclosure of sensitive information, which surfaces dead-drop resolver activity when it involves exfiltrating or posting encoded C2 pointers via those monitored vectors; it does not broadly instrument all possible web-service dead drops or adversary intelligence actions like honeypots.
T1102.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services or sent via email), and acting on it; this surfaces T1102.002's bidirectional C2 exfiltration of output over common web services, with the named remainder being non-sensitive or non-monitored channels.
T1102.002prevents — A.8.12's DLP tools and monitoring can block exfiltration of sensitive data over web services (e.g. via email, uploads, or copy-paste), which would stop the return/output leg of bidirectional C2 in some cases, but this does not stop inbound commands, non-sensitive C2 traffic, or adversary use of encrypted popular services that blend with normal traffic.
T1102.002responds — A.8.12's DLP monitoring, detection, blocking, and quarantine of sensitive outbound data (e.g. via email, uploads, or web channels) can respond to and contain exfiltration that realizes T1102.002's bidirectional C2, but only for the subset involving sensitive information leakage rather than generic command traffic or non-sensitive C2.
T1102.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, cloud uploads) and using DLP tools to detect disclosure of sensitive information, which surfaces one-way C2 beaconing or exfil over common web/social services when it carries or reveals sensitive data; it does not broadly instrument or detect all such C2 traffic independent of data sensitivity.
T1104detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions, uploads, and exfiltration), which surfaces the outbound C2 staging, file uploads, and multi-stage callbacks described in T1104.
T1105detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including uploads to untrusted services, email, file transfers), and acting on detected events, which surfaces most T1105 ingress tool transfers that move files across monitored boundaries or channels.
T1105prevents — A.8.12's DLP tools and channel monitoring can block outbound transfers of sensitive data (including tools) via email, uploads, cloud sync, copy/paste, or exfiltration channels, but the technique's many in-bound download vectors (e.g. C2, curl/wget on compromised hosts, lateral tool transfer, package managers, search-ms) remain largely unreached.
T1106detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), and auditing; this surfaces some T1106 abuse when it involves exfiltration of monitored data but leaves the vast bulk of native API use (process creation, memory ops, syscalls for non-leak purposes) outside its scope.
T1110detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded to untrusted services), and auditing; this surfaces brute-force attempts that transmit guessed credentials or related data exfiltration but does not broadly instrument the guessing behavior itself across all platforms and vectors in T1110.
T1110.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via email, file transfers, uploads to untrusted services), and acting on it; this surfaces password guessing attempts when they transit or expose credentials over monitored channels, but leaves the bulk of local/off-channel guessing (e.g. direct to SSH, RDP, LDAP, wifi auth) outside its scope.
T1110.001prevents — A.8.12's DLP tools and monitoring can block credential exfiltration (e.g. via email, uploads, copy-paste) after guessing succeeds, and its deception measures (honeypots, false data) can deter guessing attempts, but this leaves the core online guessing against exposed services (SSH, RDP, etc.) untouched.
T1110.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when exfiltrated via email/cloud), and auditing; credential material such as hashes or cracked plaintext qualifies as sensitive data whose unauthorized extraction or disclosure can be surfaced by those mechanisms, but this is only a slice because cracking is performed offline on adversary systems outside the monitored organizational channels and the control does not address the upstream dumping step itself.
T1110.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including over email, file transfers, cloud uploads, and network transmissions), which surfaces password spraying attempts against management/SSO/email services before or during execution.
T1110.004detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted cloud) and using DLP tools to detect disclosure of sensitive information; credential-stuffing attempts can be surfaced when they involve monitored channels or leaked credential sets treated as sensitive data, but this is only a minority slice of the technique's typical network-service login attempts which the control does not instrument.
T1111detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.), detecting disclosure of sensitive information (e.g. uploads or emails), and using DLP tools to identify/monitor at-risk data; this surfaces some MFA-interception vectors that involve out-of-band channels like email/SMS or data exfiltration, but leaves the majority (keyloggers, smart-card proxying, token prediction, service provider compromise) outside its scope.
T1112detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent or in unstructured data), which would surface many Registry modifications that exfiltrate, impair defenses by leaking credentials, or otherwise expose sensitive data; it does not broadly detect all Registry interactions used for evasion, persistence or lateral movement that do not involve data disclosure.
T1113detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information, and auditing (including screenshots as an addressed vector), which surfaces the T1113 technique when it involves exfiltrating captured sensitive data; this is only a slice of all screen-capture activity since non-sensitive or non-exfiltrating uses fall outside DLP scope.
T1113prevents — A.8.12 explicitly lists addressing screenshots/photographs via terms, training, auditing, and DLP-style restrictions on copy actions that can block some native capture paths, but does not stop all API-based or post-compromise screen capture techniques on all platforms.
T1113responds — A.8.12 explicitly lists addressing screenshots via terms/conditions, training, auditing, and (in the espionage section) responding to adversary intelligence actions with confusion tactics such as honeypots or reverse social engineering once underway; this is a genuine but minority slice of the post-compromise T1113 technique itself.
T1114detects — A.8.12 explicitly requires monitoring channels (incl. email), using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), and acting on it, which surfaces the T1114 collection/forwarding technique on covered channels.
T1114prevents — A.8.12 explicitly monitors email channels, detects sensitive information in emails or attachments, and blocks transmissions or user actions (quarantine, copy-paste restrictions, DLP tools) that would allow collection or forwarding, directly stopping the T1114 technique in the majority of its described vectors while leaving a bounded remainder for server-side collection methods outside endpoint DLP scope.
T1114responds — A.8.12 explicitly requires acting on detected leakage (quarantine emails, block transmissions, DLP tools that stop disclosure in flight) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which directly contains or eradicates an in-progress T1114 email collection once underway.
T1114.001detects — A.8.12 explicitly requires monitoring channels (including email) and using DLP tools to detect disclosure of sensitive information, which surfaces local email collection attempts or exfiltration of .ost/.pst files.
T1114.001prevents — A.8.12 explicitly monitors channels such as email, detects disclosure of sensitive information (including via email), and blocks transmissions or user actions that would expose it, directly stopping the local email files from being exfiltrated; it is only partial because the control is scoped to sensitive/classified data the organization has identified and does not address all possible local collection of any email.
T1114.001responds — A.8.12 explicitly requires monitoring channels (e.g. email) for leakage, detecting disclosure, and acting (quarantine/block) once it occurs, which responds to local email collection in flight; partial because the clause is scoped to sensitive/classified data and outbound channels rather than all local file acquisition, and its deception elements (honeypots) are unrelated.
T1114.002detects — A.8.12 explicitly requires monitoring channels (email), detecting disclosure of sensitive information (e.g. when sent via email), and using DLP tools to identify/monitor at-risk data, which surfaces the adversary's remote email collection activity.
T1114.002prevents — A.8.12's DLP tools and monitoring can block exfiltration of collected email (e.g. via outbound email, copy/paste, or upload), but do not stop the core technique of credentialed access to the Exchange/Office 365 mailbox itself to acquire the data.
T1114.003detects — A.8.12 explicitly requires monitoring channels of data leakage (including email) and using DLP tools to detect the disclosure of sensitive information (e.g. when sent via email), which surfaces the setup or use of forwarding rules that exfiltrate mail.
T1114.003prevents — A.8.12 explicitly requires monitoring email channels, detecting disclosure of sensitive information (including via email), and blocking transmissions that expose it, which stops the forwarding rule from successfully exfiltrating mail; it is only partial because the control is scoped to identified/classified sensitive data and does not reach hidden rules, transport rules, or unmonitored email paths.
T1114.003responds — A.8.12 explicitly lists monitoring email channels, detecting disclosure (e.g. when sent via email), quarantining/blocking transmissions that expose sensitive info, and acting on leakage events once underway, which directly contains or eradicates an active email-forwarding rule's ongoing exfiltration; partial because it does not address hidden rules, transport rules, or post-compromise rule creation itself.
T1115detects — A.8.12 explicitly requires monitoring channels of data leakage (including clipboard via copy/paste restrictions and DLP tools that detect sensitive data exposure), which surfaces clipboard collection in scope; partial because scope is set by the organization’s chosen sensitive data and monitored channels, leaving clipboard use on unmonitored apps or non-sensitive data as a slice the implementer chooses
T1115prevents — A.8.12 explicitly calls out restricting copy/paste (including via DLP tools or remote-view configs that block clipboard exfil outside org control) and addresses screenshots, which directly stops the T1115 collection technique from succeeding on monitored channels; partial because it is scoped to org-determined sensitive data, user-approved exports, and does not blanket-remove all clipboard access mechanisms (e.g. local adversary tools like clip.exe on unmanaged endpoints).
T1115responds — A.8.12 explicitly addresses screenshots/photographs of the screen (a common way clipboard data is exfiltrated after T1115 collection) via terms, training, auditing, and DLP blocking of copy/paste or exfil actions; this contains/eradicated realized clipboard theft once underway, but only for a slice of the technique (post-collection exfil, not the initial collection itself).
T1119detects — A.8.12 explicitly requires monitoring channels, identifying/monitoring sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces automated collection activity against the bulk of covered data types and exfiltration vectors.
T1119prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, transfers, uploads, copy-paste) can stop automated exfiltration of identified sensitive data once collection occurs, but do not stop the adversary's initial automated search/copy steps inside the environment or non-sensitive data collection.
T1119responds — A.8.12 explicitly requires monitoring channels for leakage, detecting disclosure of sensitive information (including automated collection and exfiltration), blocking transmissions/actions that expose it, and quarantining — which is containment/eradication once automated collection is underway, matching the `responds` verb on the event lane.
T1120detects — A.8.12 explicitly requires monitoring channels of data leakage including portable storage devices and using DLP tools to detect disclosure of sensitive information, which surfaces peripheral device discovery when it involves removable storage or similar exfiltration vectors, but does not broadly detect non-data-leakage discovery of other peripherals like keyboards or printers.
T1123detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk, and detecting its disclosure (including via tools that surface when sensitive data is about to be or is being exfiltrated); audio captured from peripherals or apps and written to disk for later exfil is sensitive information traversing a monitored channel, so the control surfaces the technique in most cases (remainder: non-sensitive or non-monitored audio, or capture that never reaches a DLP-monitored egress point).
T1124detects — A.8.12 explicitly requires monitoring channels for data leakage and using DLP tools to detect disclosure of sensitive information; system time itself is not sensitive data, but the technique's network/CLI/command channels (e.g. net time, show clock, systemsetup) overlap the monitored exfiltration paths, creating a genuine but minority slice of detection coverage.
T1125detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when exfiltrated), and auditing; this surfaces video/image capture of sensitive data when it traverses monitored channels or is written/exfiltrated, but does not broadly detect local device API use or non-sensitive captures.
T1127detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces some instances of T1127 when the proxy utility is used to exfiltrate or transmit sensitive data, but the technique's core (local proxy execution of arbitrary code) has no necessary data-leakage footprint and is therefore only a minority slice.
T1127.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces MSBuild-based proxy execution when it involves or exposes monitored sensitive data, but the control is scoped only to information-classification-driven leakage channels and does not broadly instrument or surface the technique itself when no sensitive data is touched.
T1127.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted cloud) and using DLP tools to detect disclosure of sensitive information, which surfaces some ClickOnce abuse vectors (e.g. web-based delivery or file movement) when they involve monitored exfiltration of sensitive data; it does not broadly instrument or surface the technique's core proxy-execution, rundll32 abuse, or startup-folder persistence behaviors.
T1127.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or other exfiltration), which would surface JamPlus-driven script execution if it involves or reveals monitored sensitive data; however, the technique itself is a build-tool proxy for arbitrary malicious scripts that need not involve sensitive data leakage at all.
T1129detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some T1129 activity when the shared module/DLL payload or its loading action involves observable exfiltration or sensitive data movement, but most in-memory module loading for C2 or execution has no data-leakage footprint and is outside the control's scope.
T1132detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), which surfaces encoded C2 traffic when it carries or exfiltrates identifiable sensitive data; this is a genuine but minority slice of T1132 because most encodings are generic protocol obfuscation unrelated to organizational sensitive-data classification or leakage channels.
T1132.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosure (e.g. uploads or emails), which surfaces encoded C2 traffic when it matches monitored sensitive data patterns or channels, but this is scoped only to sensitive information rather than all standard encodings or generic C2.
T1132.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in network transmissions and to untrusted services), which surfaces non-standard encoding attempts in C2 traffic that would otherwise evade standard detection; partial because DLP scope is limited to organization-defined sensitive data types and channels rather than all non-standard encodings universally.
T1133detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), and auditing; this surfaces some T1133 activity that involves exfiltration or sensitive data movement over remote services but does not broadly detect initial access, persistence, or exposed unauthenticated services like VPNs, Docker APIs, or Tor hidden services.
T1134detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which can surface token-manipulation activity when it involves exfiltration or anomalous privileged behavior, but this is only a minority slice of the technique's core local Windows API and process-context actions.
T1134.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; token theft can be a precursor that surfaces in anomalous data-access or exfiltration patterns, but the control is scoped to information disclosure channels rather than the Windows token-duplication primitives themselves.
T1134.003detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which can surface anomalous token-creation/impersonation behavior when it involves exfiltrating or leaking credentials or data; this is a genuine but minority slice of the Windows-specific technique, which is not primarily a data-disclosure event.
T1134.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via network transmissions or anomalous user actions), which surfaces PPID-spoofing attempts when they involve observable data-leakage indicators, but the control is silent on process-creation telemetry or parent-child relationship analysis and therefore reaches only a minority slice of the technique.
T1134.005detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces SID-History injection when it involves exfiltrating or disclosing harvested credentials/SIDs, but the technique's core local AD manipulation and privilege-escalation steps have no required monitoring surface.
T1135detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers and network activity) and using DLP tools to detect disclosure of sensitive information, which would surface network share discovery when it exposes or moves sensitive data; however, the technique itself is purely reconnaissance with no inherent data exfiltration, so only the subset involving sensitive shares is caught.
T1136detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including uploads, emails, and actions exposing data), which surfaces adversary account creation when it involves or exposes monitored sensitive information, but this is only a slice of T1136's broad account-creation surfaces across local, domain, cloud, and non-data-leak vectors.
T1136.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information, which surfaces the creation and use of a local account when that account is subsequently employed to exfiltrate or disclose data (e.g. via monitored email, file transfers, or uploads).
T1136.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information, and auditing (including screenshots), which can surface anomalous domain-account creation when it involves exfiltration or policy-violating transmission of credentials or related data, but this is only a minority slice of the technique itself.
T1136.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted cloud services or email), which surfaces adversary creation of stealthy cloud accounts used for persistence when those actions involve exfiltrating or handling sensitive data; however this is only a slice of the technique, as account creation itself (especially low-privilege or service accounts with no immediate sensitive-data interaction) is not inherently a data-leakage event and can occur without triggering DLP channels.
T1137detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. via email, file transfers, uploads); this surfaces some Office-based persistence that involves exfiltrating or leaking sensitive data through those channels, but most T1137 mechanisms (template macros, add-ins, Outlook rules/forms/Home Page for startup persistence) are local and do not involve detectable leakage.
T1137.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces some Office-template macro abuse when it involves exfiltration or monitored channels, but the core persistence technique (local template modification and macro execution on app start) has no required detection surface in the clause.
T1137.001prevents — A.8.12's DLP tools and monitoring can block macro-bearing templates or Office files from leaving/entering via monitored channels (email, uploads, file transfers), and its macro policy slice can constrain execution, but the technique's core (local template modification, registry hijack, or trusted-location abuse on a compromised host) is untouched by leakage-focused controls.
T1137.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via email, file transfers, uploads, and unstructured data), which can surface anomalous Office Test registry changes or DLL loads that exfiltrate or indicate persistence tied to sensitive data, but this is limited to data-centric channels and does not broadly cover all registry-based persistence without a data-leakage component.
T1137.003detects — A.8.12 explicitly requires monitoring channels (e.g. email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), which surfaces the malicious form-bearing message in flight; this is a genuine but minority slice of the technique whose dominant persistence and form-install steps live outside monitored exfiltration channels.
T1137.004detects — A.8.12 explicitly requires monitoring channels of data leakage (including email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email or to untrusted services); the T1137.004 technique relies on loading a malicious external URL/HTML in Outlook (a monitored channel) that can trigger on folder load, so anomalous/sensitive content or exfil-like behavior is surfaced in the slice covered by email and outbound monitoring, but the control does not address registry/mailbox persistence changes, non-sensitive HTML, or non-email vectors.
T1137.005detects — A.8.12 explicitly requires monitoring channels of data leakage (e.g. email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), which surfaces the rule-triggered execution on a crafted email; this is only a slice of the persistence technique itself, which also includes rule creation and loading at Outlook start.
T1137.006detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information, which can surface add-in-based persistence when it triggers observable data-leakage events, but the technique itself is code execution at app startup with no guaranteed sensitive-data disclosure or channel use.
T1140detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in files, email, uploads, and exfiltration), which surfaces some deobfuscation/decode actions when they involve monitored sensitive data movement, but the technique is primarily local malware utilities or user actions on non-sensitive artifacts with no guaranteed observable disclosure event.
T1176detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or exfiltration), which surfaces some abuse of extensions for data tunneling or persistence when it involves observable sensitive-data movement; this is only a slice of the technique's full scope (installation, social engineering, marketplace compromise, benign-abuse without leakage).
T1176.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces the data exfiltration that T1176.001 performs once the malicious extension is installed and active; this is only a slice of the technique because detection is limited to post-install data-stealing behavior and does not address silent installation, persistence, or stealth modifications themselves.
T1176.001prevents — A.8.12's DLP tools and monitoring/blocking of data exfiltration channels can block the post-install theft of credentials or other sensitive browser-entered data that is the primary goal of T1176.001, but do nothing to stop the core technique of installing or persisting a malicious extension itself.
T1176.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including exfiltration), and acting on it; this surfaces the exfil payload or tunnel usage in the IDE-extension technique but does not broadly detect the installation, persistence, or non-exfil actions such as backdoors or cryptomining.
T1185detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and acting on it; browser session hijacking that inherits sessions/cookies or pivots traffic to exfiltrate intranet data or bypass auth is a data-leakage event that such monitoring and tools would surface.
T1187detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted cloud) and using DLP tools to detect disclosure of sensitive information, which surfaces some forced-authentication cases that transmit credential material over monitored vectors, but leaves the bulk (e.g. .SCF/.LNK icon loads, EFSRPC, or non-sensitive-hash exfil) outside its sensitive-data focus.
T1189detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some drive-by delivery vectors once they trigger outbound sensitive data exfiltration but does not broadly detect the initial browser exploit or code execution on visit.
T1190detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads to untrusted clouds or email), which surfaces some T1190 cases once the exploit has produced observable data movement or leakage, but does not address the initial exploitation of the public-facing weakness itself or non-data-leakage post-exploit activity.
T1195.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting disclosures (e.g. uploads to untrusted services or email), which surfaces supply-chain compromise of dependencies/tools when it manifests as anomalous data movement or leakage; this is a genuine but minority slice of the technique's pre-receipt manipulation and broad targeting.
T1197detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers and network transmissions) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted services or via email); BITS upload for exfiltration is a file-transfer channel that would be in scope where DLP coverage reaches it, but BITS's background/low-profile nature, COM/PowerShell interfaces, and non-file/registry artifacts leave substantial uncovered surface.
T1197prevents — A.8.12's DLP tools and channel monitoring can block BITS-based exfiltration (upload) or sensitive-data transfers, but do not stop BITS job creation, local execution, persistence, download, or cleanup aspects of the technique.
T1199detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some supply-chain/third-party exfiltration events once underway; this is a genuine but minority slice of T1199's broader trusted-relationship abuse (e.g. it misses initial compromise of the provider account or lateral movement that never touches monitored data channels).
T1200detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile/portable devices) and using DLP tools to detect disclosure of sensitive information, which would surface many hardware additions that exfiltrate or transmit data but leaves a bounded remainder of purely passive or non-data-leaking insertions (e.g. keystroke injection via DMA without observable outbound flow).
T1202detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which can surface some T1202 executions that involve exfiltration or leakage of command artifacts, but the technique's core (abusing proxy utilities like forfiles, pcalua, or ssh -o for stealthy execution without touching cmd) is mostly in-process or local and outside DLP's data-centric focus.
T1203detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads or emails), which can surface client-exploitation attempts that transmit or trigger via those vectors, but leaves the core vulnerability exploitation and many non-data-leakage delivery paths (e.g. drive-by without sensitive data) unreached.
T1204detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to cloud, copy/paste) and using DLP tools to detect disclosure of sensitive information, which surfaces some social-engineering-driven user execution vectors (e.g. opening malicious docs or running coerced payloads) when they involve exfiltration-like behavior, but leaves the bulk of pure execution triggers (e.g. desktop clicks, enabling RATs, browser JS without data leak) outside its scope.
T1204prevents — A.8.12's DLP tools and monitoring can block user actions like copy-paste of malicious content or uploads that would execute it, and its deception measures (honeypots, false info) can deter social engineering leading to execution, but this leaves the bulk of T1204 (opening docs/links, enabling RATs, running JS, manual execution after phishing) untouched as it is not data-leakage oriented.
T1204responds — A.8.12 explicitly acts on detected leakage (quarantine, block transmissions, DLP tools that stop exposure once underway) and includes response-oriented deception (honeypots, reverse social engineering) once adversary intelligence actions are recognized, but this only covers the subset of T1204 that involves data exfiltration or copy-paste execution rather than the dominant vectors like opening documents or enabling RATs.
T1204.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted services) and using DLP tools to detect disclosure of sensitive information, which surfaces the user action of clicking a malicious link when it triggers data exfiltration or reaches monitored channels, but leaves the initial click itself (especially on air-gapped or non-data-leak vectors) outside its scope.
T1204.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. via email, uploads, or file transfers), which surfaces malicious files containing sensitive payloads or exfiltration attempts but does not broadly instrument user file-opening or execution behavior across all T1204.002 vectors.
T1204.002prevents — A.8.12's DLP tools and monitoring can block transmission or actions that would deliver/execute certain malicious files (e.g. quarantining email attachments or preventing upload/copy of sensitive/malicious content), but this does not stop all vectors such as local files placed on a desktop, internal sharing, or user opening of already-present files via social engineering.
T1204.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted cloud services), which surfaces malicious/backdoored images when they contain or expose identifiable sensitive data; this is a genuine but minority slice of the technique whose dominant vector is unwitting deployment of attacker-controlled images that do not carry detectable sensitive payloads.
T1204.004detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.), detecting disclosure of sensitive information (e.g. uploads or emails), and using DLP tools to identify/monitor at-risk data, which surfaces the social-engineering copy-paste of malicious payloads when they involve exfiltration-like or monitored channels, but leaves the majority of in-terminal paste-and-execute cases (especially non-sensitive, non-network) outside its scope.
T1204.004prevents — A.8.12 explicitly requires DLP tools or configurations that can block copy-and-paste or upload actions involving sensitive information outside organizational control, directly stopping the user-mediated paste step that T1204.004 relies on; it is only partial because the control is scoped to identified/classified sensitive data rather than arbitrary malicious commands, and the technique can still succeed via non-paste vectors or unmonitored channels.
T1204.005detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in uploads to untrusted services or public repos), which surfaces malicious library installs that exfiltrate or act on data, but this is only a slice of the technique's full scope (e.g., silent persistence or crypto-mining without detectable leakage).
T1205detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads to untrusted services), which surfaces the signaling packets or magic values when they carry or expose sensitive data, but this is scoped only to information-classification-driven leakage rather than arbitrary or non-sensitive traffic signaling.
T1205.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions), which can surface the anomalous port-knocking packet sequences when they carry or expose protected data, but the control is scoped to information disclosure rather than arbitrary port-knocking behavior.
T1205.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces the crafted packet that matches the filter and triggers the backdoor activation; this is a genuine but minority slice because the technique's low-visibility raw socket installation, passive nature until triggered, and non-sensitive-payload triggers fall outside typical DLP scope focused on data content rather than all network filters.
T1207detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces the rogue-DC registration and replication actions when they involve exfiltrating or disclosing AD data such as credentials/keys, but the core local schema manipulation and logging bypass occur outside monitored data channels, leaving a large remainder.
T1210detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), and auditing; this surfaces some adversary actions that could coincide with remote service exploitation (e.g. when it triggers data movement or exfiltration), but the technique's core (vulnerability exploitation for lateral movement) is not a data-leakage event and is mostly outside DLP scope.
T1211detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces stealthy exploitation that attempts to suppress logging or hide in unmonitored components; partial because the clause's scope is data-leakage focused rather than general stealth/evasion techniques and many exploitation vectors (e.g. kernel-level or non-data-bearing) fall outside its telemetry.
T1212detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces some credential-exfiltration events once they occur; this is a minority slice of T1212 because most exploitation-for-credential-access techniques (vulnerability triggers, replay packets, token forging, in-memory credential dumping) are not data-leakage events and fall outside DLP scope.
T1213detects — A.8.12 explicitly requires monitoring channels, identifying/monitoring sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces the adversary's mining or exfiltration from repositories; mostly because it is scoped to sensitive/classified data and chosen channels rather than all repository access universally.
T1213prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, uploads, copy-paste, external sharing) directly stop exfiltration of repository data to outsiders, but the technique's core (mining via broad access, internal abuse, or repository misconfiguration) is only partially reached as the control focuses on leakage detection/prevention rather than access enforcement or repository hardening.
T1213.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including to untrusted services), which surfaces the exfiltration of Confluence-stored data; the remainder is non-monitored instances or pre-disclosure mining inside the repository itself.
T1213.001prevents — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information (including in cloud services or email), and blocking transmissions or user actions that would expose it; this directly stops the exfiltration step of mining Confluence data in many common scenarios, but leaves a bounded remainder where the adversary has already obtained credentials or direct repository access that bypasses DLP tooling.
T1213.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosure (including uploads to untrusted services or email), which surfaces the exfiltration of SharePoint-mined data; the remainder is non-electronic channels or pre-exfiltration mining itself.
T1213.002prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, uploads, copy-paste, exfiltration to untrusted services) can stop some outbound extraction or disclosure of SharePoint-mined data once it reaches a user endpoint or transmission path, but do not stop the adversary from first accessing or mining the repository itself.
T1213.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads to untrusted cloud services or email), which surfaces adversary collection from internal/private code repositories when it crosses monitored vectors; it does not instrument the repository itself or all offline exfiltration methods, leaving a genuine slice uncovered.
T1213.003prevents — A.8.12's DLP tools and monitoring can block exfiltration of sensitive source code or credentials from internal/private repositories (e.g. via email, uploads, copy-paste), but do not stop initial access to the repository itself or collection once the adversary is inside with legitimate access.
T1213.004detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure (e.g. uploads to untrusted services or email), which directly surfaces the mining/extraction of PII/customer data from CRM systems once access is gained.
T1213.004prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, uploads, copy-paste, exfiltration) can stop post-access mining and outbound disclosure of CRM-stored PII when it matches sensitive data patterns, but this is only a slice: the technique is any access to the CRM itself (on-prem or SaaS) and succeeds without ever triggering outbound DLP.
T1213.005detects — A.8.12 explicitly requires monitoring channels of data leakage (including email, file transfers, and by extension messaging apps) plus DLP tools that detect disclosure of sensitive information such as proprietary data or credentials when sent or uploaded, directly surfacing the T1213.005 technique when it moves mined chat data outward.
T1213.005prevents — A.8.12 explicitly requires monitoring messaging channels for leakage, detecting disclosure of sensitive data (including in SaaS tools like Teams/Slack), and blocking transmissions or user actions that would expose it, which stops the adversary technique from successfully exfiltrating or mining the listed information types; partial because the control is scoped to organizationally-classified sensitive data and chosen DLP rules rather than all chat mining, and its deception elements (honeypots) address only a narrow slice.
T1213.005responds — A.8.12 explicitly includes acting on detected leakage (quarantine, block transmissions, DLP tools that stop exposure) and orients actions as response to adversary intelligence gathering (e.g. honeypots, disinformation once actions are detected), which matches the `responds` verb once the technique is underway; partial because the clause is primarily oriented at detection/prevention of exfiltration rather than containment/eradication of already-mined chat data.
T1213.006detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces database mining and exfiltration in monitored environments; the remainder is unmonitored or internal adversary queries that evade the DLP scope.
T1213.006prevents — A.8.12's DLP tools and monitoring can block unauthorized extraction/transmission of sensitive data from databases (e.g. blocking queries, exfil via email/cloud, or copy-paste), directly stopping the technique from succeeding in many cases, but this is only a slice: the control does not stop initial database access, credential abuse, or all exfil paths, and many database platforms fall outside its monitoring scope.
T1216detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or file transfers), which would surface many proxy-execution events that involve exfiltration or movement of sensitive data, but the control is silent on detecting the proxy technique itself when no sensitive data is involved.
T1216.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces the anomalous remote scriptlet fetch and proxy execution in T1216.001 when it involves sensitive data or monitored channels, but only a slice of instances (not all PubPrn abuse carries detectable sensitive data or falls inside the chosen monitoring scope).
T1216.002detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions); the T1216.002 technique executes via wscript.exe and can produce observable network, file, or process artifacts that fall inside those monitored channels when exfiltrating or proxying sensitive/PowerShell payloads, but the clause's scope is set by identified/classified data and chosen tools, leaving many in-process script-abuse cases outside that boundary.
T1217detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when exfiltrated via files, email or uploads), and this surfaces browser-stored sensitive data (bookmarks, history, credentials) if/when it is read or moved; the remainder is local enumeration that never triggers an outbound channel or monitored action.
T1218detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or network transmissions), which can surface proxy execution of malicious content when it involves exfiltrating or moving sensitive data, but this is limited to data-centric cases rather than the technique's dominant process/signature-bypass executions.
T1218.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces the delivery/execution of a malicious CHM containing embedded payloads when it traverses those channels, but does not address in-memory or hh.exe execution post-delivery on Windows.
T1218.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), and auditing; this surfaces some abuse of control.exe/.cpl for exfiltration or proxying but not the technique's core execution, registration, or bypass behaviors in general.
T1218.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which surfaces CMSTP abuse when it involves exfiltrating or leaking data through monitored vectors, but does not broadly detect the technique's core proxy execution, DLL/SCT loading, or UAC bypass absent a data-leakage event.
T1218.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via untrusted services or email), and auditing; this surfaces some proxy-execution events when they involve exfiltrating or exposing monitored data, but the core technique (running InstallUtil to proxy arbitrary code) has no inherent data-leakage footprint and is outside the control's scope when it does not trigger a monitored channel or sensitive-data rule.
T1218.005detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.), using DLP tools to detect disclosure of sensitive information (including uploads and network transmissions), and acting on detected events, which would surface many mshta.exe abuse cases that involve external payloads or data exfiltration but not all in-memory or local-only executions.
T1218.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or other exfiltration), which surfaces some abuse of msiexec.exe when it results in observable data movement or leakage events, but the technique's core (proxy execution, DLL loading, or privilege escalation without exfil) is outside DLP's scope.
T1218.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which would surface the anomalous execution and network activity of odbcconf.exe proxying a malicious DLL in many but not all cases (e.g., purely local non-sensitive payloads or non-monitored channels remain unseen).
T1218.009detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, uploads, or file activity), which can surface anomalous use of signed binaries like Regsvcs/Regasm when they exfiltrate or trigger sensitive data movement, but this is scoped only to data-centric events rather than the full technique of proxy execution or COM attribute abuse itself.
T1218.010detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces Squiblydoo-style network-aware Regsvr32 abuse when it involves exfiltrating or loading sensitive data; this is only a slice of the technique's possible uses (local DLL proxying, persistence, or non-sensitive binaries).
T1218.011detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent or in unstructured data), which can surface some rundll32.exe abuse when it involves exfiltrating or exposing monitored sensitive data, but the technique's core (proxy execution, masquerading, function-name tricks) is outside DLP's data-centric focus.
T1218.012detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, uploads, and unstructured data), which can surface anomalous proxy execution or COM-based payload activity when it involves exfiltration or sensitive data movement, but the technique itself is local process execution with no inherent data leakage.
T1218.013detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which can surface mavinject.exe abuse when it involves exfiltrating or leaking data through monitored vectors, but the technique itself is a local process-injection proxy with no inherent data-leakage component in most executions.
T1218.014detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via untrusted services, email, or user actions), which surfaces the technique when it involves exfiltrating or exposing data through MMC-abused .msc files or related actions.
T1218.015detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which would surface anomalous Electron app behaviors involving exfiltration or planted JS, but the control's scope is limited to data-leakage events rather than all Electron abuse mechanics such as background command execution.
T1219detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), and acting on detected events, which surfaces post-compromise use of remote access tools when they transmit or exfiltrate data.
T1219.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces some IDE tunneling that exfiltrates or exposes data over monitored channels, but the bulk of the technique (establishing C2 tunnels, persistence via auto-reconnect, or lateral movement without data leakage) falls outside DLP scope.
T1219.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted via untrusted services or tools), which surfaces adversary use of remote desktop software for C2 exfiltration or interactive access carrying sensitive data.
T1219.003detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile/portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces hardware-based exfiltration once it moves data but does not broadly instrument the physical installation or out-of-band KVM session itself.
T1220detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in files, email, uploads, and exfiltration), which surfaces some XSL-scripting abuse when it involves sensitive data movement or anomalous file handling, but the bulk of T1220 is local process execution and application-control bypass with no data disclosure.
T1221detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted cloud) and using DLP tools to detect disclosure of sensitive information, which surfaces template-injection documents that fetch external payloads; this is a genuine but minority slice of the technique (e.g. post-delivery network or email vectors) while most variants (RTF byte modification, initial document crafting, forced auth without exfil) remain outside DLP scope.
T1222detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when files are exfiltrated or uploaded), and auditing; this surfaces T1222 when the permission change enables or accompanies unauthorized extraction of protected data, but only for the subset of cases that cross monitored leakage vectors rather than all permission modifications (e.g. local ransomware symlink changes).
T1222.001detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. via DLP tools watching email, file transfers, uploads to untrusted services); this surfaces some Windows permission modifications that expose protected data but not the technique's core act of altering DACLs/attributes in general, nor non-data-leak uses such as persistence setup.
T1222.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces the permission change when it causes or coincides with exfiltration of protected data, but the control is scoped to information movement rather than the permission-modification act itself on Linux/macOS endpoints.
T1480detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces guardrail-related checks or anomalous environment-specific behaviors when they involve exfiltration of sensitive data; this is a genuine but minority slice of T1480's full scope of environment checks and payload scoping.
T1482detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information, which can surface domain-trust discovery activity when it involves observable data exfiltration or anomalous queries over monitored channels, but the technique is primarily local API/LDAP enumeration with no inherent data leakage.
T1484detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some T1484 abuse that exfiltrates or leaks policy data but does not broadly detect configuration modifications such as GPO changes or trust alterations that do not involve observable data movement.
T1484.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces some GPO modifications that exfiltrate or transmit sensitive policy data but does not broadly detect the technique's core AD privilege-escalation or configuration changes.
T1484.002detects — A.8.12 explicitly requires monitoring channels for data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some trust modifications that expose credentials, tokens or federation settings as unauthorized extraction, but the bulk of T1484.002 (config changes inside identity providers or AD that do not transit monitored channels) sits outside its scope.
T1485detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads or emails), which surfaces some T1485 activity when it involves exfiltration-like steps or monitored channels, but the core of overwriting/deleting local files or cloud objects for availability impact has no required detection surface in the clause.
T1485recovers — A.8.12 explicitly requires protecting backups of sensitive data (via encryption, access control, physical measures) so that destroyed data remains recoverable from those backups; this matches the recovery verb but is only a slice of T1485's scope (e.g., does not recover data already overwritten in place without prior backup, nor non-backed-up cloud/VM deletions).
T1485.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), and auditing; this surfaces the adversary action of triggering mass deletion of stored objects in some scenarios (e.g. logs or sensitive data exfiltration paths) but not others (e.g. non-sensitive buckets or pure policy changes without observable leakage).
T1486detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces ransomware encryption activity on monitored data flows or endpoints; this is only a slice of T1486 because the technique can also act on unmonitored critical system files, hypervisors, or cloud objects outside DLP scope.
T1486recovers — A.8.12 explicitly requires protecting backups of sensitive data (via encryption, access control, physical measures) so that leakage is prevented and data remains recoverable after an encryption-for-impact event; this is a genuine but minority slice of the technique's broad scope (most T1486 victims lack such protected backups for all affected data).
T1489detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information, and auditing (e.g. of screenshots), which can surface anomalous service-stop activity when it enables or coincides with data exfiltration or leakage but does not broadly instrument service control-plane actions across platforms.
T1490detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in backups), and auditing; this surfaces some T1490 actions (e.g. deleting cloud snapshots, online backups, or exfiltrating recovery data) but not the majority of local Windows utility-based or firmware deletion techniques on non-monitored endpoints.
T1491.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure or exfiltration; while this surfaces data-leakage events, internal defacement (post-intrusion replacement of web content, login banners or desktop wallpaper) is only a narrow, non-exfiltration slice of what the control's monitoring would catch.
T1496detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted cloud services or via email), which surfaces some forms of resource hijacking such as proxy networks, SMS spam or cloud messaging abuse that involve outbound data flows, but does not address compute-intensive hijacking like cryptomining with no data exfiltration.
T1496.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure or exfiltration (including via tools that flag uploads, emails, or data movement), which surfaces compute-hijacking malware that exfiltrates or phones home; this does not cover purely local resource-consumption mining with no observable data movement, leaving a large named remainder on the dominant use case.
T1496.002detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage, uploads to untrusted services) and using DLP tools to detect disclosure of sensitive information, which surfaces anomalous outbound bandwidth consumption or exfiltration patterns that match several T1496.002 vectors such as botnet seeding, proxyjacking, and scanning; it does not instrument all bandwidth-hijacking scenarios (e.g., purely internal resource tasks without detectable sensitive-data markers).
T1496.003detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. via email, uploads, or network transmissions); this surfaces anomalous SMS-pumping traffic generated through victim web forms or messaging infrastructure, but only as a bounded slice of the technique's fraud/availability impact rather than its full scope.
T1496.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded/sent to untrusted third-party cloud services), which surfaces some SaaS hijacking activity that involves exfiltration-like or anomalous outbound use, but the control is silent on detecting compute abuse, quota exhaustion, or enabling of unused services for resource-intensive tasks such as LLMJacking.
T1498detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions and untrusted services), which surfaces anomalous outbound or exfiltration-like traffic that can indicate a Network DoS in progress; this is a genuine but minority slice of the broad technique (most DDoS uses spoofed or botnet flooding unrelated to data leakage).
T1499.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions), which surfaces anomalous floods or renegotiations that match leakage patterns, but this is a minority slice of general service-exhaustion DoS that does not involve data exfiltration.
T1505detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces some T1505 installations when they involve exfiltration or monitored server data flows, but the core technique of installing a malicious component on a server is outside the DLP focus on data movement and leakage.
T1505.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in database contexts), and auditing; this surfaces some abuse of stored procedures that exfiltrate or act on sensitive data but does not broadly detect all persistence mechanisms or CLR assembly abuse described in the technique.
T1505.002detects — A.8.12 explicitly requires monitoring channels of data leakage (including email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email or uploaded), which surfaces the exfiltration step of a malicious transport agent but does not address the agent's registration or persistence itself.
T1505.003detects — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information (e.g. uploads, email), and using DLP tools to identify/monitor at-risk data, which surfaces web shell activity when it involves exfiltration or sensitive data movement, but this is only a slice of web shell behaviors (command execution, persistence) rather than the technique itself.
T1505.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and acting on it; this surfaces the IIS component's traffic observation/modification or C2 proxying when it exposes or exfiltrates sensitive data, but only for the data-leakage slice of the technique rather than all installation or persistence uses.
T1505.005detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which would surface anomalous DLL replacement or RDP-abuse activity when it involves exfiltration or leakage of the modified termsrv.dll or related artifacts; this is a genuine but minority slice of the technique's persistence focus.
T1505.006detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), and auditing; this surfaces malicious VIB installation or masquerading when it involves exfiltrating or leaking sensitive data, but the technique's core (persistent boot changes via privileged esxcli on ESXi) has no necessary data-leakage component and would routinely evade DLP-focused detection.
T1518detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when exfiltrated via uploads, email or other means), which surfaces the T1518 enumeration step when it involves sensitive data such as security tooling or vulnerability-related software; the remainder is non-sensitive software discovery that never triggers DLP rules.
T1518.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when exfiltrated via email, cloud upload, or other channels), which would surface the specific discovery commands, API calls, or file/registry accesses that reveal security software presence; however this is scoped only to data-leakage contexts rather than general process or system discovery, leaving most of the technique (especially non-exfiltrating reconnaissance) outside its view.
T1518.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including in backups), which surfaces backup software discovery attempts when they trigger exfiltration-oriented indicators, but the clause's scope is limited to data-movement channels and does not broadly instrument arbitrary discovery commands or process listings for backup tools.
T1525detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads or exfiltration), which surfaces the act of implanting a malicious image containing sensitive/backdoor payloads into a registry; this is only a slice of the technique because the control is scoped to data-leakage events rather than all persistence-oriented image tampering.
T1526detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), and monitoring for adversary intelligence actions; this surfaces some discovery activity when it involves exfiltration or leakage of enumerated service data but does not broadly instrument or surface the core enumeration technique itself.
T1528detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via email, file transfers, uploads to untrusted cloud services), which surfaces some token-theft vectors when they involve exfiltration of token material, but leaves the majority of T1528 cases (in-memory theft from compromised containers/CI pipelines/IMDS, OAuth phishing without data movement, refresh-token theft) outside its defined scope.
T1530prevents — DLP monitors uploads to untrusted cloud storage services, preventing the bulk transfer of sensitive files stored in cloud repositories.
T1530detects — A.8.12 explicitly requires monitoring channels, identifying/monitoring sensitive information at risk, and detecting disclosure events such as uploads to untrusted cloud services, which directly surfaces T1530 access to cloud storage objects (especially via misconfigs or leaked creds).
T1530responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exposure in flight) and orients actions as response to adversary intelligence gathering, which matches the `responds` verb once the T1530 access event is underway; extent is only partial because the control is scoped to outbound leakage channels and does not address containment/eradication of an already-completed cloud-storage exfiltration.
T1534detects — A.8.12 explicitly requires monitoring channels (email, file transfers, chat, uploads) and using DLP tools to detect disclosure of sensitive information, which surfaces the internal spearphishing messages, attachments, links, or credential-capture attempts once they are sent inside the organization.
T1534prevents — A.8.12's DLP tools and monitoring can block exfiltration of sensitive data or credentials via monitored channels (email, file transfers, chat apps, uploads) that internal spearphishing often relies on to spread payloads or capture info, but this does not stop the initial trusted-account compromise, impersonation, or non-data-leakage vectors like device control.
T1534responds — A.8.12's DLP tools detect and block disclosure/transmission of sensitive information (including via email, chat, file transfers) and can quarantine or respond to internal spearphishing attempts that spread malicious content or seek credentials, but this is scoped only to data-leakage slices of the multi-staged technique rather than full incident response or eradication.
T1535detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), and monitoring for adversary intelligence actions; this surfaces T1535 activity when it involves exfiltrating or operating on sensitive data in unused regions, but the technique's core (creating unmonitored instances for evasion or crypto mining) is only a minority slice of what DLP tools observe.
T1537detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services), and acting on it; this surfaces T1537 transfers to adversary cloud accounts in the same provider, though internal/same-provider blending and non-sensitive data leave a bounded remainder.
T1537prevents — A.8.12 explicitly requires monitoring channels, detecting disclosures to untrusted cloud services, and blocking transmissions or user actions that expose sensitive data (including via DLP tools or remote-view configs that stop copy/paste/export), which stops many same-provider cloud-account transfers before they succeed; it is only partial because the technique can still succeed via privileged insider APIs, SAS links, or backups that bypass DLP scope or detection rules.
T1537responds — A.8.12 explicitly requires monitoring channels, detecting disclosures (including to untrusted cloud services), blocking transmissions, quarantining, and acting on leaks once underway, which directly maps to containing/eradicating an in-progress T1537 exfil to an adversary cloud account; partial because the clause is scoped to DLP tooling and policy-driven actions on monitored channels rather than all cloud-native mechanisms like internal APIs, SAS URIs, or honeypot misdirection.
T1538detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services), which surfaces the adversary's use of a stolen-credential dashboard to enumerate/exfiltrate cloud data; partial because the clause's scope is set by identified/classified sensitive data and chosen monitoring channels, leaving dashboard use on unmonitored services or non-sensitive assets undetected.
T1539detects — A.8.12 explicitly requires monitoring channels (email, file transfers, network transmissions, cloud uploads) and using DLP tools to detect disclosure of sensitive information, which surfaces the exfiltration step of T1539 when cookies traverse those channels; the local malware/JS/memory theft slice is a bounded remainder.
T1539prevents — A.8.12's DLP tools and monitoring can block exfiltration of cookies (e.g. via email, upload, or network transmission of sensitive data on disk/memory), but do not stop local malware/JS injection, in-memory theft, or proxy-based collection before any leakage channel is used.
T1542.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted services), and auditing; this surfaces some adversary actions that exfiltrate or manipulate firmware-related secrets but does not broadly detect firmware modification itself.
T1542.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in files, uploads, email), and auditing; this surfaces bootkit-induced anomalies or exfiltration of sensitive boot-sector data in some monitored channels but does not broadly detect the low-level boot-sector modification itself.
T1542.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces the unauthorized firmware load or exfiltration step in ROMMONkit even though the low-level boot manipulation itself is designed to be difficult to detect.
T1542.005detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transfers to untrusted services), which surfaces the TFTP-based exfiltration of unauthorized images in a bounded slice of network file-transfer scenarios, but leaves the majority of boot-sequence manipulation and device-local config changes outside its telemetry scope.
T1543detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which surfaces anomalous system behavior that can include creation/modification of system processes for persistence when those actions involve exfiltrating or staging sensitive data.
T1543.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), and auditing; this surfaces the .plist placement or launch-agent execution when it involves exfiltration of monitored sensitive data, but the core persistence action itself (local agent creation without data movement) lies outside DLP scope.
T1543.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), which can surface systemd service modifications that exfiltrate or leak data, but the control does not address creation/modification of services for persistence itself or non-exfiltration cases.
T1543.003detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, cloud uploads, or exfiltration of classified data), which surfaces some T1543.003 activity when the service or driver involves outbound leakage of sensitive material, but the vast majority of service creation/modification for persistence (registry changes, driver loading, masquerading, hiding) has no data-leakage component and is unreachable by this control.
T1543.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces some Launch Daemon behaviors when they involve exfiltration of monitored sensitive data or anomalous network/file activity, but the core persistence action of installing/modifying a plist to run at boot is outside DLP scope on macOS.
T1543.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, emails), which can surface anomalous container/service modifications that expose or exfiltrate data, but this is only a slice of the technique's persistence/escalation behaviors that do not involve data movement.
T1546detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted services or email), which surfaces some T1546 abuse when it involves observable data exfiltration or anomalous event-triggered actions on monitored channels, but leaves the bulk of trigger creation/modification and non-data events (e.g. logon WMI) outside its scope.
T1546.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), and auditing; this surfaces the anomalous file-association change or its triggered execution when it involves exfiltration of identified/classified sensitive data, but only a minority slice of the persistence technique (most instances are unrelated to leakage).
T1546.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via user actions like screenshots), and auditing; this surfaces the screensaver execution when it triggers malware that performs exfiltration or other detectable leakage, but the core persistence mechanism itself (registry manipulation and timed PE launch on inactivity) is outside DLP's primary scope.
T1546.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which can surface anomalous WMI activity tied to persistence or exfiltration but does not broadly instrument or guarantee detection of the WMI subscription technique itself.
T1546.004detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), which can surface malicious shell-configuration changes that exfiltrate or otherwise leak data; this is only a slice of the persistence technique itself, which is not inherently a data-leakage event.
T1546.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which surfaces anomalous or unauthorized activity that could include trap-based persistence mechanisms when they trigger data exfiltration or related signals.
T1546.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via untrusted services or email), and acting on detected events; this surfaces the technique when the added dylib causes exfiltration or other observable leakage of protected information, but the control is silent on the binary-modification step itself and on non-leakage uses of the persistence.
T1546.007detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which would surface the anomalous netsh.exe execution or registry activity if it exfiltrates or involves monitored sensitive data, but this is scoped only to data-leakage events rather than the persistence technique itself.
T1546.008detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when exfiltrated via network, email, or upload), and auditing; this surfaces the technique when it involves leaking/replacing system binaries or using the backdoor for data extraction, but the core local binary/registry replacement at login has no data flow and is outside DLP scope.
T1546.009detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or exfiltration-like actions), which surfaces some instances of this Windows persistence technique when it triggers observable data movement or anomalous process behavior, but leaves the bulk of registry-based AppCert DLL loading and privilege-escalation aspects undetected.
T1546.010detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, and email), which can surface anomalous DLL loading or exfiltration tied to AppInit abuse on Windows, but this is scoped only to data-leakage observables rather than the persistence/elevation technique itself.
T1546.011detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which surfaces some T1546.011 abuse when it triggers observable data exfiltration or persistence artifacts, but leaves the bulk of shim installation/execution (privilege escalation, DLL injection, defense disablement) outside monitored leakage channels.
T1546.012detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which surfaces some IFEO-based persistence or defense-impairment activity when it involves exfiltration or observable leakage of sensitive data, but most IFEO abuse (registry changes, debugger hijacking, silent-exit monitoring, privilege escalation without data movement) produces no detectable leakage event.
T1546.013detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers, uploads, or exfiltration-like actions), and this surfaces the profile modification or its triggered execution when it involves sensitive data movement, but the technique is primarily local persistence via script execution with no inherent data leakage component in most cases.
T1546.014detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded), and auditing; this surfaces emond rule-loading or email actions that exfiltrate data but does not broadly detect the persistence technique itself on macOS.
T1546.015detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or other exfiltration), and the COM hijacking technique (especially its TypeLib variation) can be surfaced when it triggers outbound network activity, remote script fetches, or anomalous registry-triggered behavior that DLP or related monitoring observes.
T1546.016detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers, uploads, and scripts that could exfiltrate during install), and acting on detections, but this only surfaces a subset of installer-script abuse (e.g., when it involves sensitive data movement) rather than the persistence/elevation technique itself.
T1546.017detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via portable storage devices and hardware events), which surfaces some udev-rule abuse when it involves exfiltration or sensitive data triggers, but does not broadly detect persistence-oriented udev rule installation or execution itself.
T1546.018detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when code or data is sent via email, uploaded to cloud services, or extracted), which surfaces Python startup-hook abuse when it triggers observable leakage of sensitive information or files, but this is only a slice of the persistence technique itself (most hook executions do not involve detectable exfiltration).
T1547detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via monitoring user systems, email, file transfers, uploads, and network transmissions), which can surface anomalous autostart/persistence changes that exfiltrate or reference sensitive data, but this is only a slice of T1547's boot/logon mechanisms (e.g., registry mods, kernel extensions) rather than broad detection of the technique itself.
T1547.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, portable devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or exfiltration), which surfaces some but not most Registry Run Keys/Startup Folder persistence artifacts since those are local config changes that rarely involve outbound data movement or monitored channels.
T1547.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and auditing; this surfaces some LSA authentication package abuse when it involves observable exfiltration or sensitive data movement, but most of the technique (registry modification for boot-time DLL execution) has no data-leakage footprint and remains undetected by it.
T1547.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and auditing; this surfaces the registration and loading of a malicious time-provider DLL as anomalous/sensitive data movement at boot or parameter change, but only for the subset of cases where the payload or its effects cross a monitored channel.
T1547.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which can surface anomalous Winlogon modifications or DLL loads that exfiltrate or indicate persistence artifacts, but this is scoped only to data-leakage observables rather than the technique's core registry abuse or persistence mechanism.
T1547.005detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including credentials in transit or exfiltration), which surfaces SSP abuse that extracts plaintext passwords from LSA; this is a genuine but minority slice of the technique's full scope (registry modification at boot is not caught by DLP).
T1547.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), and auditing; this surfaces some LKM/kext rootkit behaviors such as selective hiding of network activity or log tampering when they trigger monitored exfiltration channels, but the core technique of loading kernel modules for persistence runs at ring 0 with no necessary data-leakage artifact and is outside DLP scope on Linux/macOS.
T1547.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers or uploads), and auditing; this surfaces the plist modification and malicious path addition when it involves exfiltrating or leaking sensitive data, but the technique's core (local persistence via login plist) has no inherent data-leakage component and can be performed without triggering DLP channels.
T1547.008detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or system-level actions), which can surface LSASS driver modifications or related anomalous behavior on Windows systems, but only for a slice tied to data exfiltration rather than the persistence technique itself.
T1547.009detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via file transfers, uploads, email, and user actions like copy/paste), which can surface shortcut modifications that involve sensitive data movement or persistence artifacts, but this is limited to cases where the technique exposes or leaks monitored information rather than the technique in general.
T1547.010detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which surfaces the anomalous boot-time DLL load and SYSTEM-level activity performed by this technique when it involves exfiltration or sensitive data movement, but the control's scope is limited to data-leakage events rather than the persistence mechanism itself.
T1547.012detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via file/registry changes or exfiltration-like actions), which surfaces some instances of this boot-time DLL abuse when it involves identifiable sensitive data movement, but the technique is primarily a local persistence mechanism with no inherent data-leakage component in most executions.
T1547.013detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when files are written, uploaded or executed), which surfaces the addition or execution of a malicious .desktop file in autostart paths as anomalous behavior on Linux systems; partial because the clause's scope is set by identified/classified sensitive data and chosen monitoring channels, leaving many persistence-oriented autostart modifications outside that scope
T1547.014detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which would surface the execution or network activity of a malicious Active Setup StubPath in many realistic cases, but the technique is a local persistence registry change whose initial setup and login-triggered execution often fall outside DLP's data-centric monitoring scope.
T1547.015detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), and auditing; this surfaces some login-item additions that involve observable file/registry changes or exfiltration-like behavior on macOS, but the bulk of the technique (API/scripted persistence with no data movement) sits outside DLP scope.
T1548detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which can surface some T1548 abuse of elevation mechanisms when it involves exfiltration of sensitive data or related anomalous actions, but this is only a minority slice of the technique's scope focused on privilege escalation itself.
T1548.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via file transfers or uploads), which surfaces the setuid/setgid abuse when it involves exfiltrating or transmitting data but does not address the core technique of setting or abusing the bits for local privilege escalation.
T1548.002detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via email, file transfers, uploads, and user actions), which surfaces some UAC-bypass techniques that involve observable data movement or exfiltration of sensitive material, but leaves the bulk of pure privilege-elevation methods (COM hijacks, eventvwr.exe, process injection without data leakage) outside its scope.
T1548.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces some sudo/sudoers abuse that involves exfiltrating or transmitting credentials, configs, or elevated outputs, but the core technique (local timestamp monitoring, editing /etc/sudoers, or NOPASSWD abuse) is mostly in-process/local privilege escalation with no necessary data leakage component.
T1548.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces the credential prompt and any subsequent sensitive-data action on macOS but only for the subset of executions that involve identifiable sensitive information rather than the technique itself.
T1548.005detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services), and auditing; this surfaces some abuse of temporary elevated cloud access when it involves exfiltrating or exposing data, but the technique's core (JIT/impersonation/PassRole permission abuse without data movement) lies outside DLP scope.
T1548.006detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), and auditing; this surfaces TCC manipulation when it triggers observable data-access or exfiltration events on monitored channels, but the core database manipulation itself (especially with SIP disabled) is a local permission-abuse step that is not inherently a data-leakage event and can remain inside the monitored-slice remainder.
T1550detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk of disclosure, and detecting when it is uploaded/sent; alternate auth material (hashes, tickets, tokens) is sensitive data whose exfiltration or anomalous use can be surfaced by DLP tooling, but this is only a slice of the technique (theft via memory scraping, registry, or in-process access often evades channel-based DLP).
T1550.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services or sent via email), which surfaces some token-based exfiltration or API abuse when it involves identifiable sensitive data, but the technique is primarily about using a stolen token for direct API access that often aligns with legitimate workflows and is not dependent on leaking data through monitored channels.
T1550.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces some PtT activity when tickets or related credential material traverse monitored channels or appear in exfiltration, but the core technique (in-memory ticket use for lateral auth) has no necessary data-leakage footprint and is outside the control's primary scope.
T1550.004detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted cloud services or email), which surfaces the exfiltration or use of a stolen session cookie in some network or endpoint contexts, but leaves many in-browser or post-import uses of T1550.004 outside its defined monitoring scope.
T1552detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and using DLP tools to detect disclosure of sensitive information (including credentials in files, registries, or artifacts), which surfaces the T1552 search/exfiltration behavior on monitored vectors.
T1552prevents — A.8.12's DLP tools and monitoring can block exfiltration of discovered credentials (e.g. blocking copy/paste, email, or upload of files containing them), but do not stop the adversary's initial search and discovery of unsecured credentials on the compromised system itself.
T1552.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to identify/monitor sensitive information at risk and detect its disclosure (including in files, emails, uploads, and unstructured data on user systems), which surfaces the search for and presence of credential-containing files before or during exfiltration.
T1552.001prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, file transfers, uploads, copy-paste) can stop exfiltration of credential files once discovered, but do not stop the initial search for or insecure storage of credentials in files, nor cover all vectors like backups, container logs, or VM extraction.
T1552.002detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including unstructured data), which surfaces credential-storing registry values when they are read or exfiltrated; it does not instrument or surface the initial registry query itself.
T1552.003detects — A.8.12 explicitly requires monitoring channels of data leakage (including file transfers) and using DLP tools to detect disclosure of sensitive information, which can surface the presence of credential-bearing shell history files when they are read, transferred or exfiltrated; this is a genuine but minority slice of the technique because the control is scoped to sensitive-data events rather than to credential searches inside local history files that are never moved.
T1552.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when files are accessed, uploaded or exported), and auditing; private keys are a named sensitive asset whose search/export would trigger those detections on covered channels.
T1552.004prevents — A.8.12's DLP tools and monitoring can block exfiltration of discovered private-key files (e.g. via email, upload, copy/paste), stopping the technique's post-search use, but do not stop the initial local search or extraction of the keys themselves.
T1552.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent), which surfaces attempts to exfiltrate credentials/secrets obtained from the Instance Metadata API; however this is scoped to organization-defined channels and tools rather than all possible access methods or the API query itself.
T1552.006detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; this surfaces the technique of pulling and decrypting credentials from GPP XML files in SYSVOL as unauthorized extraction of sensitive data.
T1552.006prevents — A.8.12's DLP tools and monitoring can detect and block extraction or exfiltration of the discovered credential-containing XML files from SYSVOL or endpoints, but do not stop the core technique of locating and decrypting GPP credentials in the first place.
T1552.007detects — A.8.12 explicitly requires monitoring channels, identifying/monitoring sensitive information at risk, and detecting its disclosure (including via tools that flag uploads or transmissions), which surfaces credential-gathering via container APIs when those credentials or the API calls themselves cross monitored channels or match sensitive-data patterns.
T1552.008detects — A.8.12 explicitly requires monitoring channels of data leakage (including email and file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email or uploaded), which directly surfaces unsecured credentials being passed through chat/communication services on supported platforms.
T1552.008prevents — A.8.12 explicitly requires monitoring channels of data leakage (including email and file transfers) plus DLP tools that detect and block disclosure of sensitive information (e.g. when sent via email or uploaded), which directly stops unsecured credential transmission in chat/comms services before the adversary can collect it; partial because the control is scoped to organization-determined sensitive data and leaves chat-specific credential patterns, SaaS admin portals, and integration-tool compromises as uncovered slices.
T1552.008responds — A.8.12 explicitly includes acting on detected leakage (quarantine, block transmissions, DLP tools that stop exposure) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which can contain or eradicate an in-flight credential exfiltration from chat services once underway.
T1553detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces some trust-subversion activity when it involves exfiltration or leakage of signed/untrusted artifacts, but the clause is scoped only to data-leakage vectors and does not address the dominant methods of T1553 such as registry modification, permission changes, or certificate theft on local systems.
T1553.001detects — A.8.12 explicitly requires monitoring channels for data leakage and using DLP tools to detect disclosure of sensitive information (including via email, uploads, file transfers, and user actions), which surfaces some Gatekeeper-bypass vectors that involve exfiltration or unauthorized transfer of untrusted/malicious files, but the control is silent on macOS-specific quarantine-flag or code-signing subversion and does not address the bulk of the technique's stealthy local execution paths.
T1553.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces adversary acquisition or use of code-signing materials when they traverse monitored paths, but this is limited to data-movement observables and does not address local creation, theft, or offline signing on macOS/Windows endpoints outside DLP scope.
T1553.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some hijack-induced trust bypasses when they involve exfiltration of sensitive data but does not address the core registry/DLL tampering or most signature-validation subversions themselves.
T1553.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including uploads and network transmissions), which surfaces the root-certificate installation action when it involves exfiltrating or transmitting cert material, but the technique's core local installation (e.g. via command or supply-chain) is outside DLP's typical data-focused scope
T1553.005detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including uploads and transfers), which surfaces MOTW-bypass attempts when they involve exfiltration or movement of tagged sensitive payloads, but does not broadly instrument or surface the bypass technique itself in all its forms (e.g., local container extraction without network/email involvement).
T1553.006detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces the technique when it involves exfiltrating or transmitting modified policy artifacts or unsigned code, but the control is scoped to data-leakage events rather than all policy modifications or kernel-memory changes.
T1554detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads, emails, or exfiltration of modified binaries containing sensitive data), but this only covers a slice of T1554's binary modification techniques that involve observable leakage rather than all persistence or patching behaviors.
T1555detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, email), which surfaces credential theft from common password stores when it involves exfiltration or observable leakage events.
T1555prevents — A.8.12's DLP tools and monitoring can block exfiltration of discovered credential files or vaults from endpoints/cloud (e.g. via email, upload, copy-paste), stopping the technique's post-search disclosure step in covered channels, but do not stop the initial local search and extraction from common stores.
T1555.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), which surfaces credential theft from Keychain when it traverses a monitored channel; it does not instrument or surface the in-memory/file read itself on macOS.
T1555.001prevents — A.8.12's DLP tools and monitoring can block exfiltration channels (e.g. email, uploads, copy/paste) for sensitive data including credentials once they leave Keychain storage, but do not stop the initial local acquisition via security command, file read, or Keychain Access on macOS.
T1555.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; this surfaces the exfiltration of credentials from securityd memory as a leakage event on monitored channels, but only where those channels or tools are in scope for memory/process-level extraction on the given platforms.
T1555.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices), using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and acting on it; browser credential files and process memory qualify as sensitive data at risk of unauthorized extraction, so detection holds for most of the technique's vectors.
T1555.003prevents — A.8.12's DLP tools and monitoring can block exfiltration channels (e.g. email, file transfers, uploads to untrusted services) after credential files are read from disk or memory, but do not stop the initial local file read, SQL query or process-memory search that acquires the credentials.
T1555.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when extracted or uploaded), and auditing; this surfaces the technique when credentials are read, enumerated, backed up or recovered from Credential Manager as sensitive data exfiltration.
T1555.004prevents — A.8.12's DLP tools and monitoring can block exfiltration channels (e.g. email, file transfer, uploads) after credentials are acquired from Credential Manager, and its deception measures (honeypots, false data) can deter the technique, but nothing in the control stops the initial local acquisition via vaultcmd, file reads, APIs, or backups on Windows.
T1555.005detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that surface unauthorized extraction or upload), which directly surfaces the technique of credential extraction from unlocked password-manager memory/databases on endpoints.
T1555.005prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, file transfers, uploads, copy-paste) can stop exfiltration of unlocked plaintext credentials from memory or disk files, but do not stop the core acquisition techniques of memory extraction or master-password brute-forcing that occur before any leakage channel is used.
T1555.006detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded/sent or at risk in unstructured data), which surfaces credential theft from cloud secrets stores when it traverses a monitored channel; this is a genuine but minority slice because the technique can succeed via direct API calls from a privileged/compromised service without observable leakage across email, file transfer, or user-driven exfil channels.
T1556detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. via DLP tools on email, uploads, or exfiltration), which surfaces some T1556 instances that involve credential theft or exfiltration of modified auth data, but leaves the bulk of in-process auth modifications (e.g. LSASS/PAM tampering without data movement) outside its scope.
T1556.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data or network transmissions), and auditing; this surfaces the anomalous authentication patching and credential injection on a DC as a data-leakage or espionage indicator, but only for the subset of cases that cross monitored channels or involve exfiltrated material rather than the in-memory patch itself.
T1556.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including credentials in transit or exfiltration); a malicious password filter that receives and can exfiltrate plaintext credentials matches this detection surface, but the control's focus is primarily on data channels rather than in-process authentication hooks, leaving a genuine remainder.
T1556.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded), and auditing; this surfaces some PAM modifications or credential harvesting if they trigger observable data exfiltration, but the core technique (patching PAM for backdoors or in-memory harvesting) is mostly in-process with no guaranteed data-leakage artifact.
T1556.004detects — A.8.12 explicitly requires monitoring channels for leakage/disclosure and using DLP tools to detect when sensitive information is disclosed (e.g. uploads, emails), which surfaces the backdoor password or modified image if it is exfiltrated or transmitted; this is a genuine but minority slice of the technique itself (which is an on-device implant, not an outbound disclosure event).
T1556.005detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces the enabling of reversible encryption or the resulting credential exposure in monitored channels, but the core technique (setting a policy property via GPO/PowerShell) is a configuration change outside typical DLP scope, leaving a large remainder
T1556.006detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), which surfaces adversary actions that modify/disable MFA mechanisms involving configuration changes, patching, or exfiltration-like steps on monitored channels.
T1556.007detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces some on-prem/cloud hybrid authentication tampering that involves credential harvesting or exfiltration of identity data, but the core technique (patching backdoors into PTA/AD FS processes) is an in-memory or config-level auth bypass that is only partially overlapped by data-leakage-focused detection.
T1556.008detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including credentials in transit or exfiltration), which surfaces the credential-capture outcome of this technique when it triggers a monitored channel; it does not instrument the registry-based installation or the NPLogonNotify hook itself.
T1556.009detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some adversary actions that modify conditional access policies to enable unauthorized access or exfiltration, but only for a slice involving observable data movement rather than the policy modification itself.
T1557detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or via email), which surfaces some AiTM behaviors that result in exfiltration or sniffing but does not broadly detect protocol abuse like ARP/DNS/LLMNR poisoning used to establish the position itself.
T1557prevents — A.8.12's DLP tools and channel monitoring can block exfiltration of sensitive data once an AiTM position enables sniffing or manipulation, but do not stop the core network-protocol abuse (ARP/DNS/LLMNR poisoning, downgrade attacks) that establishes the position itself.
T1557.001detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces the credential material or hashes sent during name-resolution poisoning/relay but does not broadly instrument the LLMNR/NBT-NS/mDNS spoofing itself.
T1557.002detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, network transmissions) and using DLP tools to detect disclosure of sensitive information, which surfaces ARP-poisoning-enabled sniffing or data exfiltration when it involves observable leakage of classified data; this is only a slice of the technique because ARP cache poisoning itself is a local-layer MITM that can succeed without triggering data-leakage observables.
T1557.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), and acting on detected events; this surfaces the collection/exfiltration step after successful DHCP spoofing/AiTM but does not address the spoofing, rogue server, or network configuration steps themselves.
T1557.004detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud or email), which surfaces the network sniffing / transmitted-data-manipulation / input-capture that follows evil-twin connection; this is a genuine but minority slice of the technique whose core (hosting the rogue AP and coercing the connection) lives outside those monitored channels.
T1558detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in file transfers, uploads, and unstructured data), which would surface Kerberos ticket theft when the ticket material is handled or exfiltrated; it does not address forging in memory or klist use that never touches a monitored channel.
T1558.001detects — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information (including via tools that flag uploads/emails), and acting on it, which surfaces golden-ticket use when it triggers observable data exfiltration or anomalous Kerberos activity; partial because the clause scopes to data-leakage events rather than all forgery or credential-use artifacts, and the espionage-oriented paragraph is only advisory.
T1558.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some silver-ticket uses that involve exfiltrating or abusing service-account material, but the technique's offline forging and local use on Windows systems (without data movement) largely evades DLP-oriented detection.
T1558.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, network transmissions) and using DLP tools to detect disclosure of sensitive information, which would surface TGS ticket material or hashes traversing those channels; it does not address the dominant in-memory or DC-request aspects of Kerberoasting.
T1558.005detects — A.8.12 explicitly requires monitoring channels for data leakage, using DLP tools to detect disclosure of sensitive information (including when files are accessed, uploaded or exfiltrated), and credential-cache files containing Kerberos tickets qualify as sensitive information whose unauthorized extraction can be surfaced by those tools; the coverage is only partial because the control's scope and tooling are scoped by organizational policy rather than mandating universal coverage of every ccache location or in-memory case on Linux/macOS.
T1559detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which surfaces some but not most IPC-based execution that exfiltrates or moves data between processes.
T1559.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or other exfiltration), which can surface COM-based local execution when it triggers observable data movement or leakage patterns, but this is only a slice of the technique's possible behaviors (many of which involve no data leakage at all).
T1559.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), and acting on it; this surfaces some DDE-based exfiltration or command payloads that carry or expose sensitive data, but the bulk of T1559.002 is local IPC/command execution with no data leakage involved.
T1559.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which can surface some XPC-based local privilege-escalation attempts that involve exfiltrating or leaking data, but the bulk of the technique is local IPC abuse with no data disclosure.
T1560detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure (including uploads, emails, or exfiltration-like actions), which surfaces T1560's compression/encryption of collected data when it traverses monitored vectors or matches sensitive patterns.
T1560prevents — A.8.12's DLP tools and monitoring explicitly block network transmissions, email, file transfers, uploads to untrusted services, and copy/paste of sensitive data — directly stopping the exfiltration step that T1560's archiving prepares for — but only for data the organization has identified/classified as sensitive and only on monitored channels, leaving unclassified data, non-monitored vectors, or post-collection local archiving untouched.
T1560.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when packaged for exfiltration to untrusted services), and acting on it, which surfaces the archive-via-utility technique in flight for most common channels and data types.
T1560.001prevents — A.8.12's DLP tools and monitoring can block exfiltration of sensitive data (including when it has been archived/compressed by the adversary), but this is scoped only to identified/classified sensitive information and chosen channels, leaving the bulk of T1560.001's utility-abuse technique (any data, any utility, any unmonitored path) untouched.
T1560.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure events (including exfiltration of collected data), which surfaces T1560.002 archiving of sensitive information prior to exfiltration; the remainder is library use that evades the specific monitoring or data-classification rules chosen by the implementer.
T1560.002prevents — A.8.12's DLP tools and monitoring can block exfiltration of already-archived sensitive data (e.g. via email, uploads, or copy actions), but do not stop an adversary from invoking or linking archival libraries to compress/encrypt data in the first place
T1560.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure events (including exfiltration of collected data), which surfaces custom archival prior to exfil; the named remainder is fully custom/obfuscated cases that evade signature-based or content-aware DLP.
T1560.003prevents — A.8.12's DLP tools and monitoring can block transmissions or copy actions that would exfiltrate custom-archived data when the sensitive payload is recognized, but custom methods (XOR, in-memory stream ciphers, no library calls) routinely evade signature-based detection and leave most instances unprevented.
T1561detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when written to storage or exfiltrated), and auditing; this surfaces some disk-wipe activity that touches monitored sensitive data or channels but leaves the bulk of raw-sector/MBR wipes on unmonitored systems or devices outside its scope.
T1561recovers — A.8.12 explicitly requires protecting backups of sensitive data (via encryption, access control, physical measures) so that wiped/corrupted data on primary systems can be restored from those backups, directly enacting recovery after the T1561 impact.
T1561.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted services or via transfers), and auditing; this surfaces disk-wipe activity when it involves exfiltration-like or monitored channels, but the core local low-level overwrite (raw disk drivers, arbitrary sectors) has no necessary data-leakage signature and is outside the control's primary scope.
T1561.001recovers — A.8.12 explicitly requires protecting backups of sensitive data with encryption, access control and physical measures, which enables recovery of wiped content from those backups; this is only a slice of the technique because the control is scoped to leakage prevention, does not mandate universal or timely backups, and the technique can target non-backed-up or non-sensitive data on live systems.
T1561.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when transmitted or exfiltrated); while disk-structure wipe is not exfiltration of information, the control's monitoring/auditing of destructive actions (screenshots, backups, worm-like propagation) and adversary-intelligence actions surfaces the technique in a minority of cases (e.g. network propagation or honeypot interaction) but leaves the bulk of local MBR/partition overwrites on endpoints unreached.
T1561.002recovers — A.8.12 explicitly requires protecting backups of sensitive information with encryption, access control and physical measures, enabling restoration of wiped disk structures from clean backups after the destructive technique has run.
T1563detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which surfaces session hijacking when it involves exfiltration or movement of monitored sensitive data, but does not broadly detect all hijacking techniques (e.g., pure lateral movement without data disclosure).
T1563.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), and auditing; this surfaces some SSH hijacking activity when it involves observable exfiltration or anomalous use of an active session, but the core local agent/socket compromise on Linux/macOS is outside typical DLP scope.
T1563.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), and auditing; RDP hijacking via tscon.exe can be surfaced as anomalous session behavior or unauthorized lateral movement on monitored channels, but this is only a slice of the technique's possible forms (local, credential-less, non-sensitive-data, non-network).
T1564detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces some hiding behaviors when they involve exfiltration of monitored data; this does not reach hiding of files, accounts, virtualization containers, or non-sensitive artifacts, leaving an open rather than bounded remainder.
T1564.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in files on user systems), and auditing; this surfaces hidden-file techniques when they involve exfiltration of monitored sensitive data, but does not broadly detect all hidden-file usage unrelated to leakage.
T1564.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces hidden-user creation or use when it involves exfiltration of classified/sensitive data or adversary intelligence gathering, but the technique itself is local account manipulation with no inherent data movement or leakage so most instances go unseen.
T1564.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via user actions, uploads, email, or exfiltration), which would surface many hidden-window techniques that conceal data-extraction or C2 activity; however, purely UI-concealment tactics with no data movement fall outside DLP scope, and the control's focus is data-centric rather than general process/behavior monitoring.
T1564.004detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk, and detecting its disclosure (including via tools that surface when data is moved or exfiltrated), which can surface NTFS attribute abuse when it involves monitored sensitive data or channels, but the control is silent on attribute metadata, non-sensitive data, or non-channel uses of ADS/EA.
T1564.005detects — A.8.12 explicitly requires monitoring channels for data leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data, uploads, or exfiltration), which surfaces hidden-file-system artifacts when they involve monitored sensitive data movement; this is a genuine but minority slice of the broad technique that can hide arbitrary non-sensitive malicious components without triggering data-focused detection.
T1564.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), and auditing; this surfaces some T1564.006 behaviors that involve data movement or exfiltration from the virtual instance but does not address VM creation, hidden artifacts inside the instance, or non-data-leakage aspects of the technique.
T1564.007detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in documents and via email/cloud), which can surface VBA-stomped Office files carrying hidden malicious payloads when they traverse monitored vectors; it does not guarantee detection of the technique itself when the document is at rest or the p-code is never triggered.
T1564.008detects — A.8.12 explicitly requires monitoring channels of data leakage (including email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), which surfaces the creation or effect of malicious hiding rules that filter security alerts or phish-related content; this is a genuine but minority slice of the technique's full scope (any rule, any mailbox, any platform, organization-wide transport rules).
T1564.009detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in files, uploads, email), and auditing; this surfaces resource-fork abuse when it involves exfiltrating or exposing hidden sensitive content, but the control is scoped to data-leakage events rather than all stealth or evasion uses of forks on macOS.
T1564.010detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in memory/unstructured data on user systems), which surfaces some in-memory PEB manipulation when it involves exfiltration or observable leakage, but the technique's core is stealthy argument spoofing that evades process-creation sensors without necessarily triggering data-leakage channels.
T1564.012detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including file-based artifacts moved to untrusted locations), and auditing; this surfaces some abuse of AV exclusions for hidden payloads but only where the excluded path or action intersects monitored sensitive-data channels, leaving most non-sensitive or non-channel uses undetected.
T1564.014detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in unstructured data or exfiltration attempts), which surfaces xattr-hidden payloads when they trigger monitored actions like file transfer or upload, but does not inspect or surface xattrs themselves as a general mechanism.
T1565detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces T1565 manipulations once they occur on monitored vectors; the remainder is offline or non-channel manipulations outside DLP scope.
T1565.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure or exfiltration attempts, which surfaces stored-data manipulation when it involves monitored channels or sensitive information movement (e.g. upload, copy, backup); the remainder is stealthy offline manipulation of non-monitored local files that never triggers a channel or tool.
T1565.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting its disclosure (e.g. uploads to untrusted services or email), which surfaces T1565.002-style in-transit manipulation of transmitted data; the remainder is non-sensitive or non-monitored channels.
T1565.003detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads or emails), which surfaces runtime data manipulations that affect displayed information when they involve observable leakage vectors, but leaves most in-memory binary alterations or non-exfiltration manipulations undetected.
T1566detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces some phishing messages containing or leading to sensitive data exfiltration; this is only a slice of T1566 because most phishing (malware delivery, credential theft, social engineering without data leakage) is outside DLP's sensitive-data focus.
T1566prevents — A.8.12's DLP tools and monitoring can block the delivery or opening of malicious attachments/links in monitored channels like email, but phishing vectors using social engineering, phone calls, third-party platforms, spoofing, or non-monitored vectors remain unaddressed.
T1566.001detects — A.8.12 explicitly requires monitoring channels (e.g. email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email or uploaded), which surfaces spearphishing attachment attempts carrying sensitive/malicious payloads; the remainder is non-sensitive or non-monitored attachments.
T1566.001prevents — A.8.12's DLP tools and monitoring explicitly block email transmissions and quarantine sensitive/malicious attachments before they reach users, stopping the spearphishing delivery vector on monitored channels; this is only a slice because it does not stop all social engineering, unmonitored vectors, or user execution after delivery.
T1566.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces spearphishing link delivery in monitored channels; the remainder is non-email vectors or pre-delivery reconnaissance.
T1566.002prevents — A.8.12's DLP tools and monitoring explicitly block email transmissions and user actions (e.g. copy-paste of links, uploads) that would disclose or execute on sensitive data, stopping many spearphishing-link deliveries or follow-on interactions, but leaves social engineering, obfuscated URLs, consent phishing, and non-sensitive-link cases untouched.
T1566.002responds — A.8.12 explicitly requires monitoring channels (email, file transfers) for leakage, detecting disclosure (e.g. uploads or emails with sensitive info), quarantining/blocking transmissions, and acting on detected events; this surfaces and contains spearphishing-link delivery once underway, but only for the subset involving exfiltration of already-classified sensitive data rather than the technique's dominant social-engineering or credential-theft vectors.
T1566.003detects — A.8.12 explicitly requires monitoring channels of data leakage (including email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces spearphishing messages containing malicious links/attachments via third-party services; this is only a slice of the full technique because it depends on the payload carrying detectable sensitive data and does not address the social engineering rapport-building phase itself.
T1566.004detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage) and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud or email), which surfaces some voice-phishing social engineering when it triggers data exfiltration or credential leakage but does not broadly detect the voice call, impersonation, or urgency tactics themselves.
T1567detects — Web-service DLP rules detect and block the posting or uploading of sensitive information to external web or cloud destinations.
T1567prevents — A.8.12 explicitly requires DLP tools to monitor channels (incl. uploads to untrusted cloud services and email), detect sensitive data disclosure, and block transmissions or user actions that would exfiltrate it over web services, directly stopping the technique from succeeding in most cases.
T1567responds — A.8.12 explicitly requires monitoring channels, detecting disclosure (e.g. upload to untrusted cloud or email), and acting to block or quarantine transmissions once underway, which directly contains and eradicates an exfiltration-over-web-service event in progress.
T1567.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure events such as uploads to untrusted third-party cloud services (code repositories fit this pattern via API/HTTPS).
T1567.001prevents — A.8.12 explicitly requires DLP tools to monitor channels (incl. file transfers, uploads to untrusted cloud services) and block transmissions or user actions that would disclose sensitive data, directly stopping exfiltration to a code repository API before it succeeds; the named remainder is that popular internal code repos or non-sensitive data may be exempted from blocking.
T1567.001responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop upload to untrusted cloud services) and names response to adversary intelligence actions (honeypots, disinformation), which can contain or eradicate an exfiltration underway to a code repo; however, the clause is scoped to data-leakage channels and does not address all T1567.001 vectors or post-exfiltration eradication.
T1567.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and using DLP tools to detect disclosure events such as uploads to untrusted third-party cloud services, which directly surfaces T1567.002 exfiltration.
T1567.002prevents — A.8.12 explicitly requires DLP tools to detect and block network transmissions or user actions that would upload sensitive data to untrusted third-party cloud services, directly stopping the exfiltration technique in the common case where the data is identifiable and the channel is monitored.
T1567.002responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop upload to untrusted cloud services) once the exfiltration is underway, which is the core of `responds` on the event lane; the remainder is preemptive identification/classification that belongs to other verbs.
T1567.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, cloud uploads) and using DLP tools to detect disclosure of sensitive information to untrusted third-party services, which directly surfaces exfiltration to text storage sites such as pastebin.com.
T1567.003prevents — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to untrusted cloud/text sites) and blocking transmissions that expose sensitive data, directly stopping exfiltration to pastebin-style text storage sites when DLP tools or configurations are applied to identified/classified information.
T1567.003responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration) and names response to adversary intelligence actions (e.g. honeypots, disinformation); this bounds an in-progress exfil to a text site once underway, but the core of the control is still detection/prevention and the response slice is narrower than the full technique surface (e.g. post-exfil concealment via paid/encrypted paste services).
T1567.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including uploads to untrusted cloud services or email), which directly surfaces webhook-based exfiltration when it involves monitored SaaS or HTTP/S channels, though some manual or blended cases may evade depending on configuration.
T1567.004prevents — A.8.12 explicitly requires monitoring channels, detecting disclosures to untrusted services/cloud/email, and blocking transmissions or user actions that expose sensitive data, which directly stops webhook-based exfiltration of identified sensitive information in many cases; partial because it depends on prior classification, tool configuration, and does not address all blending/HTTPS cases or non-sensitive data.
T1567.004responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration in flight) and responding to adversary intelligence actions (e.g. honeypots, disinformation as response), which matches the `responds` verb of containing/eradication once the webhook exfil technique is underway; partial because the clause is scoped to monitored channels and approved DLP tooling rather than guaranteeing response to every webhook variant (HTTPS blending, manual posts, unmonitored SaaS).
T1568detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some dynamic C2 resolution events when they involve exfiltration of monitored data, but the bulk of T1568's algorithm-driven domain/IP/port adjustments for C2 (especially non-exfil fallback) sit outside DLP's data-centric scope.
T1568.001detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which can surface fast-flux C2 traffic when it exfiltrates or beacons sensitive data, but the control is scoped to data-leakage events rather than the DNS flux technique itself and does not broadly instrument all fast-flux behaviors.
T1568.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers, network transmissions) and using DLP tools to detect disclosure of sensitive information to untrusted destinations, which surfaces some DGA-driven C2/fallback traffic when it exfiltrates or reaches generated domains, but leaves the bulk of DGA domain generation and resolution itself (especially non-exfiltrating beaconing) outside DLP scope.
T1568.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which would surface anomalous DNS responses or C2 traffic patterns in monitored channels, but the control's scope is limited to sensitive data exfiltration and does not broadly instrument arbitrary DNS calculation for C2 port/IP derivation.
T1569detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which can surface anomalous service abuse that involves exfiltrating or moving sensitive data; this is a genuine but minority slice of T1569's scope (local/remote service execution for commands/programs, including persistence via boot services, with no data-movement requirement).
T1569.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and uploads), which can surface anomalous service execution or related exfiltration of sensitive data, but this is a minority slice of the technique's core abuse of the service control manager for arbitrary command or payload execution.
T1569.003detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via network transmissions or untrusted services), which can surface anomalous systemctl invocations that trigger data exfiltration as part of the monitored event chain, but the control is scoped to data movement rather than the full breadth of Linux service execution techniques.
T1570detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, mobile devices, portable storage) and using DLP tools to detect disclosure of sensitive information (including uploads and network transmissions), which surfaces many but not all T1570 file-copy events (e.g. internal SMB/RDP lateral transfers of non-sensitive tools often fall outside DLP scope).
T1570prevents — A.8.12's DLP tools and monitoring explicitly block unauthorized file transfers/exfiltration of sensitive data over channels like email, cloud uploads, network transmissions, and removable media, which overlaps with (and stops) some T1570 vectors such as web-service sync folders, ftp/sftp/curl, or SMB shares when the transferred tool/file is marked sensitive; it does not stop native lateral copies of unmarked tools inside the perimeter.
T1571detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, network transmissions, cloud uploads) and using DLP tools to detect when sensitive information is disclosed or exfiltrated, which surfaces non-standard port C2 that carries such data; the remainder is purely protocol-muddling use with no sensitive payload.
T1572detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, network transmissions) and using DLP tools to detect disclosure of sensitive information, which surfaces protocol tunneling when it carries or exfiltrates identifiable sensitive data; the remainder is tunneling that does not transit monitored channels or carry detectable sensitive payloads.
T1573detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in network transmissions and to untrusted services), which surfaces some encrypted C2 that carries or exfiltrates identifiable sensitive data; this is only a slice of T1573 because the technique is not inherently about leaking sensitive data and many implementations (custom protocols, non-sensitive C2) remain undetected by data-centric DLP.
T1573.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in network transmissions and to untrusted services), which surfaces some symmetric crypto C2 that carries or exfiltrates identifiable sensitive data; this is only a slice of the technique because most T1573.001 use does not involve detectable sensitive payloads and the clause's scope is set by what the organization classifies as sensitive.
T1573.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers, network transmissions) and using DLP tools to detect disclosure of sensitive information, which surfaces C2 traffic that exfiltrates or beacons sensitive data; this is a genuine but minority slice of the technique because the bulk of T1573.002 is pure key-exchange or protocol-level concealment that carries no detectable sensitive payload and is outside DLP scope.
T1574detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads or emails), which surfaces some hijack-execution techniques when they involve exfiltration of monitored data but leaves the majority of hijack methods (DLL search-order, registry poisoning, etc.) outside its scope.
T1574.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to identify/monitor sensitive information at risk and detect its disclosure (including via file transfers, uploads, and system-level actions), which surfaces most DLL sideloading/hijacking/substitution behaviors when they involve observable movement or loading of sensitive DLLs, with a bounded remainder for purely in-memory or non-sensitive cases.
T1574.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in files, uploads, or exfiltration), which surfaces dylib hijacking when the malicious library or its loading carries or exposes identifiable sensitive data, but this is limited to cases involving detectable sensitive payloads rather than the technique's core execution or non-sensitive hijacks.
T1574.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when files are written, uploaded or transmitted), which surfaces the file-permission-weakness exploitation when it involves exfiltration or movement of the replaced binary or its payload, but does not address the core installer hijacking or permission misconfiguration itself
T1574.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in uploads, emails, or unstructured data), which surfaces some instances of LD_PRELOAD/DYLD_INSERT_LIBRARIES abuse when they result in observable exfiltration or anomalous library loads, but leaves the bulk of in-process hijacking (e.g. purely for hooking without data movement) outside its scope.
T1574.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or user actions), which surfaces some PATH-interception attempts when they involve observable exfiltration or anomalous binary execution on monitored channels, but leaves the majority of in-process or pre-execution hijacks (especially on Linux/macOS or non-sensitive binaries) outside its scope.
T1574.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when files are placed or transmitted), and auditing, which would surface many search-order hijack artifacts involving sensitive data movement or exfiltration but not the technique in general (e.g. non-sensitive binaries or non-leakage scenarios).
T1574.009detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers or uploads), which can surface the anomalous executable placement or launch that realises T1574.009; this is a genuine but minority slice of the technique's full surface (mostly file/registry path hijacking without data exfil).
T1574.010detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in files, uploads, or exfiltration), which surfaces this hijack when it involves or leads to unauthorized extraction of sensitive binaries/data, but does not broadly detect the permission flaw or binary replacement itself.
T1574.011detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when it is uploaded or transmitted), and acting on detected events; this surfaces the technique when the hijacked service causes exfiltration or leakage of sensitive data, but the technique itself is a local Registry permission abuse for persistence/execution that does not inherently involve data leakage and can succeed without triggering DLP.
T1574.012detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or exfiltration-like actions), which would surface anomalous .NET process behavior or DLL loading tied to data leakage in many implementations, but the technique itself is a low-level execution-hijack/persistence method with no inherent data-leakage artifact and can be scoped in-memory without touching monitored channels.
T1574.013detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via uploads, email, or anomalous user actions), which surfaces some in-process or exfiltration-linked behaviors that could accompany KernelCallbackTable hijacking when it leads to data exposure, but the technique itself is a memory-resident execution-flow attack with no inherent data-leakage artifact and is outside the primary scope of DLP tooling.
T1574.014detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including uploads and transmissions), which can surface AppDomainManager injection when it exfiltrates or loads sensitive .NET payloads, but the control is scoped to data-leakage observables rather than the code-execution technique itself.
T1578detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure or exfiltration (including to untrusted cloud services), which surfaces some T1578 modifications that involve data movement or leakage but not the dominant infrastructure-mutation slice (create/delete/modify instances, snapshots, or permissions for evasion).
T1578.001detects — A.8.12 explicitly requires monitoring channels for data leakage, using DLP tools to detect disclosure of sensitive information (including in cloud uploads or backups), which surfaces the snapshot creation when it exposes protected data, but only for the subset of cases involving identifiable sensitive information rather than all evasion-driven snapshots.
T1578.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services), and acting on it, which surfaces the post-creation data-exfiltration step of T1578.002 but does not address the instance-creation act itself or non-data events.
T1578.003detects — A.8.12 explicitly requires monitoring channels, detecting disclosure of sensitive information, and using DLP tools to identify/monitor at-risk data (including in cloud contexts per its guidance on untrusted services and backups), which surfaces the deletion action when it involves exfiltrating or handling sensitive data beforehand, but does not broadly detect all instance deletions or non-data-related evasion.
T1578.004detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), and auditing; this surfaces the revert action when it exposes or moves protected data but does not broadly detect snapshot reversion or ephemeral storage reset itself.
T1578.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including in cloud uploads), and acting on it; this surfaces some T1578.005 activity when the modification enables exfiltration or anomalous resource use that crosses monitored boundaries, but the bulk of config changes (quotas, policies, regions) occur in the management plane without necessarily involving detectable data movement.
T1580detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), which surfaces some T1580 discovery activity when it involves exfiltrating or exposing enumerated cloud resource data, but leaves the bulk of pure reconnaissance (API calls, CLI enumeration, wordlist scanning without data movement) outside its scope.
T1583.002detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces adversary setup/use of their own DNS server when it carries exfiltrated data or C2, but this is only a slice of the PRE technique whose core (acquiring and configuring the server itself) is outside DLP scope
T1583.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services), and monitoring for adversary intelligence actions; this surfaces some serverless infrastructure use when it involves exfiltrating or proxying sensitive data through cloud runtimes, but the bulk of T1583.007 (acquisition, configuration, and benign-looking C2 proxying without sensitive data) sits outside DLP scope.
T1583.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services), and acting on detected events; this surfaces the adversary's malvertising purchase and distribution of malicious artifacts when they involve or trigger outbound sensitive-data flows, but the bulk of pre-compromise ad purchasing, spoofing, and evasion occurs outside monitored organizational channels and before any data leak.
T1584detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some adversary use of compromised third-party infrastructure when it involves exfiltrating or staging data through monitored vectors, but leaves the bulk of pre-compromise reconnaissance, botnet formation, or non-data-leakage uses of the infrastructure undetected.
T1584.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services or email), and auditing; this surfaces some hijack indicators (e.g. anomalous domain/email use or exfiltration of registration data) but the PRE technique's social-engineering, renewal-gap, and cloud-compromise vectors largely sit outside DLP's data-centric monitoring scope.
T1584.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some adversary actions that leverage compromised DNS for redirection, exfiltration or C2, but the control is scoped to data-leakage events rather than the full breadth of DNS-server compromise techniques on PRE platforms.
T1584.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services), which surfaces adversary compromise of a VPS for C2 or staging as anomalous exfiltration or outbound activity from the compromised asset.
T1584.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some post-compromise server usage for C2, phishing support or staging when it involves exfiltration of classified data, but leaves the bulk of server compromise, watering-hole setup and non-data-leak server tasks undetected.
T1584.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces botnet-related exfiltration or C2 activity when it involves monitored sensitive data, but this is limited to data-centric channels and does not broadly detect botnet formation, compromise, or takeover itself.
T1584.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded to untrusted third-party cloud services or sent via email), which surfaces adversary abuse of compromised web services for exfiltration or related operations; this is a genuine but minority slice of the broad PRE technique that also covers initial compromise, C2, and phishing uses not addressed by leakage monitoring.
T1584.007detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services), and acting on it; this surfaces some serverless compromise behaviors that involve exfiltrating or proxying sensitive data through cloud runtimes, but leaves the majority of the technique (initial compromise, attribution hiding, and non-sensitive proxying) unreached.
T1584.008detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which would surface anomalous outbound activity from a compromised network device acting as proxy/C2 or exfiltrating harvested data, but the control is scoped to data-leakage patterns rather than the device compromise or infrastructure abuse itself.
T1585detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, cloud uploads, etc.) and using DLP tools to detect disclosure of sensitive information; this surfaces adversary account-creation activity when it involves exfiltrating or uploading persona-building data (photos, profiles, documents) through monitored vectors, but the bulk of PRE T1585 (silent account registration on social/email/free-trial services with no data movement) sits outside DLP scope.
T1585.002detects — A.8.12 explicitly requires monitoring channels of data leakage (e.g. email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), which surfaces adversary creation and use of email accounts for follow-on behaviors such as phishing.
T1585.003detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded to untrusted third-party cloud services), which surfaces adversary creation and use of cloud accounts for exfil/storage in the PRE phase when data movement occurs.
T1586.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information, which surfaces some social-media compromise activity when it involves exfiltration or anomalous sharing of credentials/data, but leaves the bulk of pre-compromise reconnaissance, credential theft, and account takeover on external platforms outside its monitored channels and tools.
T1586.002detects — A.8.12 explicitly requires monitoring channels (e.g. email) and using DLP tools to detect disclosure of sensitive information (including via email upload or transmission), which surfaces adversary use of a compromised email account for phishing/spam campaigns; this is a genuine but minority slice of the technique whose core (credential compromise via phishing, brute force, purchase, or insider payment) is outside DLP's view.
T1586.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers, cloud uploads) and using DLP tools to detect disclosure of sensitive information to untrusted third-party cloud services, which surfaces the post-compromise use of cloud accounts for exfiltration or tool upload; it does not address the pre-compromise reconnaissance, credential theft or account takeover steps themselves.
T1587.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting disclosure (e.g. uploads or emails), which surfaces adversary malware development artifacts such as infected removable media or indicators planted to mislead attribution; this is a genuine but minority slice of the pre-attack technique whose core (building payloads, C2 protocols, contracting skills) occurs outside monitored enterprise channels.
T1587.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads or transmissions), which surfaces adversary creation or use of self-signed certificates when they involve exfiltration or leakage of cert material, but this is only a minority slice of the PRE technique whose core development activity is offline and unrelated to data leakage channels.
T1587.003detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure or exfiltration of sensitive information (including in uploads, emails, or unstructured data), which surfaces the creation/use of self-signed certificates when they enable or accompany data-leakage events, but the technique itself is a PRE creation step with no inherent data movement and many non-leakage uses, so only a slice is detected.
T1588detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces acquisition of certain capabilities like malware/exploits from third parties when they cross monitored boundaries; this is only a slice of the full PRE technique (which also includes in-house development, direct purchases without transit, or offline theft).
T1588.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads or transmissions), which surfaces adversary acquisition of malware when that malware or its indicators appear in monitored data flows; this is only a slice of the pre-compromise acquisition technique itself.
T1588.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud or email), which surfaces adversary acquisition of tools that involve data exfiltration or transfer of stolen software/licenses.
T1588.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces adversary acquisition of code-signing certs when the materials or purchase actions involve monitored exfiltration paths, but the technique is PRE and can succeed entirely outside monitored channels (e.g. direct theft from a third-party or front-org purchase with no data leak).
T1588.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including in email, file transfers, uploads to untrusted services), which surfaces some certificate acquisition or exfiltration attempts when they involve monitored data flows, but the technique is primarily acquisition from external CAs or third parties outside those channels and the control's scope is limited to organizational data leakage rather than all adversary certificate sourcing.
T1588.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces adversary acquisition of exploits from online sources, marketplaces, or stolen from third parties; this is only a slice of the technique's full surface (e.g. no coverage of forum monitoring, targeting researchers, or offline theft).
T1588.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent externally), and extends to protecting against adversary intelligence actions that obtain confidential information; this surfaces the reconnaissance act of acquiring vulnerability details from databases or research targets when those details qualify as sensitive, but only for the subset that crosses monitored channels or matches DLP rules rather than all open-source monitoring.
T1588.007detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted services), and auditing; this surfaces adversary use of public LLMs for generating phishing content, impersonation material or other exfiltratable artifacts, but only the subset that crosses monitored channels or involves detectable sensitive data rather than the pre-attack acquisition itself.
T1589detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. via email, uploads, or exfiltration), which surfaces some forms of identity gathering such as leaks or active probing that expose data; it does not cover passive OSINT, social media scraping, or pre-leak reconnaissance that never touches monitored channels.
T1589prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, uploads, file transfers, copy-paste) can prevent some leakage vectors for identity data (e.g. blocking exfiltration of harvested emails/credentials from internal systems or via monitored channels), but most of T1589's gathering (phishing elicitation, active scanning, public leaks, social media, search victim sites) occurs outside those monitored channels and is untouched.
T1589.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads or emails containing credentials), which surfaces some leaks of exposed credentials but does not address adversary gathering via phishing, site compromise, dark web purchases, or pre-breach elicitation.
T1589.001prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, uploads, exfiltration) can stop some credential leaks from internal systems or backups reaching adversaries, but the technique's dominant vectors (phishing elicitation, site compromises, dark web purchases, infostealer logs) sit outside its scope.
T1589.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.) and using DLP tools to detect disclosure of sensitive information (including when uploaded/sent via email or to untrusted services), which surfaces the gathering of exposed email addresses in some channels but not others such as social media, public websites, or active scanning of auth services.
T1589.003detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded or sent externally), which surfaces the gathering of employee names from internal data sets or leaks, but does not address the dominant external/open-source gathering methods described in the technique.
T1590detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent externally), which surfaces some network-related data exposures that adversaries could gather via open datasets or phishing, but does not broadly detect active scanning or most pre-compromise reconnaissance on the PRE platform.
T1590.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services or sent via email), which surfaces some domain-property leaks when they cross monitored boundaries, but the technique is predominantly passive/public reconnaissance (WHOIS, passive DNS, public APIs) that occurs outside those channels and before any disclosure event.
T1590.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent externally), and acting on it; this surfaces the reconnaissance act when it involves exfiltrating or querying DNS data that reveals sensitive details, but only for a slice of T1590.002 (e.g., active queries or zone transfers that cross monitored channels) rather than passive/open-source DNS gathering.
T1590.003detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk of disclosure, and detecting its disclosure (e.g. via email, uploads, or exfiltration), which surfaces some forms of network trust information when it traverses those channels, but the technique is primarily PRE and can succeed entirely via open/public data sets or phishing without any detectable leakage event.
T1590.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent externally), which surfaces some network-topology data exposures when they cross monitored boundaries or involve identifiable sensitive assets, but leaves the bulk of passive/pre-collection reconnaissance (scanning, public data sets, phishing) outside its scope.
T1590.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent externally), which would surface an adversary's active scanning, phishing, or open-source queries that cause IP address data to leave the organization.
T1590.006detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded to untrusted services), and acting on it; this surfaces adversary reconnaissance that would leak appliance details through those channels, but the control is scoped only to data-leakage vectors and does not address scanning, phishing-for-info, or public data-set exposure methods named in the technique.
T1591detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces some T1591 gathering when it traverses monitored exfiltration paths or leaks via DLP-watched data sets, but leaves the bulk of PRE techniques (open-source searches, social media, phishing elicitation) outside its scope.
T1591.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via email, file transfers, uploads to untrusted services, and unstructured data), which surfaces some business-relationship details when they are exfiltrated or exposed in monitored channels, but leaves the bulk of PRE pre-compromise gathering (e.g. via open web search, social media, or phishing for information) outside its scope.
T1591.004detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via email, uploads, or exfiltration), which surfaces adversary gathering of role/identity data when it traverses those channels; partial because the control is scoped to data-leakage vectors and does not broadly detect passive OSINT or elicitation that never touches monitored exfiltration paths.
T1592detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including via uploads, email, or exfiltration-like actions), which surfaces some host-configuration leaks when they cross monitored boundaries, but the bulk of T1592 occurs via passive exposure, scanning, phishing, or pre-compromise reconnaissance outside DLP's view.
T1592.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some hardware-reconnaissance activity when it involves exfiltration of classified hardware details, but the bulk of T1592.001 occurs via passive public data, phishing, or scanning that never crosses a monitored leakage channel.
T1592.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including via tools that flag uploads or transmissions), which surfaces some software-reconnaissance activity when it involves exfiltration of metadata or defensive-component details; this is only a slice of the PRE technique's many collection vectors (scanning, phishing, public datasets).
T1592.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some client configuration data exfiltration events when they cross monitored channels or match sensitive patterns, but the technique is primarily passive reconnaissance via scanning, phishing, or public data sets that never trigger leakage detection.
T1593.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or exposed publicly), which surfaces the spillage/leak that T1593.002 searches for; partial because the control is scoped to organization-controlled channels and data under its purview, not arbitrary public web content crawled by external search engines.
T1593.003detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted third-party cloud services), which surfaces the adversary's search of and extraction from public code repositories when it involves leaked sensitive data; this is only a slice of the technique because most reconnaissance searches target non-sensitive information such as employee names, languages, and libraries that fall outside DLP's sensitive-data focus.
T1593.003prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, uploads, file transfers) can prevent accidental leakage of sensitive data such as credentials or API keys into public code repositories, but do not stop deliberate adversary searches of already-public repos or non-sensitive information like employee names and library usage.
T1594detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or exposed on external/untrusted services), which surfaces adversary searches for and exfiltration of victim site data; partial because the control is scoped to sensitive/classified data and outbound channels rather than all public web reconnaissance or hidden-directory scanning on victim-owned sites.
T1595detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces active scanning probes when they involve exfiltration or leakage of classified data; this is only a slice of T1595's broad PRE reconnaissance (e.g. non-sensitive port/protocol scans remain unseen).
T1595.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which can surface vulnerability scanning artifacts such as server banners or port probes when they carry or expose sensitive data; however, this is limited to cases involving sensitive information leakage rather than general vulnerability scanning activity.
T1595.003detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), which surfaces some wordlist-driven bucket-enumeration and content-discovery activity when it touches monitored sensitive data or channels, but leaves the bulk of PRE reconnaissance (web directory brute-forcing, non-sensitive discovery) outside its scope.
T1596.004detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services), which surfaces the CDN misconfiguration leak described in T1596.004; partial because the control is scoped to organization-controlled channels and data rather than all external public CDN lookups or third-party hosted content.
T1597detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted clouds or email), which surfaces adversary acquisition from closed sources when that data is organizational; this is only a slice of T1597 because most closed-source purchases (dark web markets, paid non-org feeds) sit outside the DLP's monitored channels and data-in-motion/rest focus.
T1597.001detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including to untrusted services), which surfaces adversary searches of private threat-intel vendor data when that data is classified and monitored; the remainder is vendor portals or feeds falling outside the organization's own monitored channels or DLP tooling.
T1598detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces some instances of phishing-for-information once the elicited data moves; it does not address the social-engineering elicitation itself or pre-disclosure reconnaissance on PRE.
T1598.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded to untrusted third-party services), which surfaces spearphishing attempts that successfully elicit such information; however this is limited to cases where the elicited data transits monitored enterprise channels rather than purely external social media or personal webmail interactions that never reach the organization's DLP scope.
T1598.002detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces spearphishing attachment lures attempting to elicit data; this is a genuine but minority slice because the technique is primarily social engineering/pre-delivery and most variants (e.g. HTML smuggling, reconnaissance-driven lures) fall outside DLP's data-centric detection scope.
T1598.003detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces some spearphishing-link lures that transmit or expose data; it does not address social-engineering text, QR codes, tracking pixels, or pre-click reconnaissance that dominate the technique.
T1598.003prevents — A.8.12's DLP tools and monitoring can block transmission of sensitive data (including credentials) to untrusted sites reached via spearphishing links, but the social-engineering elicitation itself, tracking pixels, QR codes on mobile, and pre-transmission divulgence fall outside its data-channel focus.
T1598.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via channels), and auditing; this surfaces some vishing attempts that result in unauthorized disclosure/extraction but does not address the voice channel, social engineering elicitation itself, or pre-disclosure reconnaissance.
T1599detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, etc.), using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted cloud services or email), and acting on detected events, which surfaces the exfiltration that T1599 enables via boundary bridging; this is a genuine but minority slice of the technique itself (which centers on device compromise and reconfiguration, not the data movement).
T1599.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which surfaces adversary NAT modifications that enable or obscure exfiltration of that information; however, the control is scoped to sensitive data flows rather than all NAT changes on boundary devices, leaving a large remainder of technique executions undetected.
T1600detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in network transmissions and to untrusted services), which surfaces the unauthorized-disclosure outcome that T1600 produces even if it does not directly observe the device-compromise step itself.
T1600.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in network transmissions and to untrusted services), which surfaces the weakening of encryption parameters on network devices as anomalous sensitive-data exposure; this is a genuine but minority slice of the technique's scope (network-device CLI modification post-compromise).
T1601detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including in uploads, emails, or unstructured data), which surfaces T1601 attempts when they involve exfiltrating or transmitting the modified image or related sensitive OS artifacts.
T1601.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces the exfiltration-like transfer of a modified image or false output but does not broadly detect in-memory patching, boot-loader manipulation, or non-data-leak aspects of the technique on network devices.
T1601.002detects — A.8.12 explicitly requires monitoring channels for data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads), which would surface the download of an older/weaker OS image file to a network device in many cases, but this is only a slice of the technique's full scope (e.g., local storage replacement, reconfiguration, or restart on embedded devices with no exfiltration).
T1602detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), and acting on it; configuration repositories on network devices are a named vector for bulk sensitive administrative data that aligns with the control's scope for identifying, monitoring and detecting unauthorized extraction or disclosure.
T1602prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, transfers, uploads, copy-paste) can stop exfiltration of sensitive config data once it reaches user systems or outbound paths, but do not stop the initial collection from the repository itself on network devices.
T1602.001detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions), and the MIB dump is a network query that can expose configuration, routing, and other sensitive data the control is oriented to detect.
T1602.001prevents — A.8.12's DLP tools and monitoring can block exfiltration channels (including SNMP queries if treated as a leakage vector) and detect sensitive MIB data disclosure, but SNMP MIB dumps on network devices are outside typical endpoint-focused DLP scope and the control does not address SNMP configuration, community strings, or query restrictions.
T1602.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when exported or uploaded), and auditing; this surfaces the exfiltration-oriented dump of network device configs containing credentials and layout data in most cases, though network-device-specific protocols like SNMP may fall outside general DLP scope.
T1602.002prevents — A.8.12's DLP tools and monitoring/blocking of channels (email, file transfers, uploads, copy-paste) can stop exfiltration of extracted config data once obtained, and its deception measures (honeypots, false data) can deter the reconnaissance technique itself, but this is only a minority slice against network-device SNMP/SMI queries or in-memory/non-volatile storage access on the device itself.
T1606detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), which surfaces some T1606 forgeries when they involve exfiltration or use of forged credentials on monitored web/SaaS resources, but leaves the majority of offline/local forging and non-disclosure uses undetected.
T1606.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers, cloud uploads) and using DLP tools to detect disclosure of sensitive information, which would surface anomalous cookie-based access or exfiltration attempts involving sensitive data; this is a genuine but minority slice of the technique itself (forging cookies to bypass auth), as the control does not broadly instrument or detect the forgery generation step across all platforms.
T1606.002detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces some SAML forgery paths that transit monitored channels or exfil sensitive material, but the core offline forgery act (using a stolen cert or new trust) has no guaranteed observable event inside the clause's scope.
T1608detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including uploads to untrusted cloud services or web services such as GitHub/Pastebin), which surfaces some staging activity when it involves exfiltrating or exposing capabilities, but leaves the bulk of adversary-controlled infrastructure staging (e.g. on purchased/compromised hosts or PaaS without data exfil) unseen.
T1608.001detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including uploads to untrusted third-party cloud services, email, or web services), which surfaces adversary uploads of malware to staging infrastructure like GitHub, Pastebin, or cloud repos; partial because the control is scoped to organization-owned sensitive data and monitored channels rather than comprehensively detecting all adversary-controlled malware uploads on PRE platforms.
T1608.002detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including uploads to untrusted third-party cloud services or web services), which surfaces the upload-tool action when it involves exfiltrating or staging sensitive tools; partial because the control is scoped to sensitive/identified information and does not broadly instrument all possible tool uploads on adversary-controlled infrastructure.
T1608.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent), and auditing; this surfaces the act of installing a certificate that could expose or be used in exfiltration/C2 channels, but only for a minority slice of cases where the cert itself or its use is treated as sensitive data in transit.
T1608.005detects — A.8.12 explicitly requires monitoring channels (email, file transfers, uploads to cloud) and using DLP tools to detect disclosure of sensitive information, which surfaces some link-based phishing setups when they trigger outbound transmission or data exposure; it does not address pre-positioning of link targets on external infrastructure (domains, IPFS, shortening services) before any user interaction or data leak occurs.
T1609detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when transmitted or uploaded), and auditing; this surfaces some T1609 abuse that exfiltrates or transmits data but leaves the majority of container exec (local/remote command execution without data movement) outside its scope.
T1610detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including uploads to untrusted services), and acting on it; this surfaces some T1610 deployments that involve exfiltrating or moving sensitive data but does not address the core technique of simply creating/starting a container for execution or evasion.
T1611detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and auditing; this surfaces some T1611 instances that exfiltrate or touch sensitive data post-escape, but the bulk of the technique (privilege-escalating breakout via bind mounts, privileged containers, kernel modules, docker.sock abuse, or hypervisor exploits) produces no data-leakage signal and is invisible to DLP-focused detection.
T1612detects — A.8.12 explicitly requires monitoring channels for data leakage and using DLP tools to detect disclosure of sensitive information (including uploads to untrusted services or exfiltration-like actions), which surfaces the malware-download step inherent to building a malicious image on-host; this does not address the build API call or image construction itself, leaving a genuine open remainder on the technique.
T1613detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including via logs that can leak environment details), which surfaces T1613 activity when it involves exfiltration or observable leakage of container/resource data, but the control's scope is limited to data-leakage vectors and does not broadly instrument all discovery queries or dashboard access.
T1614detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which would surface the outbound IP-lookup portion of T1614 when it exfiltrates locale data; local system checks (time zone, keyboard layout, GetLocaleInfo) and metadata access fall outside DLP scope.
T1614.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information, and auditing (including screenshots), which can surface the reconnaissance behavior of querying language-related artifacts when it traverses a monitored channel or produces observable data movement.
T1615detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), which would surface the reconnaissance commands and network/file accesses that realize T1615 in most Windows/AD environments; it does not instrument every possible local discovery method or non-sensitive GPO patterns, leaving a genuine implementation-dependent slice.
T1619detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), which surfaces T1619 when it involves exfiltration-oriented enumeration of cloud objects; this is a genuine but minority slice of the technique's full discovery surface (API-driven enumeration for shaping behaviors, not always tied to leakage).
T1620detects — A.8.12 explicitly requires monitoring channels for leakage and using DLP tools to detect disclosure of sensitive information (including in unstructured data or network transmissions), which can surface reflective loading when it involves exfiltrating or exposing sensitive payloads, but the control is scoped to data-leakage events rather than the in-memory code-loading technique itself.
T1621detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. via email, uploads, or network transmissions), which surfaces MFA fatigue bombing or anomalous push/SMS patterns when they involve exfiltration-like disclosure of credentials or auth data; this is only a slice of the technique's full scope (credentialed login abuse, SSPR, non-data channels).
T1648detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services or sent via email), and this surfaces some T1648 abuse that results in data exfiltration via serverless functions/workflows, but the bulk of T1648 (arbitrary code execution, privilege escalation, persistence via event triggers, resource hijacking without exfil) has no data-leakage signal and is unseen by DLP-focused detection.
T1649detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure of sensitive information (including when uploaded or sent), and certificates are sensitive authentication material; this surfaces the technique when it involves exfiltration or observable leakage but does not broadly detect local theft, forgery, or root-CA key abuse across all platforms and scenarios.
T1651detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded to untrusted cloud services), and acting on it; this surfaces the abuse of cloud admin services for command execution when it involves exfiltrating or moving sensitive data, but the technique itself is broader (any command execution, not just data disclosure) and many instances have no detectable leakage component.
T1652detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information; while device driver enumeration is not itself data exfiltration, the resulting insights (e.g. present security tools or defenses) can be treated as sensitive information whose disclosure via discovery utilities, registry, or /dev can be surfaced by monitoring and DLP tooling on those channels.
T1654detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when exported or sent outward), and this surfaces log enumeration/export activity when logs contain or expose sensitive data, but the control is scoped only to sensitive/classified information leakage rather than all system/service log enumeration.
T1657detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads to untrusted clouds or emails), which surfaces financial theft attempts that rely on exfiltration, BEC fraud, or ransomware leak threats; partial because it is scoped to data-leakage vectors and does not broadly detect social engineering, account compromise, or non-data extortion methods also named in T1657.
T1657prevents — A.8.12's DLP tooling and monitoring can block exfiltration of sensitive data used in ransomware extortion (preventing the leak that enables the monetary demand), but the technique encompasses many other vectors (social engineering, BEC, direct account compromise, cryptocurrency exploits) that DLP does not stop.
T1657responds — A.8.12 explicitly requires acting on detected leakage (quarantine, block transmissions, DLP tools that stop exfiltration) and orients actions as response to adversary intelligence gathering, which bounds the realized financial-extortion event once the leak threat is underway; it does not address the monetary transfer, social engineering, or pre-leak ransomware steps that also realize T1657.
T1659detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded/sent via network channels), which surfaces the content-injection technique when it involves exfiltration or sensitive data flows, but does not broadly detect all upstream ISP-level or man-on-the-side injection of malicious content unrelated to organizational data leakage.
T1665detects — A.8.12 explicitly requires monitoring channels of data leakage, identifying/monitoring sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted cloud or email), which surfaces some network traffic anomalies tied to hidden C2 but only for data-exfiltration patterns, not the broader traffic filtering, domain masking, proxy/VPN blending, or sandbox evasion that define T1665.
T1666detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including to untrusted cloud services), and acting on it; this surfaces some IaaS hierarchy modifications that expose or move sensitive data but does not address the dominant technique of creating/leaving orgs or hijacking subscriptions to evade policy without necessarily disclosing data.
T1667detects — A.8.12 explicitly requires monitoring channels of data leakage (including email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), which surfaces email bombing when it involves sensitive data but does not broadly detect non-sensitive spam floods or inbox overloads.
T1671detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. when uploaded to untrusted third-party cloud services), and acting on it; this surfaces the exfiltration/persistence outcome of T1671 in SaaS/Office Suite but does not address the OAuth consent, app creation, or token-bypass steps themselves.
T1673detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when uploaded or transmitted), and broader monitoring for adversary intelligence-gathering actions; this surfaces VM enumeration when it involves exfiltration or observable channels, but the core local CLI/GUI discovery on a compromised hypervisor has no necessary data-leakage footprint and is outside the clause's primary scope.
T1674detects — A.8.12 explicitly requires monitoring channels of data leakage (email, file transfers, devices) and using DLP tools to detect disclosure of sensitive information (e.g. uploads or transmissions), which surfaces some input-injection techniques that result in data exfiltration or clipboard/paste actions but does not broadly detect keystroke simulation or HID emulation itself.
T1675detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers and uploads), which would surface the InitiateFileTransferFromGuest and related data-exfiltration steps that follow T1675 command execution on guest VMs.
T1677detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted clouds or email), and this surfaces credential exfiltration or secret-leakage artifacts that occur in several T1677 scenarios, but leaves the initial code-injection steps, self-hosted runner execution, and non-sensitive-data poisoning undetected.
T1679detects — A.8.12 explicitly requires monitoring channels and using DLP tools to detect disclosure or exfiltration of sensitive information, which surfaces selective-exclusion behavior when it involves monitored data movement or anomalous file-handling patterns, but only a minority slice of the technique (e.g., when it touches monitored sensitive data or channels) rather than the core ransomware exclusion logic itself.
T1680detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when it is being accessed or exfiltrated from local storage), which surfaces T1680 activity when it involves sensitive data but does not broadly detect all local storage enumeration regardless of sensitivity or intent.
T1681detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (including to untrusted services), which surfaces an adversary searching threat-vendor data about their own campaigns when that data contains or leaks organization-controlled indicators.
T1683detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads to untrusted services or email), which surfaces adversary content-generation when that content carries or reveals organizational sensitive data; this is only a slice of T1683 because most content generation (pretexts, personas, non-sensitive media) occurs externally/pre-operation without touching monitored organizational channels.
T1683.002detects — A.8.12 explicitly requires monitoring channels, identifying sensitive information at risk, and detecting its disclosure (e.g. uploads or emails), which surfaces adversary creation/manipulation of audio-visual content when it traverses those channels or contains detectable sensitive markers; this is only a slice of the PRE technique whose core (offline generation of deepfakes for later use in phishing/social engineering) has no required detection surface.
T1684detects — A.8.12 explicitly requires monitoring channels (email, file transfers, etc.), using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted clouds or via email), and auditing (including for screenshots), which surfaces some social engineering attempts that result in unauthorized disclosure; this is only a slice because the bulk of T1684 (trust-building, voice/AI interactions, scare tactics, help-desk impersonation, non-data-leak vectors) lies outside DLP's telemetry and the clause's scope is set by what the organization classifies and monitors.
T1684prevents — A.8.12's DLP tools and monitoring can block disclosure/extraction channels (e.g. email, uploads, copy-paste) that social engineering often exploits to obtain sensitive info, and its deception measures (honeypots, disinformation) can deter some adversary intelligence gathering; however, it does not stop the core human-influence or persuasion steps of the technique itself.
T1684responds — A.8.12 explicitly orients DLP actions as a response to adversary intelligence/espionage actions (e.g. reverse social engineering, honeypots to confuse decisions after the fact), which bounds the realized social-engineering technique once underway, but this is only a minority slice of the broad T1684 class that centers on influence and authorized disclosure rather than post-breach containment.
T1684.001detects — A.8.12 explicitly requires monitoring channels (email, file transfers) and using DLP tools to detect disclosure of sensitive information (e.g. when uploaded or sent via email), which surfaces impersonation attempts that rely on those same vectors to extract information, but does not address the social-engineering core, reconnaissance, or non-data-leak impersonation variants.
T1684.002detects — A.8.12 explicitly requires monitoring channels of data leakage (including email) and using DLP tools to detect disclosure of sensitive information (e.g. when sent via email), which surfaces spoofed emails carrying sensitive payloads; this is a genuine but minority slice of T1684.002 because the technique is not limited to sensitive data and many spoofed messages (e.g. generic phishing without exfiltrated content) fall outside DLP's detection scope.
T1685detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted clouds or email), which surfaces many tampering events that produce anomalous exfiltration attempts or telemetry gaps, but this is scoped only to data-movement indicators rather than the broad class of tool disablement across hosts, networks, logging, or cloud sensors.
T1685.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded), and auditing of actions such as screenshots; this surfaces the adversary's use of auditpol, registry edits, or service-stop commands when they involve exfiltrating or acting on logged sensitive data, but the control's scope is limited to data-leakage vectors rather than all modifications of the Event Log service itself.
T1685.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent to untrusted cloud services), and acting on it; this surfaces the adversary's logging-disabling actions when they involve exfiltrating or exposing related sensitive data, but only a minority slice of T1685.002 techniques (most are direct config tampering with no data disclosure).
T1685.003detects — A.8.12 explicitly requires monitoring channels for leakage, using DLP tools to detect disclosure of sensitive information (including when tools or data flows are tampered with), and auditing actions like screenshots; this surfaces the spoofed-UI deception in some but not all cases (e.g., non-data-exfil UI fakes on endpoints fall outside DLP scope).
T1685.004detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which would surface many of the file/network/process events that auditd would have logged before an adversary disables it.
T1685.005detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via file transfers or other exfiltration-like actions), and the technique's deletion of .evtx files or use of utilities can be surfaced as anomalous file or process behavior on monitored channels.
T1685.006detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information, which surfaces log-clearing actions when they involve exfiltration or leakage of the log contents themselves; this is a genuine but minority slice of the technique (most log clearing is local deletion to evade detection, not data exfiltration).
T1686detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions, email, file transfers, and untrusted services), which surfaces many but not all firewall-tampering actions that enable exfiltration.
T1686.001detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including network transmissions and uploads to untrusted cloud services), which surfaces some adversary actions that modify cloud firewalls to enable exfiltration or lateral movement, but only for the subset involving sensitive data flows rather than all firewall changes or non-data-plane activity.
T1686.002detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including via network transmissions or uploads), which surfaces some firewall rule changes or bypasses that enable exfiltration but does not broadly detect all network-device firewall manipulations (especially non-data-leakage ones).
T1686.003detects — A.8.12 explicitly requires monitoring channels of data leakage and using DLP tools to detect disclosure of sensitive information (including network transmissions), which surfaces some firewall modifications that enable unauthorized exfiltration but does not broadly detect all Windows host firewall disabling or rule changes.
T1687detects — A.8.12 explicitly requires monitoring channels, identifying sensitive data at risk, and detecting disclosures (e.g. uploads to untrusted services or emails), which surfaces exploitation attempts against DLP components or related defensive tools as anomalous leakage events.
T1689detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (e.g. uploads to untrusted services or email), and auditing; this surfaces some downgrade-induced exposures such as cleartext network data or leaked sensitive payloads, but does not address most downgrade vectors (e.g. PowerShell version evasion of SBL, boot manager changes, or protocol downgrades that do not leak data).
T1690detects — A.8.12 explicitly requires monitoring channels of data leakage, using DLP tools to detect disclosure of sensitive information (including when sent via email or uploaded), and auditing; command-history changes or history-file exfiltration can be among the monitored channels or sensitive data, but the control is scoped to information-classification and leakage vectors rather than every possible logging-impairment action on every platform.

Prevented OWASP Web Top 10 (2025) risks (13)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A02←P A04→P A05→P A06←P A09→P A10→P

Why these map — AI rationale (under review)

A01mitigates — DLP tools can bound the consequence of a realized broken-access-control weakness by blocking exfiltration of the unauthorized data (e.g. via email, upload, copy/paste), but they do not address the authorization decision, path traversal, IDOR, CSRF or missing function-level checks themselves
A04mitigates — A.8.12's DLP tools and monitoring can detect/block transmission of already-unencrypted sensitive data (e.g. via email or uploads), bounding the realized consequence of exposure, but do not address absent/weak/misused cryptography itself nor protect data at rest.
A05mitigates — DLP tools can block or quarantine certain realized injection payloads (e.g. outbound exfiltration of SQL results or XSS payloads sent via email/cloud), bounding the consequence without neutralizing the untrusted input at the interpreter boundary
A09finds — A.8.12 explicitly requires monitoring channels, detecting disclosures (e.g. uploads/emails), and using DLP tools to identify sensitive data at risk, which surfaces logging/alerting gaps when they enable undetected leakage.
A09mitigates — DLP tools can detect and block exfiltration of logged sensitive data (e.g. via email or cloud upload), bounding the realized consequence of missing alerts or unprotected logs, but this does not address core failures in event generation, alert firing, or log integrity.
A10mitigates — A.8.12's DLP tools and monitoring can bound the consequence of an error-path leak (e.g. blocking exfiltration of sensitive data disclosed in an error message), but do nothing to prevent the exceptional-condition weakness itself or its inconsistent/fail-open states.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.