Cyber Resilience

← ISO 27001 Annex A

A.8.18 Technological

Use of privileged utility programs

AttributesPreventive C·I·A Protect System and network security Secure configuration Application security Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (17)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-3←M AC-5←M AC-6←M AU-2←P →M CM-6←P CM-7←M →P IA-2←P SC-2←P

Why these map — AI rationale (under review)

AC-3mostlyaligns with — Both enforce that privileged utility functions are executed only after explicit identification, authentication, and authorization checks.
AC-6mostlyaligns with — Both controls restrict the assignment and use of elevated privileges to the smallest set of trusted users and limit the duration and scope of those privileges.
AU-2mostlyaligns with — Both require that every invocation of privileged utilities is captured in an audit log for subsequent review.
AC-5partialaligns with — Both prevent users who already hold application privileges from also holding utility-program privileges that could compromise segregation of duties.
CM-7partialaligns with — Both mandate the removal or disabling of unnecessary privileged utilities to reduce the attack surface.
CM-7partialcovers — A.8.18 specifically addresses restricting privileged utilities (a narrow slice of prohibited/restricted software and functions), while CM-7's least-functionality requirement is far broader across all ports, protocols, services, and non-privileged software.
AC-3covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
AC-5covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
AC-6covers — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (24)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

DE.CM-03gov PR.AA-01gov PR.AA-03gov PR.AA-05gov PR.IR-01gov PR.PS-01gov PR.PS-04gov PR.PS-05gov

Why these map — AI rationale (under review)

PR.AA-01mostlyaligns with — By requiring unique identification and authentication for every use of privileged utilities, the ISO control fulfills the CSF requirement to manage identities and credentials for authorized users and services.
PR.AA-05mostlyaligns with — The ISO control restricts and authorizes privileged utility access through defined permission levels, reviews, and enforcement mechanisms that directly support the CSF outcome of managing and reviewing access entitlements.
PR.PS-04mostlyaligns with — Mandating comprehensive logging of all privileged utility activity provides the log records the CSF outcome expects to be generated and made available for continuous monitoring.
PR.IR-01partialaligns with — Segregating utility programs from application software and network traffic limits unauthorized logical access, supporting the CSF outcome of protecting networks and environments.
PR.PS-05partialaligns with — Removing or disabling unnecessary utility programs reduces the attack surface and prevents unauthorized execution, which partially satisfies the CSF goal of blocking unauthorized software.
PR.AA-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-05implements — A.8.18's technical restrictions on privileged utilities (including approval, authorization and least-privilege use) give operational effect to the access-permission management and enforcement outcome named in PR.AA-05; the link is by subject membership in the access-control domain rather than by explicit citation of the CSF subcategory.
PR.IR-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-05implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (10)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V13.2.3→P V13.3.2→P V16.3.2←M →P V6.3.2←P V8.2.1←M →P V8.3.1←P →P V8.4.2←M

Why these map — AI rationale (under review)

V13.2.3partialaligns with — Requiring unique identification and authentication before any utility program is executed aligns with the ASVS rule that service-to-service credentials must never be default or shared accounts.
V13.3.2partialaligns with — Limiting utility-program access to the smallest practical set of users embodies the principle-of-least-privilege control that ASVS V13.3.2 demands for secret-asset access.
V16.3.2partialaligns with — The explicit logging of every utility-program invocation provides the audit trail that ASVS V16.3.2 expects for all failed and successful authorization decisions.
V8.2.1partialaligns with — The ISO control's requirement to restrict utility programs to trusted, authorized users and to define authorization levels directly supports the ASVS mandate that function-level access be granted only to consumers with explicit permissions.
V8.3.1partialaligns with — By insisting that utility programs be invoked only through trusted service-layer authorization rather than client-side checks, the ISO guidance mirrors the ASVS requirement to enforce authorization decisions at a trusted backend.

Related weaknesses / CWE (36)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-271nonemitigates — Restricting use of privileged utility programs forces explicit privilege lowering before handing control to unprivileged actors.
CWE-648nonemitigates — Restricting privileged utility programs limits the exposure of privileged APIs to misuse.
CWE-1234mitigates — Restricting privileged utility programs limits debug access, but does not guarantee hardware lock protection.
CWE-1244mitigates — Privileged utility programs may include debug tools, but the control does not address hardware debug access levels.
CWE-1256mitigates — Restricting privileged utility programs limits exposure of low-level hardware interfaces that could be abused for memory or register manipulation.
CWE-1262mitigates — Privileged utility programs may touch registers, so the control partially mitigates misuse.
CWE-1274mitigates — Restricting privileged utilities reduces the chance of tampering with boot code in volatile memory.
CWE-15prevents — Use of privileged utility programs is controlled to prevent misuse of configuration tools.
CWE-250prevents — Restricting privileged utilities to the fewest trusted users and requiring explicit authorization directly stops developers or operators from embedding or invoking code that runs with unnecessary elevated rights.
CWE-266mitigates — Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
CWE-267mitigates — Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
CWE-268mitigates — Controlling privileged utility programs reduces opportunities for chaining privileges to perform unsafe actions.
CWE-269mitigates — Defining and enforcing documented authorization levels for each utility program prevents the assignment of excessive privileges that would let an attacker abuse those utilities beyond their intended scope.
CWE-270mitigates — Restricting privileged utilities reduces exposure to context-switch privilege errors.
CWE-272mitigates — Restricts and monitors privileged utility programs, directly addressing the need to drop elevated rights immediately after use.
CWE-274mitigates — Restricting privileged utilities reduces exposure but does not address how the application handles privilege shortfalls.
CWE-279mitigates — Restricting privileged utility programs reduces the chance that such tools will incorrectly alter object permissions.
CWE-284mitigates — Requiring identification, authentication, and authorization before any use of a privileged utility blocks unauthorized actors from reaching the control points that bypass normal access restrictions.
CWE-412mitigates — Restricting privileged utilities can limit external lock manipulation but does not address the core weakness.
CWE-732prevents — Removing or disabling unnecessary utilities and logically segregating the remaining ones reduces the chance that default or permissive file permissions will expose powerful system-modifying tools to untrusted processes or users.

Mitigated MITRE ATT&CK techniques (1092)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001.001←M T1001.002←M T1001.003←M T1003←M →P T1003.001←M →P T1003.002←M →P T1003.003←M →P T1003.004←M →P T1003.005→P T1003.006←M →P T1003.007←M →P T1003.008←M →P T1006←M →P T1007→P T1014←M →P T1016→P T1018→P T1021←M →P T1021.002←M →P T1021.003→P T1021.004←M →P T1021.005→P T1021.006→P T1021.008←M →P T1027.001←M T1027.002←M T1027.004←P T1027.005←M T1027.006←M T1027.007←M T1027.008←M T1027.009←M T1027.010←M T1027.011←M T1027.012←M T1027.013←M T1027.014←M T1027.016←M T1027.017←M T1027.018←M T1033→P T1036←M →P T1036.002←M T1036.003←M →P T1036.004←M T1036.005←M T1036.006←M T1036.007←M T1036.008←M T1036.009←M T1036.011←M T1037←M →P T1037.001→P T1037.002←M →P T1037.003←P →P T1037.004←M →P T1037.005→P T1040←M →P T1047←M →P T1048←M T1049→P T1053←M →P T1053.002→P T1053.003←M →P T1053.005←M →P T1053.006←M →P T1053.007→P T1055←M →P T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M →P T1055.005←M T1055.008←M →P T1055.009←M →P T1055.011←M T1055.012←M →P T1055.013←M →P T1055.014←M →P T1055.015←M →P T1056.001→P T1056.002←M T1056.004←M →P T1057→P T1059←M →P T1059.001←M →P T1059.002→P T1059.003←M →P T1059.004←M →P T1059.006←M →P T1059.008→P T1059.009→P T1059.010→P T1059.011→P T1059.012←M →P T1059.013←M →P T1068←M →P T1069.002→P T1070←M →P T1070.003←M →P T1070.004←M →P T1070.005→P T1070.006←M →P T1070.007←M →P T1070.008←M →P T1070.009→P T1070.010←M →P T1071←M T1071.001←M T1071.002←M T1071.004←M T1072←M →P T1078→P T1078.001←M →P T1078.002→P T1078.003→P T1078.004←M →P T1080→P T1082→P T1083→P T1087→P T1087.001→P T1087.004→P T1090←M T1090.001←M T1090.002←M T1090.003←M T1091←M T1095←M T1098←P →P T1098.001←M →P T1098.002←P →P T1098.003←M →P T1098.004←M →P T1098.005←M T1098.006←M →P T1098.007→P T1102←M T1102.001←M T1102.002←M T1104←M T1105←M T1106←M T1110←M →P T1110.001→M T1110.002→P T1110.003←M →P T1110.004→P T1111←P T1112←M →P T1127→P T1127.001→P T1127.002←M →P T1127.003←M →P T1129→P T1132.001←P T1132.002←M T1133←M T1134←M →P T1134.001←M →P T1134.002←M →P T1134.003←M →P T1134.004←M T1134.005←M →P T1136→P T1136.001←M →P T1136.002→P T1137→P T1137.001←M →P T1137.002→P T1137.003←M →P T1137.005←M →P T1137.006→P T1140←M →P T1176←M T1176.001←M →P T1185←M →P T1187→P T1197←M →P T1199→P T1202→P T1204←P T1204.002←M T1204.003←M T1204.004←M T1204.005←M T1205←M T1205.001←M T1205.002←M →P T1207←M →P T1210←M →P T1211←M →P T1212←M T1216←M →P T1216.001←M →P T1216.002←M →P T1218←M →P T1218.001←M T1218.002←M →P T1218.003←M →P T1218.004→P T1218.005→P T1218.007→P T1218.008→P T1218.009→P T1218.010←M →P T1218.011←M →P T1218.012←M →P T1218.013→P T1218.014→P T1219←M →P T1219.001←M →P T1219.002←M →P T1219.003←M T1220→P T1221←M T1222←M →P T1222.001←M →P T1222.002←M →P T1480.001←M T1482→P T1484←M →P T1484.001←M →P T1484.002←M →P T1485←P →P T1485.001←P T1489←M →P T1490→P T1491.001→P T1495→P T1496.001→P T1497←M T1505←M →P T1505.001→P T1505.002←P →P T1505.003←M →P T1505.004←M →P T1505.005←M →P T1505.006←M →P T1518.001→P T1518.002→P T1528←M →P T1529→P T1530→P T1531←P →P T1535←M T1537←M T1539←M →P T1542←M T1542.002←M T1542.003←M →P T1542.004←M →P T1542.005←M →P T1543←M →P T1543.001←M →P T1543.002←M →P T1543.003←M →P T1543.004←M →P T1543.005←P →P T1546←M →P T1546.001←M →P T1546.002←M →P T1546.003←M →P T1546.004←M →P T1546.006←M →P T1546.007←M →P T1546.008←M →P T1546.009→P T1546.010←M →P T1546.011←M →P T1546.012←M →P T1546.013←M →P T1546.014→P T1546.015←M →P T1546.016←M →P T1546.017←M →P T1546.018←M →P T1547←M →P T1547.001←M →P T1547.002→P T1547.003→P T1547.004←M →P T1547.005←M →P T1547.006←M →P T1547.008→P T1547.009→P T1547.010←M →P T1547.012←P →P T1547.013→P T1547.014→P T1547.015→P T1548→P T1548.001→P T1548.002→P T1548.003→M T1548.004←M →P T1548.005←M →P T1548.006←M →P T1550←M →P T1550.001←M T1550.002←M →P T1550.003←M →P T1550.004←F T1552→P T1552.001←M →P T1552.006→P T1553←M →P T1553.001←M T1553.002←M T1553.003←M →P T1553.004←P →P T1553.005←M T1553.006→P T1554←M →P T1555←M →P T1555.001←M →P T1555.004←M →P T1555.005→P T1555.006→P T1556←M →P T1556.001←M →P T1556.002←M →P T1556.003←M →P T1556.004←M T1556.005←P →P T1556.006←M →P T1556.007←M →P T1556.008←M →P T1556.009←M →P T1557←M T1558←M →P T1558.001←M →P T1558.002←M →P T1558.005←M →P T1559.003←M →P T1560→P T1560.001←M →P T1561←P →P T1561.001←P →P T1561.002←P →P T1563→P T1563.001←M →P T1563.002←M →P T1564→P T1564.006→P T1564.012→P T1564.013→P T1564.014→P T1565→P T1565.001→P T1565.002→P T1565.003→P T1568.003←P T1569←P →P T1569.001←M →P T1569.002←M →P T1569.003←M →P T1571←M T1572←M →P T1574←M →P T1574.001←M →P T1574.004←M →P T1574.005←M →P T1574.006←M →P T1574.007←M →P T1574.008←M →P T1574.009←M →P T1574.010←M →P T1574.011←M →P T1574.012←M →P T1574.013←M →P T1574.014→P T1578←M →P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005←P →P T1583.007←M T1588.001←P T1599←M T1599.001←M →P T1600←P T1600.001←P T1601←P →P T1601.001←M →P T1601.002←M T1602.001→P T1602.002→P T1606←M T1606.001←M T1606.002←M T1609←M →P T1610←P →P T1611←M →P T1612←M →P T1615→P T1620←M →P T1621←P T1622←M T1647←M T1649←P →P T1651→P T1653←P →P T1654→P T1665←P T1666←P T1671←M T1674←P T1675→P T1677←M →P T1678←P T1679←P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M T1685.004←M →P T1685.005←M →P T1685.006←M →P T1686←M →P T1686.001←M →P T1686.002←M →P T1686.003←M →P T1687←P →P T1688←M T1689←M T1690←M

Why these map — AI rationale (under review)

T1003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface many (but not all) credential-dumping tools and ad-hoc invocations on the platforms where they run; the remainder includes in-memory techniques, custom non-utility tools, and any dumping that evades the utility-program boundary.
T1003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls, which stops many (but not all) credential-dumping tools and ad-hoc methods on the platforms where they run.
T1003.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface the execution of tools such as procdump, rundll32 with comsvcs.dll, or mimikatz when they are used to dump LSASS, but does not address in-memory SSP loading, registry modification of Security Packages keys, or non-utility-program vectors.
T1003.001prevents — A.8.18's restrictions on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) stop many common LSASS dumping tools and techniques that rely on them, but do not block all in-memory access paths or SSP modifications by already-privileged actors.
T1003.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface execution of the listed in-memory tools (Mimikatz, gsecdump, pwdumpx, secretsdump) and reg.exe invocations when they are treated as utilities, but does not address non-utility in-memory techniques or post-extraction processing such as creddump7.
T1003.002prevents — A.8.18's limits on privileged utility use (authorization, unique ID, removal/disable, segregation, time-bounding, logging) directly constrain the privileged tools and registry techniques (pwdumpx, Mimikatz, reg save, secretsdump) that require SYSTEM access to reach the SAM, but cannot stop all in-memory or ad-hoc privileged extraction paths.
T1003.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface ntdsutil.exe (and similar listed tools when run with elevated rights), but does not address Volume Shadow Copy, secretsdump.py, Invoke-NinjaCopy, or non-utility access to backups.
T1003.003prevents — A.8.18 limits, authorizes, logs, segregates and removes privileged utilities (including ntdsutil.exe and similar tools listed for NTDS access), which stops many but not all paths (e.g. Volume Shadow Copy, Invoke-NinjaCopy, or non-utility methods) to the technique.
T1003.004detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1003.004 implementations rely on such utilities (Mimikatz, reg.exe, etc.) whose execution can therefore be surfaced in logs, but this is only a slice because the technique can also be performed via direct registry/memory reads that do not invoke a detectable utility.
T1003.004prevents — A.8.18's restrictions on privileged utilities (authz, least use, removal/disable, segregation, logging) directly constrain the SYSTEM-level tools (Mimikatz, Reg) that read LSA secrets, but only for the subset of utilities an org can disable or gate; built-in registry/memory access primitives required for normal system function cannot be removed and remain available to any SYSTEM context.
T1003.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's final step (SYSTEM/sudo execution of Mimikatz, secretsdump.py, tdbdump, Reg, Linikatz) is therefore surfaced in logs when those utilities are the vector, but the technique can also be performed by non-utility means or on unmonitored utilities, leaving a genuine slice undetected.
T1003.005prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling, logging) constrain the SYSTEM/sudo tools (Mimikatz, secretsdump, tdbdump, Reg) that extract cached credential hashes, but do not stop the technique outright when those utilities are authorized or when access is obtained by other means.
T1003.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; DCSync is performed by (or via) such privileged utilities or APIs on a DC, so the logging surfaces the technique when it runs, but this is only a slice of the full technique surface (e.g. does not cover non-utility API abuse or non-logged cases).
T1003.006prevents — A.8.18 limits, authorizes, logs, segregates and removes privileged utilities that can override controls; DCSync is performed by such privileged accounts/utilities (e.g. Mimikatz lsadump) so the control constrains the technique for authorized users and unnecessary tools, but does not stop the built-in replication APIs or privileged group members from invoking it.
T1003.007prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this reaches the root-privilege slice of T1003.007 (where the technique relies on privileged access to /proc/<PID>/mem of other processes) but leaves the non-privileged self-process and browser-permission slices untouched.
T1003.008detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface the execution of utilities such as cat or unshadow when they are used to dump /etc/passwd and /etc/shadow; this is genuine detection of the technique in flight but only for the utility-execution slice, not for direct file reads that bypass a named utility program.
T1003.008prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could read protected files like /etc/shadow), which stops many but not all paths to the T1003.008 technique (e.g. non-utility vectors or already-elevated non-utility processes remain).
T1006detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs, which would surface the built-in or third-party utilities (vssadmin, wbadmin, esentutl, NinjaCopy) named in the T1006 description and source prose; this is genuine detection of the technique in flight but only a slice, as the technique can also be performed by custom code that does not invoke a utility program.
T1006prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that can override controls), which constrains the use of volume-access utilities such as NinjaCopy, vssadmin or esentutl and thereby stops many instances of the technique from running; it leaves open the remainder of built-in or third-party utilities that are not removed and of authorized ad-hoc use that still succeeds.
T1007detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; the technique is defined as execution of exactly those OS utility commands, so the logging surfaces the technique when it runs, but only for the privileged subset and only where the logging is actually reviewed — a genuine but minority slice of the class.
T1007prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including OS commands like sc, tasklist, systemctl, schtasks and crontab that implement T1007), so their use by an adversary is blocked in many practical cases; it is only partial because the control does not reach non-privileged discovery utilities or the many ordinary user-context commands that can still enumerate services/tasks.
T1014prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) stop many user/kernel-level rootkits that rely on installing or running such tools, but firmware/bootkit variants and post-install hiding live outside its reach.
T1016prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including many of the exact discovery tools named in T1016 such as ipconfig/ifconfig/route/esxcli), so their use by an adversary is prevented on systems under that regime; the remainder is the broad set of non-privileged discovery utilities plus any privileged ones that remain authorized or are re-enabled.
T1018prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including many of those named in the T1018 description such as net, esxcli, arp, ping and CLI commands), which stops the technique from running for the covered subset of utilities and users; it leaves passive/local-file methods, non-privileged utilities, and in-scope but unsanctioned use untouched.
T1021prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those enabling remote services like SSH/RDP), which stops many abuse paths that rely on privileged utilities; it does not address credential theft, domain auth, or non-utility remote service abuse, leaving a large remainder.
T1021.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; SMB admin share access (especially via valid admin accounts, PtH, or RPC) routinely exercises such utilities, so the mandated logs surface the technique when it occurs, but only for the subset of executions that route through covered utilities rather than all lateral movement variants.
T1021.002prevents — A.8.18's limits on privileged utilities (auth, least use, removal, segregation, logging) constrain admin-level SMB share access that relies on privileged accounts and tools, but do not stop valid admin accounts or the SMB protocol itself from being used for lateral movement.
T1021.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; DCOM remote activation/execution often surfaces in such logs when performed by privileged accounts, but this is only one narrow observable among many possible DCOM abuse paths and does not broadly instrument the technique.
T1021.003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could invoke or abuse DCOM as a privileged RPC mechanism), which stops many but not all paths an adversary could take with a valid privileged account; the control does not reach the default ACLs, insecure COM methods, or non-utility account abuse described in the technique.
T1021.004detects — A.8.18.i explicitly requires logging of all use of utility programs; SSH is a remote-access utility that can override controls when enabled or used with privilege, so the mandated logging surfaces the technique when it runs, but only for the utility-usage slice rather than all SSH logins or the broader technique.
T1021.004prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could enable or configure SSH access on Linux/ESXi), which stops many but not all paths an adversary could take with a valid account to open an SSH remote shell.
T1021.005prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could enable or abuse remote-control tools like VNC), which stops many abuse paths that rely on privileged utilities but leaves the bulk of the technique (valid-account VNC use without privileged-utility involvement) untouched.
T1021.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; WinRM is a privileged remote-execution utility that can be treated as such, so the control surfaces its use when the logging requirement is scoped to include it, but the clause leaves scope to the implementer and does not mandate WinRM-specific detection.
T1021.006prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could run WinRM or equivalent remote management tools), which stops many abuse paths that rely on unauthorized or overly broad use of such utilities; it does not address the core technique of using already-valid accounts that are legitimately authorized for WinRM.
T1021.008prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those providing direct console/root access to VMs), which constrains the cloud-native privileged connection methods named in T1021.008; it is not full because the control addresses only the utility programs themselves and leaves the upstream valid-account and cloud-API vectors untouched.
T1033prevents — A.8.18 limits, authorizes, logs, segregates and disables privileged utilities that could be abused for discovery commands such as whoami/w/who/show users; this stops the privileged slice of T1033 but leaves ordinary-user discovery (environment variables, unprivileged commands, process/file ownership) untouched.
T1036prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including via unique ID and least use), which directly stops adversaries from freely renaming/abusing them as masquerading artifacts on the platforms where those utilities exist; it does not address all masquerading vectors such as metadata manipulation or non-utility objects.
T1036.003detects — A.8.18.i explicitly requires logging of all use of (authorized) utility programs, which surfaces renamed/masqueraded instances when they are still exercised through the controlled, identified utility path; this is genuine detection of the technique but only a minority slice, as the control's dominant thrust is preventive authorization and removal of unnecessary utilities while the technique's core (pre-use rename to evade name/path-based monitoring) sits outside that logged surface.
T1036.003prevents — A.8.18's limits on which utilities exist, who may run them, how they are authorized/identified, and their segregation directly stop many rename-and-abuse paths that rely on the original utility remaining available under its expected name or path; it does not stop every renaming variant an adversary can craft.
T1037detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; boot/logon init scripts that run with elevated privileges are a named subset of such utilities, so their execution is surfaced in those logs (with the remainder being non-privileged or non-utility-script forms of T1037).
T1037prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could run or alter boot/logon scripts with elevated rights), which stops many but not all T1037 paths (e.g. non-utility scripts, already-installed ones, or non-privileged vectors remain possible).
T1037.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; a logon script (especially one needing admin rights) is observable as such a utility, but the clause does not mandate monitoring/analysis of those logs or coverage of non-privileged cases, leaving a genuine slice unreached.
T1037.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; a logon script (esp. one needing admin rights) is a privileged utility whose misuse for persistence is directly constrained by points a, b, c, d, e, f, g and h, but the control does not reach non-privileged user-writable logon scripts or every possible execution vector.
T1037.002detects — A.8.18.i explicitly requires logging of all use of utility programs; the technique relies on the defaults command-line utility (and root-level plist edits), so that logging surfaces the actor's use of the privileged utility, but the control does not require logging of the resulting hook execution itself or of non-utility persistence artifacts.
T1037.002prevents — A.8.18's limits on privileged utility use (auth, authorization, removal/disabling, segregation, temporary availability, and logging) constrain the administrator-level defaults command and plist modification that T1037.002 requires, but only for a minority slice because the technique can still be performed by any authorized admin user under the defined procedures.
T1037.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; network logon scripts that run with elevated rights (as the description notes may require an administrator account) are a form of such utility that would be logged when used, surfacing the persistence technique after the fact, but the clause does not mandate monitoring or analysis of those logs nor cover non-privileged cases.
T1037.003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could run or alter logon scripts with elevated rights), which stops many but not all instances of this persistence technique (e.g. non-privileged user-assigned scripts or scripts outside the utility category remain possible).
T1037.004detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; RC script modification (to achieve persistence) is a privileged action that would be logged if performed via such a utility, but the control does not require detection of direct file edits or the resulting anomalous boot behavior.
T1037.004prevents — A.8.18's limits on privileged-utility use (authz, segregation, removal of unnecessary ones, temporary availability, logging) constrain the root-level modification of RC scripts that the technique requires, but only for the subset of utilities that overlap with RC mechanisms; many systems have moved to systemd/launchd where RC scripts are deprecated or bypassed, leaving a large residual slice untouched.
T1037.005prevents — A.8.18's limits on privileged-utility use (authorization, segregation, removal of unnecessary utilities, logging) constrain an adversary's ability to install a root-executing StartupItem, but the control addresses only the privileged-utility subset of the technique and does not stop all paths to creating or registering a boot-time item.
T1040prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities (including those that enable promiscuous mode, span ports, traffic mirroring or monitor capture), which stops many but not all vectors for T1040 (e.g. unprivileged userland sniffing, cloud mirroring services, or network-device CLI that bypass the utility controls).
T1047detects — A.8.18.i explicitly requires logging of all use of utility programs; WMI (including wmic.exe, PowerShell, and COM APIs) is an administrative utility that can override controls, so its use is surfaced in logs, but the control does not mandate monitoring/analysis of those logs or detection of abuse.
T1047prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including management interfaces like WMI that can override controls), which stops many abuse paths for T1047; it is only partial because the clause is scoped to 'utility programs that can override system and application controls' and does not reach all WMI usage vectors (e.g. COM APIs, PowerShell, or non-privileged discovery/execution).
T1049prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including many of the exact discovery commands named in the T1049 prose such as netstat, lsof, who, w and network-device CLI equivalents), so their use is prevented for the bulk of untrusted users and ad-hoc scenarios; the named remainder is legitimate authorized administrators on systems where such utilities remain enabled and accessible.
T1053detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; task-scheduling utilities (at, cron, schtasks, etc.) are a classic privileged-utility class whose abuse is surfaced by those logs, but the control does not mandate monitoring, alerting or analysis of the logs, leaving detection dependent on downstream tooling outside its scope.
T1053prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including scheduling ones like at/cron/schtasks), which stops many abuse paths for T1053 but leaves the remainder of unprivileged/local scheduling, in-scope platform utilities that cannot be removed, and remote-auth bypasses.
T1053.002detects — A.8.18.i explicitly requires logging of all use of utility programs; at is a privileged utility, so the resulting logs surface its abuse (including for persistence/escalation) when reviewed, but this is only one slice of detection with no requirement for real-time alerting, anomaly-based monitoring, or coverage of non-log observables.
T1053.002prevents — A.8.18 directly limits privileged-utility use (minimize number of authorized users, strict authz, remove/disable unnecessary utilities, time-bound availability, segregation), which constrains at(1) abuse on Linux/macOS and the Windows at.exe path; the remainder is the baseline where at is already present and usable by admins, plus the WMI scheduling vector that bypasses the utility binary itself.
T1053.003detects — A.8.18.i explicitly requires logging of all use of utility programs; cron is a privileged utility, so the resulting logs surface adversary abuse for persistence, but this is only one slice of detection (no requirement for real-time alerting, anomaly analysis, or coverage of non-log indicators).
T1053.003prevents — A.8.18's guidance (limit use to trusted authorized users, authN/authZ, remove/disable unnecessary utilities, segregate, log, time-bound availability) directly constrains who and how the cron utility itself can be invoked or installed for abuse, preventing the technique on a meaningful but incomplete slice of the attack surface (e.g., non-root, non-privileged, or non-essential utilities).
T1053.005detects — A.8.18.i explicitly requires logging of all use of utility programs; schtasks.exe (the primary documented utility for T1053.005) is a privileged utility whose invocation would therefore be logged, surfacing the technique when it runs, but the control reaches only the named utility slice and is silent on .NET wrappers, WMI, PowerShell Invoke-CimMethod, hidden-task registry edits, and non-utility scheduler abuse.
T1053.005prevents — A.8.18's limits on privileged utility use (authorization, unique ID, logging, removal of unnecessary ones, segregation) constrain schtasks.exe and similar privileged utilities that adversaries abuse for T1053.005, but do not block non-privileged creation methods, WMI/.NET/PowerShell paths, or hidden-task techniques that do not rely on those utilities.
T1053.006detects — A.8.18.i explicitly requires logging of all use of utility programs; systemd timers are activated and managed via the privileged systemctl utility, so the mandated logging surfaces adversary use of this technique (especially in privileged paths), but the control does not require monitoring/analyzing those logs or covering user-level timers outside privileged utilities.
T1053.006prevents — A.8.18's limits on privileged utility use (authz, unique ID, removal/disabling of unnecessary ones, segregation, time-bound availability) directly constrain the privileged-path timer installation and systemctl activation that enable root-level T1053.006 persistence; user-level timers and non-utility aspects remain untouched.
T1053.007detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; container-orchestration job scheduling (CronJob) is a privileged utility whose abuse can be surfaced in those logs, but the control does not mandate monitoring, alerting, or coverage of orchestration-specific artifacts, leaving most of the technique undetected.
T1053.007prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal, logging) constrain abuse of orchestration schedulers that rely on elevated container privileges, but do not block the technique outright on platforms where such utilities remain available or where lower-privilege jobs suffice.
T1055prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be abused for injection; this constrains some legitimate-functionality vectors on the platforms but leaves many platform-specific and non-privileged injection techniques untouched.
T1055.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many documented DLL-injection techniques rely on or can be surfaced by anomalous privileged-utility or process-creation events that such logging would capture, but the control does not mandate host telemetry, API monitoring, or memory-integrity checks that would catch reflective, hollowing, or non-utility-based variants.
T1055.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged-process and elevated-privilege slice of T1055.001 but leaves the majority of in-memory injection techniques (reflective, module stomping, non-privileged processes) untouched.
T1055.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many PE-injection techniques rely on such utilities (e.g. debuggers, process manipulators) whose invocation or anomalous behavior would therefore be surfaced in logs, but the control does not address the many non-utility-based PE-injection vectors or runtime memory anomalies themselves.
T1055.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged process context and tooling an adversary would need for PE injection, but leaves the dominant in-memory API-based technique (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread) in ordinary processes largely untouched.
T1055.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's core steps (SuspendThread, WriteProcessMemory, SetThreadContext, ResumeThread) are performed by or via such utilities, so the mandated logging surfaces their use, but the control does not require monitoring/analysis of process-memory anomalies or injection artifacts themselves.
T1055.003prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities that could be abused to perform the API calls and memory manipulation described in T1055.003; this constrains the technique on systems where such utilities are the vector, but does not stop in-process thread hijacking performed directly from already-compromised application code or non-utility tools.
T1055.004prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; APC injection (T1055.004) is a privileged technique that often relies on such utilities or elevated handles, so the control constrains a genuine but minority slice of its execution paths (e.g. via least-utility, segregation and removal) while leaving many non-utility, in-memory or Early Bird paths untouched.
T1055.008detects — A.8.18.i explicitly requires logging of all use of utility programs; ptrace-based injection is performed by (or from) a utility program exercising debug/trace capabilities, so the mandated logging surfaces the technique when it runs, but only for the bounded slice of utility-mediated cases rather than all process-injection variants.
T1055.008prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain the privileged debugging context required for ptrace injection (especially against non-child/higher-priv processes), but do not block all legitimate debuggers or all injection vectors on Linux.
T1055.009detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique relies on privileged utilities such as dd to overwrite /proc/<pid>/mem, so that logging surfaces the technique when it runs, but the control reaches only the utility-usage slice and leaves non-utility proc-memory injection (or non-logged utilities) untouched.
T1055.009prevents — A.8.18's limits on privileged utility use (auth, least users, removal/disable, segregation, logging) constrain the privileged tools (e.g. dd) and accounts typically required to perform /proc-based memory overwrite, but do not block the underlying technique for all processes or non-utility vectors.
T1055.012detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many process-hollowing implementations rely on such utilities or their APIs, so the mandated logs surface the activity, but the control does not require monitoring of the technique itself or of non-utility hollowing and the technique is explicitly designed to evade process-based detection.
T1055.012prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged process-injection APIs and tools an adversary would need for hollowing, but leaves ordinary user-context hollowing (the technique's dominant documented case) untouched.
T1055.013detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; process doppelgänging abuses TxF APIs and system utilities that qualify as such utilities on Windows, so the mandated logging would surface the anomalous use, but the control does not address non-utility aspects, memory-section anomalies, or detection outside privileged-utility invocation.
T1055.013prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities; this constrains the TxF-abusing privileged-utility steps (transact/animate) for a genuine but minority slice of the technique, while the core memory-section and rollback mechanics remain outside its scope.
T1055.014detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; VDSO hijacking (a Linux technique that often relies on privileged utilities or syscalls to map and redirect) can surface in those logs as anomalous privileged activity, but the control does not mandate monitoring/analysis of the logs nor does it address non-utility vectors or evasion of process-based defenses.
T1055.015detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which can surface anomalous or unauthorized process/memory manipulation that enables ListPlanting (a T1055 subclass); this is genuine detection coverage but only a minority slice of the technique's full surface (window messages, handles, callbacks, non-WriteProcessMemory paths).
T1056.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; several T1056.001 implementation methods (custom drivers, registry mods, Modify System Image) are typically performed via privileged utilities whose execution would therefore be surfaced in those logs.
T1056.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be (ab)used to implement keylogging methods such as custom drivers, registry changes or hardware-buffer readers; this stops some but not all vectors (e.g. standard API hooking by non-privileged malware remains outside its scope).
T1056.004detects — A.8.18 item i) explicitly requires logging of all use of utility programs, which would surface malicious hooking when performed via privileged utilities (e.g. via LD_PRELOAD or inline hooks that rely on elevated utilities), but the control is silent on non-utility hooking mechanisms, in-process hooks by non-privileged code, or detection without logging, leaving most of the technique unreached.
T1057detects — A.8.18.i explicitly requires logging of all use of utility programs (including those like tasklist/ps/Get-Process that implement T1057), which surfaces the technique when it runs via privileged utilities; this is only a slice of T1057 because many process-discovery paths (Native API, /proc reads, non-utility CLI) are outside the utility-program scope.
T1057prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those like tasklist/ps/Get-Process that adversaries use for T1057), which stops many but not all discovery paths (e.g. native APIs, /proc reads, unprivileged commands, or network-device CLI).
T1059detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces when an adversary is abusing interpreters that qualify as such utilities; this is genuine detection of (a subset of) T1059 but only a slice because most interpreters, non-privileged usage, and many platforms lie outside the privileged-utility boundary.
T1059prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including many interpreters), which stops the technique from running for that subset; it leaves the bulk of built-in, non-privileged interpreters untouched.
T1059.001detects — A.8.18.i explicitly requires logging of all use of utility programs; PowerShell is a privileged utility that can override controls, so its abuse (including non-powershell.exe invocation) is surfaced in logs where the logging scope includes it, but the control does not mandate detection tooling, alerting, or coverage of all in-memory/undocumented execution paths.
T1059.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that can override controls), which constrains many abuse vectors for the built-in privileged PowerShell interpreter on Windows; it does not reach non-privileged execution, in-memory/.NET reflection paths, or non-utility interpreters, leaving a genuine minority slice prevented.
T1059.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; AppleScript execution via osascript (a utility that can override controls) is therefore surfaced in logs when the utility is used, but the many non-utility paths (embedded NSAppleScript/OSAScript, Mail rules, Automator, shebang without osascript) lie outside the clause's scope
T1059.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could run or invoke AppleScript interpreters like osascript), which stops many abuse paths on macOS but leaves non-privileged script execution vectors, in-memory NSAppleScript/OSAScript calls, and non-utility interpreters untouched.
T1059.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; cmd.exe is the primary Windows shell and a common privileged utility, so its abuse (T1059.003) can be surfaced in logs, but the control does not mandate monitoring, analysis, or alerting on those logs.
T1059.003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could invoke or escalate to cmd.exe), which stops many abuse paths for T1059.003 but leaves ordinary/non-privileged shell use and many legitimate cmd.exe invocations untouched.
T1059.004prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including shells when they act as such), which stops many abuse paths for T1059.004; it leaves ordinary non-privileged shell use and non-utility shells untouched.
T1059.006detects — A.8.18.i explicitly requires logging of all use of utility programs; Python interpreters and .py scripts qualify as such utilities on the covered platforms, so their abuse is surfaced in logs, but the clause does not mandate monitoring/analysis of those logs nor cover non-utility Python execution vectors.
T1059.006prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including interpreters like Python when they can override controls), which stops many abuse paths for T1059.006; it does not reach non-privileged Python use, compiled binaries, or interpreters outside the privileged-utility boundary.
T1059.008detects — A.8.18.i explicitly requires logging of all use of utility programs, which on network devices would surface CLI abuse (T1059.008) after the fact; the remainder of the control is entirely preventive and does not address detection.
T1059.008prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could override controls on network devices), which constrains adversary abuse of the network CLI for many but not all of its described effects (e.g. remote access vectors and built-in permission levels remain reachable).
T1059.009detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces abuse of cloud APIs when those APIs are invoked through privileged utilities, CLIs, or cloud shells; this is genuine detection but only a slice because the control is scoped to privileged utilities rather than all cloud API abuse vectors or non-utility access paths.
T1059.009prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those providing CLI/Cloud Shell access to cloud APIs), which stops many abuse paths when those utilities are the vector; it does not address credentialed API abuse from SDKs, in-app calls or non-utility clients, leaving a genuine minority slice prevented.
T1059.010detects — A.8.18.i explicitly requires logging of all use of utility programs; AutoHotKey/AutoIT scripts and compiled executables are a form of utility/automation program whose execution can therefore be surfaced in logs, but the control does not mandate host telemetry, process monitoring, or any other detection mechanism beyond that logging slice.
T1059.010prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; AutoHotKey/AutoIT are exactly such automation utilities that can simulate input and run code, so the control constrains their use and thereby prevents the technique in covered cases, but leaves a large remainder (unmanaged endpoints, non-privileged interpreters, or scripts that do not require elevated rights).
T1059.011detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; Lua interpreters and .lua scripts are a form of utility program whose execution can therefore be surfaced in logs, but the control is scoped only to privileged utilities, does not mandate detection tooling or alerting, and leaves non-privileged Lua entirely unreached.
T1059.011prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including interpreters), which can stop Lua from being available or runnable as an abuse vector on covered systems; it reaches only a slice because the clause is scoped to privileged utilities, many Lua interpreters are embedded/non-privileged, and the technique can still run via application-embedded interpreters or non-utility vectors.
T1059.012detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface abuse of hypervisor CLIs such as esxcli/vim-cmd when they qualify as privileged utilities; this is genuine detection but only a slice, as the control does not mandate monitoring, alerting, or analysis of those logs and applies only where the organization has classified the hypervisor CLI as such a utility.
T1059.012prevents — A.8.18's limitations on privileged utility use (authorization, segregation, removal of unnecessary ones, time-bounding, logging) constrain abuse of hypervisor CLIs such as esxcli/vim-cmd when they qualify as such utilities, but only for a minority slice: the technique's core (privileged hypervisor management commands) is exactly what the control is built to gate, yet the control is silent on hypervisor-specific design, guest isolation, and the many non-utility CLI vectors that remain available.
T1059.013detects — A.8.18.i explicitly requires logging of all use of utility programs; container CLIs (docker, kubectl) and their APIs qualify as such privileged utilities, so the control surfaces their invocation for detection, but only a slice of the technique (not all sub-behaviors or non-CLI API calls) and detection depends on downstream log review.
T1059.013prevents — A.8.18's limits on privileged utilities (authz, unique ID, segregation, removal of unnecessary ones, temporary availability, logging) constrain abuse of privileged container CLIs/APIs such as docker/kubectl when treated as utilities, but do not stop all container CLI abuse (e.g. non-privileged or non-utility SDK/API calls).
T1068prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be abused for escalation, directly blocking many (but not all) exploitation vectors that rely on bringing in or invoking such tools.
T1069.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that enumerate domain groups via net/ldapsearch), so the technique cannot run for most authorized users and most unnecessary utilities; the remainder is ad-hoc authorized use and built-in utilities required for legitimate administration.
T1070prevents — A.8.18's limits on privileged utility use (f,g,h,i especially) stop many T1070 techniques that rely on those utilities to selectively clear logs, histories or metadata, but do not block all platform-specific or non-utility methods of indicator removal.
T1070.003prevents — A.8.18's limits on privileged utility use (authorization, unique ID, logging, removal of unnecessary utilities, segregation) constrain many of the privileged/admin-level ways an adversary would clear command history (e.g. rm, Clear-History as root/admin, network-device clear commands), but do not stop non-privileged users from clearing their own history files or using non-utility methods, leaving a large residual slice of the technique.
T1070.004detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface adversary use of file-deletion utilities (rm, del, SDelete, etc.) when they qualify as privileged utilities; this is genuine detection of the technique in a bounded slice rather than across all instances or platforms.
T1070.004prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling of unnecessary ones, temporary availability, logging) constrain adversary access to and use of privileged deletion tools like SDelete or root-level rm, but do not stop built-in non-privileged commands (del, rm) or unprivileged users from deleting their own dropped files.
T1070.005detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; the described T1070.005 procedure uses the net.exe utility, so that usage is logged and therefore detectable, but the control reaches only the utility-execution slice of the technique and does not address non-utility methods or post-facto log review.
T1070.006prevents — A.8.18's limits on privileged utility use (authorization, unique ID, logging, removal/disablement, segregation) stop many timestomping utilities from running as privileged tools, but do not block user-level API calls, common touch commands, or kernel-level $FN changes that require no privileged utility.
T1070.007prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal/disabling, logging, time-bounding) stop many admin-level utilities that adversaries would otherwise use to clear network artifacts, but do not reach non-privileged tools, in-memory edits, or non-utility mechanisms that can achieve the same T1070.007 effect.
T1070.008prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including command-line mail tools and PowerShell modules that adversaries use to delete mailbox data), so it stops many instances of the technique from being available or executable; it does not address every vector (e.g. APIs, transport rules, or already-available non-privileged utilities) and therefore reaches only a genuine minority slice of the class.
T1070.009detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface many of the cleanup actions (service removal, file deletion, registry/plist modification) when performed via such utilities, but does not address non-utility methods, in-memory actions, or non-privileged persistence artifacts.
T1070.010detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; relocating malware via copy/rename on many platforms is performed by such utilities (e.g. cp, mv, copy), so the logging surfaces the technique when it uses them, but the control is silent on non-utility relocation methods, non-privileged tools, or post-facto analysis of the logs.
T1072prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging, time-bounding) constrain abuse of deployment/management suites that function as privileged utilities, but only for a minority slice of T1072: many such tools are not removable utilities, run under ordinary admin accounts rather than special utilities, or live in SaaS/cloud layers outside the clause's on-prem focus.
T1078detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces anomalous or unauthorized account abuse when those utilities are involved in T1078 execution.
T1078prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be abused with valid accounts (especially for privilege escalation or defense evasion), but does not stop credential compromise, inactive-account abuse or permission overlap that enables the technique.
T1078.001prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging) constrain abuse of many default privileged accounts that function as utilities, but do not address default accounts generally, non-utility defaults, or credential theft vectors outside utility programs.
T1078.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; domain accounts (especially high-privilege ones) are commonly used to run such utilities, so the resulting logs can surface the technique when it occurs, but this is only a slice of T1078.002 (no coverage of credential dumping, password reuse, or non-utility abuse vectors).
T1078.002prevents — A.8.18's limits on privileged utility use (auth, least users, removal, segregation, logging) constrain abuse of high-privilege domain accounts obtained via dumping/reuse, but do not stop credential compromise itself or block all paths to domain account abuse.
T1078.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which can surface abuse of local accounts when that abuse involves such utilities (e.g. during privilege escalation or credential dumping), but the control does not require or address detection of local-account abuse in general
T1078.003prevents — A.8.18's limits on privileged utility use (auth, least users, removal/disable, segregation, logging) constrain several abuse vectors for local accounts (esp. privilege escalation and credential dumping via utilities), but do not stop initial acquisition, password reuse across systems, or abuse of non-privileged local accounts.
T1078.004prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls, which constrains the abuse of high-privileged cloud accounts (the dominant vector for T1078.004) but leaves ordinary user/service accounts, credential theft via phishing/brute-force, misconfigured role assumptions, and federated identity paths untouched.
T1080prevents — A.8.18 limits, authorizes, logs, segregates and removes privileged utilities that could be used to taint shared content or binaries, but does not address the core adversary action of writing tainted files to shares or the user execution that propagates them.
T1082prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that can query system version/patches like systeminfo, esxcli, systemsetup or show version), which stops many but not all instances of the technique (API-driven IaaS discovery, non-privileged CLI, and utilities outside the privileged-utility boundary remain possible).
T1083prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that enumerate files/directories), which stops many of the technique's common vectors when they require elevated rights; the remainder is unprivileged discovery (dir, ls, find, locate, custom tools) that needs no utility override.
T1087prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be abused for account enumeration (e.g. via built-in commands or tools), stopping many but not all discovery paths such as cloud APIs, file searches or non-privileged commands.
T1087.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be used to run the enumeration commands named in the technique (net, id, dscl, esxcli, etc.), so it prevents the technique on those utilities for most covered platforms; it does not address non-privileged enumeration paths such as directly reading /etc/passwd.
T1087.004prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including cloud CLI/PowerShell tools used for enumeration), which can stop many authenticated discovery paths when those utilities are the vector; it does not reach non-privileged account-listing methods or all cloud-native APIs.
T1098detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; such logging (when aggregated/analyzed) can surface account manipulation performed via those utilities, but the control reaches only the utility-mediated slice of T1098 and is silent on the many other vectors (e.g., direct API calls, GUI tools, cloud consoles).
T1098prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls, which directly constrains the high-privilege actions (credential/permission changes) required for T1098; it is only partial because the technique can still be executed with already-sufficient non-utility permissions or on platforms outside the utility-focused scope.
T1098.001prevents — A.8.18's limits on who may run privileged utilities (a,b,c,d,e,h), their segregation (g), and removal of the unnecessary ones (f) constrain the subset of privileged utilities an adversary could use to add credentials, but do not stop an adversary who already holds sufficient permissions from invoking the documented APIs or portal functions that perform the addition.
T1098.002prevents — A.8.18 limits, authorizes, logs, segregates and removes privileged utilities (including those that can alter permissions), which stops many but not all ways an adversary can grant mailbox delegate permissions via admin consoles, Gmail settings or non-utility APIs.
T1098.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; this surfaces (i.e. detects) the technique when it is performed via such utilities (e.g. IAM policy modification APIs or admin-role tools), but the control is silent on non-utility vectors, external-account role additions, and log review/monitoring, leaving a large remainder.
T1098.003prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging) constrain the tools and accounts an adversary would abuse to add IAM roles/permissions, but do not stop the technique when performed via native cloud IAM APIs from a compromised privileged account.
T1098.004detects — A.8.18.i explicitly requires logging of all use of utility programs; because the technique is performed with shell commands, CLI tools or APIs that are themselves privileged utilities on the listed platforms, that logging surfaces the action (especially when the utility is used to edit authorized_keys or sshd_config), but the control does not mandate detection of the resulting persistent key itself or of non-utility vectors, leaving a genuine slice unreached.
T1098.004prevents — A.8.18 limits, authorizes, logs, segregates and disables privileged utilities (including those that could edit authorized_keys or sshd_config), which stops many but not all paths (e.g. direct file edits by already-privileged users, cloud API calls, or non-utility mechanisms).
T1098.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; this surfaces anomalous privilege-escalating actions (including those that add container roles or bindings) when the utilities involved are monitored, but the control does not require monitoring of the Kubernetes API, RBAC changes, or ABAC policy edits themselves and many T1098.006 paths do not involve a detectable utility program.
T1098.006prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging) constrain the privileged operations needed to create RoleBindings/ClusterRoleBindings or alter ABAC policies, but only for a minority slice of the technique that routes through system utilities rather than native Kubernetes RBAC/ABAC interfaces or cloud IAM.
T1098.007detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's canonical examples (net localgroup, net group, usermod) are exactly such utilities, so their execution is logged and therefore detectable, but the control does not require monitoring/analysis of those logs nor does it address non-utility mechanisms for group addition.
T1098.007prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including usermod/net localgroup/net group), which stops many but not all paths an adversary could use to add groups for persistence.
T1110detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; such logging (when aggregated/monitored) can surface brute-force attempts that leverage or mimic privileged utilities (e.g. credential dumping tools or password crackers run as privileged utilities), but this is only a minority slice of T1110's broad surface across online guessing, offline cracking, and non-utility vectors.
T1110prevents — A.8.18 limits, segregates, authorizes, logs and disables privileged utilities that could be abused to run brute-force tools or bypass auth mechanisms (e.g. via credential dumping or policy changes), but does not stop the core guessing technique itself when performed through normal services, external remote access, or non-privileged means.
T1110.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; where password guessing is performed via such a utility the resulting logs surface the technique, but most of the technique's surface (direct service logins, SSO, wireless auth, non-utility tools) lies outside any utility-program scope.
T1110.001prevents — A.8.18's limits on privileged utility use (auth, authorization, removal/disabling, segregation, temporary availability, logging) directly constrain the management-service and network-device vectors that dominate T1110.001, while the remainder (SSO/federated, cloud email, and non-privileged guessing) is a bounded, nameable slice.
T1110.002prevents — A.8.18's limits on privileged utility use (auth, logging, removal, segregation) can block utilities that crack hashes or enable offline cracking on target systems, but most of T1110.002 occurs offline on adversary-controlled systems outside any such controls.
T1110.003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could facilitate or bypass auth on management services), which stops password spraying via that vector on covered systems but leaves the bulk of the technique (direct auth attempts against SSO, cloud, email, non-utility services, or unprivileged accounts) untouched.
T1110.004prevents — A.8.18 limits, authorizes, logs, segregates and disables privileged utilities that could be abused to run credential-stuffing tools or brute-force scripts against the listed management services; this stops the technique on systems where those utilities are the attack vector, but leaves the bulk of credential stuffing (direct protocol use from compromised accounts, scripts, or external tooling) untouched.
T1112detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; because the Reg utility (and many other registry tools) are privileged utilities whose use can be logged, this surfaces the technique when performed via those tools, but the control is silent on non-utility API-based registry modification so the coverage is only a slice.
T1112prevents — A.8.18 limits, authorizes, logs, segregates and disables privileged utilities (including reg.exe and similar tools that directly modify the Registry), which stops many T1112 executions that rely on those utilities; it does not stop all Registry modification (API-based, in-memory, or non-privileged) so the coverage is a genuine but minority slice.
T1127detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces the technique when those developer utilities are invoked; this is genuine detection but only a slice, as the control does not mandate monitoring of the proxy-execution behavior itself or of non-privileged utilities.
T1127prevents — A.8.18's limits on number of authorized users, unique auth, authorization levels, removal/disabling of unnecessary utilities, segregation, and temporary availability directly constrain which trusted developer utilities can run and who can invoke them, stopping many (but not all) T1127 abuse cases that rely on broadly available or unsigned utilities.
T1127.001detects — A.8.18.i explicitly requires logging of all use of utility programs; MSBuild is a privileged utility that can be abused for proxy execution, so the mandated logging surfaces its use (including anomalous/abusive invocations) but only where that logging is actually collected, correlated, or monitored for malice, which the clause itself does not require.
T1127.001prevents — A.8.18's limits on privileged utilities (authorization, unique ID, removal/disable, segregation, time-bounding, logging) constrain use of MSBuild as a signed trusted utility for arbitrary code proxy, but do not eliminate the technique on required build platforms where MSBuild cannot be removed.
T1127.002detects — A.8.18.i explicitly requires logging of all use of utility programs; this surfaces abuse of the trusted DFSVC.EXE launcher (and related utilities like rundll32) when the technique is exercised, but the control does not mandate monitoring of the downstream effects (startup folder drops, user-execution popups, or child-process artifacts) that are also part of the technique.
T1127.002prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling, logging) constrain abuse of trusted utilities like dfshim.dll/DFSVC.EXE for proxy execution, but do not stop non-privileged ClickOnce abuse vectors such as user-driven installation or startup-folder persistence.
T1127.003detects — A.8.18.i explicitly requires logging of all use of utility programs; JamPlus is a build utility that can be abused, so its use (and therefore the T1127.003 technique) is surfaced in logs where the control is applied, but this is only a slice because logging is one optional guideline among many, does not mandate specific detection of malicious .jam content or subverted app control, and depends on what the implementer actually monitors.
T1127.003prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain abuse of a build utility like JamPlus that can override controls, but only for managed/authorized instances; it does not stop adversaries introducing or using an unmanaged copy to proxy execution and bypass app control.
T1129detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; shared-module loaders (dlopen/LoadLibrary) are system utilities whose abuse can be surfaced in those logs, but the control does not mandate monitoring or analysis of the logs nor does it require coverage of non-privileged or non-utility module loads.
T1134detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1134 sub-techniques rely on such utilities (e.g. runas, token manipulation tools) whose invocation would be surfaced in logs, but the control does not require monitoring/analysis of those logs nor does it address non-utility mechanisms such as direct API or AD field manipulation.
T1134prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains many token-manipulation vectors that rely on such utilities (e.g. runas, token-stealing tools), but leaves standard-user API/AD mechanisms and non-utility paths untouched.
T1134.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface token-impersonation activity when it is performed via such a utility (a common vector), but the control does not require or address detection of the technique when performed by other means such as direct API calls from malware.
T1134.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; token theft often uses such utilities (e.g. whoami, token manipulation tools) so the control stops the technique for the covered slice of utilities, but leaves many non-utility avenues (direct API use in custom code, already-elevated processes) untouched.
T1134.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface runas/CreateProcessWithTokenW invocations when performed via such utilities, but the control does not require or address detection of the technique when performed by other means (e.g. direct API use from malware).
T1134.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged-token path to CreateProcessWithTokenW/runas on Windows but leaves non-utility vectors, non-Windows platforms, and incomplete implementation slices untouched.
T1134.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; token creation APIs such as LogonUser are typically surfaced through privileged utilities or monitored system-call activity, so the control surfaces the technique when it uses those utilities, but the clause's scope is limited to utility programs rather than all token-creation paths (e.g. direct API abuse from non-utility code).
T1134.003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the practical use of Windows APIs such as LogonUser/SetThreadToken that create and impersonate tokens, but does not stop an already-privileged adversary from calling them.
T1134.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; SID-History Injection is performed by such utilities (e.g. via domain admin tools that manipulate AD attributes), so the resulting logs can surface the anomalous privileged action, but this is only a slice of the technique's possible execution paths and does not guarantee detection of the injection itself.
T1134.005prevents — A.8.18 limits, authorizes, logs, segregates and removes privileged utilities that could be (and historically have been) used to perform SID-History injection; this constrains the technique on Windows but leaves a large remainder (non-utility tools, in-memory manipulation, already-elevated non-utility processes, and non-Windows platforms).
T1136prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could create accounts, so it stops the technique for many (but not all) platforms, account types and privilege levels where such utilities are the creation vector.
T1136.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1136.001 vectors (net user, useradd, dscl, esxcli, kubectl, CLI username commands) are exactly such utilities, so their execution is logged and therefore detectable, but the control is silent on log review, non-utility vectors, and post-creation account anomalies, leaving a genuine minority slice covered.
T1136.001prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging, time-bounding) stop many of the cited account-creation commands when they are treated as privileged utilities, but the technique can still succeed via non-utility paths, unmonitored management consoles, or when the adversary already holds sufficient non-utility privileges.
T1136.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the T1136.002 example of net user /add /domain is a privileged-utility action whose execution would be surfaced in those logs, but the control does not require monitoring or alerting on the logs nor does it address non-utility creation paths.
T1136.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that can create domain accounts), which stops many but not all paths to executing the technique
T1137prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains the subset of T1137 mechanisms that rely on installing or abusing privileged Office utilities/add-ins, but leaves the bulk of macro/template/rule/Home-Page abuses (which do not require privileged utilities) untouched.
T1137.001prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging) can stop an adversary from installing or modifying the template macro as a privileged action, but the technique's core (user-level template placement, registry hijack, or macro enablement) sits outside the privileged-utility boundary and is not reached by this control.
T1137.002prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain the ability to install and persistently execute an arbitrary DLL via the Office Test registry key (a privileged, Office-integrated mechanism), but do not block all vectors such as user-level registry writes or non-utility persistence paths.
T1137.003prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal, logging) can stop an adversary from installing or invoking a malicious Outlook form that overrides normal behavior, but the control is scoped to a narrow class of system-level utilities and does not address mailbox-level form customization that any authenticated Outlook user can perform.
T1137.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; malicious Outlook rules that trigger code execution qualify as abuse of such a utility, so the logging surfaces the technique when it runs, but the clause does not mandate monitoring/analysis of those logs or coverage of non-privileged rule abuse.
T1137.005prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; Outlook rules run in the mail-client context and can be installed/activated without invoking such a utility, so the control constrains only a minority slice of the technique (e.g. via removal of scripting utilities or strict least-privilege on rule-editing tools).
T1137.006prevents — A.8.18's limits on privileged utilities (auth, segregation, removal, logging) reach the slice of add-ins that qualify as privileged utilities, but most T1137.006 add-ins are user-level Office extensions that never invoke the privileged-utility controls.
T1140detects — A.8.18's logging of all privileged-utility use (item i) plus identification/authentication of their invocation surfaces when an adversary employs a system utility such as certutil, copy, or type to deobfuscate, but the control is silent on non-privileged utilities, built-in malware functionality, user-triggered actions, and non-utility mechanisms, leaving most of the technique undetected.
T1140prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could decode/deobfuscate), which stops many T1140 uses of system utilities; it leaves user-triggered, built-in malware, or non-privileged mechanisms untouched.
T1176.001prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging) can prevent some privileged-utility vectors for installing browser extensions (e.g. via profiles tool or file manipulation on compromised hosts), but most of the technique (social engineering, app-store masquerading, update-url manipulation, silent disk loading) does not rely on privileged utilities and is untouched.
T1185detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's need for high-integrity/SeDebugPrivilege rights and process injection into the browser makes its execution visible to such logging when a privileged utility is the vector, but the control does not address non-utility injection or proxy-pivoting methods.
T1185prevents — A.8.18 limits, authorizes, segregates, logs, and removes unnecessary privileged utilities (including those needing SeDebugPrivilege or admin rights for injection), which stops many but not all session-hijacking vectors described in the T1185 prose.
T1187detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; forced authentication via SMB/WebDAV/EFSRPC often surfaces through anomalous privileged-utility or network-authentication events that such logging (when aggregated and reviewed) can surface, but the control is silent on detection of the broader technique family, non-utility vectors, or real-time alerting.
T1197detects — A.8.18.i explicitly requires logging of all use of utility programs; BITSAdmin and PowerShell BITS cmdlets qualify as such utilities, so their abuse is surfaced in logs, but the technique can also be driven directly via COM without those tools and the control does not mandate monitoring of the BITS job database or COM activity itself.
T1197prevents — A.8.18's limits on privileged utility use (authz, least users, removal/disable, segregation, logging) can block abuse of BITSAdmin and similar privileged utilities, but the technique is also accessible via unprivileged PowerShell/COM interfaces that the control does not reach.
T1199prevents — A.8.18 limits, authorizes, segregates, logs and removes privileged utilities that could override controls, which constrains the elevated-access slice of T1199 (e.g. contractor accounts, delegated admin) but leaves the broader supply-chain trust, relationship abuse and initial compromise vectors untouched.
T1202detects — A.8.18.i explicitly requires logging of all use of utility programs, which surfaces abuse of privileged utilities (including those abused for indirect command execution) after the fact; this is genuine detection but only a minority slice of the technique, which also covers non-privileged utilities, WSL components, ssh.exe config abuse, and stealth subversions not tied to privileged-utility logging.
T1202prevents — A.8.18's restrictions on privileged utility programs (authorization, segregation, removal of unnecessary ones, logging) directly constrain the abuse of utilities like forfiles, pcalua.exe, scriptrunner.exe or ssh.exe that enable indirect command execution, but only for the privileged subset and leaves non-privileged or ad-hoc utilities as a large remainder
T1205.002prevents — A.8.18 limits, authorizes, logs, segregates and removes privileged utilities (including those that could install socket filters via libpcap/setsockopt), which stops the elevated-privilege step of the technique on covered utilities; it leaves the remainder of non-utility programs, non-privileged installation paths, and platforms where the technique does not require a privileged utility.
T1207prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain the admin/KRBTGT-level actions needed to register a rogue DC, but do not block the technique outright when those privileges are legitimately held.
T1210prevents — A.8.18 limits, authorizes, logs, segregates and disables privileged utilities that could be abused to exploit or escalate after remote-service compromise; this constrains the post-exploitation slice that relies on privileged utilities but does not stop the initial remote exploit of a vulnerable service.
T1211prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this stops many exploitation paths that rely on abusing or installing such utilities to hide activity or suppress logging, but leaves residual paths that do not involve privileged utilities at all (e.g. direct flaws in logging pipelines, SaaS, or unprivileged components).
T1216detects — A.8.18.i explicitly requires logging of all use of utility programs; the signed Microsoft scripts abused by T1216 are exactly such privileged utilities, so their proxy-execution use is logged and therefore detectable, but the control does not mandate monitoring/analysis of those logs nor cover non-utility-script vectors.
T1216prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain the trusted signed scripts that T1216 abuses for proxy execution, but only for a minority slice of such utilities rather than the dominant set of default Microsoft-signed LOLBins.
T1216.001detects — A.8.18.i explicitly requires logging of all use of utility programs; PubPrn.vbs is a signed Microsoft utility that can be abused for proxy execution, so its invocation is observable in logs (with the bounded remainder being silent/stealthy abuse that evades logging or occurs outside monitored scopes).
T1216.001prevents — A.8.18's limits on use/authorization/availability of privileged utilities, removal of unnecessary ones, and segregation directly constrain abuse of signed PubPrn.vbs as a living-off-the-land proxy; the Windows 10+ built-in protocol restriction is outside the control, leaving a genuine minority slice unaddressed.
T1216.002detects — A.8.18.i explicitly requires logging of all use of utility programs; SyncAppvPublishingServer.vbs is precisely such a privileged utility, so its abuse (including the proxy pattern) is surfaced in logs, but the control does not mandate monitoring/analysis of those logs nor detection of the specific living-off-the-land abuse.
T1216.002prevents — A.8.18's restrictions on privileged utilities (limit to trusted authorized users, authz, remove/disable unnecessary ones, segregate, log, time-bound availability) directly constrain abuse of the signed SyncAppvPublishingServer.vbs utility for proxying PowerShell, but only for the subset of environments and use-cases where those exact limitations are applied; many Windows systems ship with it enabled by default and the control does not mandate its removal.
T1218detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces proxy execution of malicious content via trusted binaries when those utilities are the vector, but the control does not mandate monitoring/analysis of the logs nor cover non-utility binaries or unlogged abuse.
T1218prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could proxy execution), which stops many abuse vectors for T1218; it leaves open the remainder of signed/trusted binaries that are not classified or treated as privileged utilities.
T1218.002detects — A.8.18.i explicitly requires logging of all use of utility programs; Control Panel items (including malicious .cpl proxies) are utilities that can override controls, so their use is surfaced in logs, but this is only a slice of the full technique (delivery, registration, renaming, non-CPlApplet DllEntryPoint execution) and depends on what the implementer actually logs/monitors.
T1218.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that override controls), which constrains abuse of control.exe/CPL items as a privileged utility; however, it is a practice-setting clause whose coverage depends on implementation rigor and leaves many delivery/registration vectors (phishing, multi-stage, renamed DLLs) untouched.
T1218.003detects — A.8.18.i explicitly requires logging of all use of utility programs; CMSTP.exe is a signed privileged Windows utility that can be monitored for anomalous invocation with malicious INF parameters, but the control does not mandate specific detection content, correlation, or coverage of all abuse vectors such as UAC bypass.
T1218.003prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain abuse of CMSTP.exe as a signed privileged binary for proxy execution, but do not block all legitimate uses or all bypass vectors such as UAC.
T1218.004detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface InstallUtil executions (especially ad-hoc or anomalous ones) after the fact; this is genuine detection of the technique but only a slice, as the clause does not mandate monitoring, alerting, or analysis of those logs.
T1218.004prevents — A.8.18's restrictions on privileged utility programs (authorization, unique identification, limiting availability, segregation, disabling unnecessary ones) constrain the trusted signed InstallUtil binary's use for proxy execution or app-control bypass, but only for a minority slice (managed/authorized use) while the dominant LOLBAS living-off-the-land pattern on unmanaged Windows systems remains unreached.
T1218.005detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface mshta.exe abuse when it occurs within the logged scope, but the control does not mandate monitoring/analysis of those logs nor cover all possible invocation methods or non-utility contexts.
T1218.005prevents — A.8.18's guidance (limit use to trusted authorized users, authz procedures, remove/disable unnecessary utilities, segregate, limit availability to authorized changes) directly constrains abuse of mshta.exe as a privileged utility, but leaves residual paths via authorized admins, ad-hoc use, or utilities not removed.
T1218.007detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface msiexec.exe abuse when it occurs; this is genuine detection but only a slice because the clause does not mandate monitoring, alerting, or analysis of those logs, nor does it reach non-logged or out-of-scope executions.
T1218.007prevents — A.8.18's restrictions on privileged utilities (authz, least use, removal/disable, segregation, logging) directly constrain abuse of msiexec.exe as a signed privileged utility for proxy execution, but only for the subset of mitigations that can be applied to a built-in Windows binary that cannot be fully removed.
T1218.008detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface odbcconf.exe abuse when it occurs within the logged scope, but the control does not mandate monitoring/analysis of those logs or coverage of all possible execution contexts.
T1218.008prevents — A.8.18's restrictions on privileged utilities (authorization, unique ID, limiting availability, removal of unnecessary ones, segregation) constrain abuse of signed binaries like odbcconf.exe for proxy execution, but only for utilities under organizational control and where application-control bypass is not already latent in approved tools.
T1218.009detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface Regsvcs/Regasm execution (a signed but abused utility) when the control is implemented; this is genuine detection of the technique but only a slice, as the clause does not mandate monitoring of the technique's specific behaviors, attributes, or downstream effects.
T1218.009prevents — A.8.18's limitations on use, authorization, segregation, removal/disabling and logging of privileged utilities directly constrain abuse of signed Windows utilities like Regsvcs/Regasm for proxy execution, but only for the subset of instances where the utility is unnecessary, can be fully disabled or is subject to the organization's authorization/segregation rules; many such utilities remain required and available on Windows.
T1218.010detects — A.8.18.i explicitly requires logging of all use of utility programs; Regsvr32 is a signed Windows utility that can be abused for proxy execution, so the mandated logging surfaces its invocation (and can be correlated to anomalous arguments/URLs), but the control does not require monitoring of the loaded modules, COM scriptlet behavior, or network activity that realizes the technique.
T1218.010prevents — A.8.18's limits on privileged utility use (authorization, unique ID, removal/disabling of unnecessary ones, segregation, temporary availability, logging) constrain abuse of signed binaries like Regsvr32 for proxy execution and bypass, but only for a minority slice (trusted/admin users and ad-hoc invocation) while leaving user-permission Squiblydoo and normal Windows allowlist evasion untouched.
T1218.011detects — A.8.18.i explicitly requires logging of all use of utility programs; rundll32.exe is a signed Windows utility that can proxy malicious execution, so its use (and many of the described variants) can be surfaced by reviewing those logs, but the control does not mandate monitoring, alerting, or coverage of the full range of proxying, masquerading, or ordinal/character-set tricks.
T1218.011prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain abuse of rundll32.exe as a privileged proxy but leave many legitimate uses and evasion variants (masquerading, ordinal loads, signed system DLLs) intact.
T1218.012detects — A.8.18.i explicitly requires logging of all use of utility programs; verclsid.exe is a signed native Windows utility that can be abused for proxy execution, so its invocation is observable in logs (with the bounded remainder being use that evades or is outside the implemented logging scope).
T1218.012prevents — A.8.18's restrictions on privileged utilities (authorization, unique ID, limiting availability, segregation, removal of unnecessary ones) constrain abuse of signed native binaries like verclsid.exe when treated as such utilities, but do not stop all proxy-execution paths or non-privileged COM abuse vectors.
T1218.013detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface mavinject.exe execution (a signed LOLBin abused for injection) when it occurs; this is genuine detection of the technique but only a slice, as the control does not mandate monitoring of the injection behavior itself, command-line args, or process-injection telemetry.
T1218.013prevents — A.8.18's restrictions on privileged utilities (limit to trusted users, authz, disable unnecessary ones, segregate, log, time-bound use) directly constrain abuse of mavinject.exe as a signed Windows utility for DLL/import injection, but only for a minority slice (managed environments that can remove/disable it or enforce strict least-privilege); the dominant built-in availability on Windows and signed-trusted status leave most instances reachable.
T1218.014detects — A.8.18.i explicitly requires logging of all use of utility programs; MMC.exe is a privileged utility that can override controls, so its abuse (including proxying malicious .msc) is surfaced in logs, but this is only a slice because the control does not mandate monitoring, alerting, or analysis of those logs.
T1218.014prevents — A.8.18's restrictions on privileged utilities (authz, least use, removal/disable, segregation, logging) directly constrain abuse of mmc.exe as a signed privileged utility for proxy execution, but only for the subset of techniques that rely on the utility itself rather than the .msc/CLSID payload or downstream effects like T1490.
T1219prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains many legitimate remote management tools (especially those installed post-compromise or used as malware components) from running with inherited privileges, but leaves untouched built-in OS features, EDR response channels, and non-privileged instances that adversaries also abuse.
T1219.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; IDE tunneling tools (CLI wrappers, extensions, or built-in remote features) are a form of utility that can override controls and would therefore be logged when used under this clause, surfacing the technique after the fact, but the clause does not require monitoring/analysis of those logs nor does it reach non-privileged or non-utility forms of the technique.
T1219.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; IDE tunneling tools (built-in or extensions) are a subset of such utilities on dev systems, so their abuse is prevented where those measures are applied, but the control is scoped only to privileged utilities (not all IDE features or non-privileged tunneling) leaving a large remainder.
T1219.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1219.002 tools (VNC, TeamViewer, AnyDesk, RMM) qualify as such utilities when used for remote control, so their invocation can be surfaced in logs, but the control does not mandate monitoring/analysis of those logs nor cover non-privileged or built-in remote-desktop modules.
T1219.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains many RMM/desktop-support tools when they qualify as such utilities, but leaves a large slice (built-in OS RMM features, non-privileged tools, or tools allowed by policy) untouched.
T1220detects — A.8.18.i explicitly requires logging of all use of utility programs; the msxsl.exe and wmic /FORMAT invocations are exactly such privileged-utility usage and would be surfaced in those logs, but the control does not require host/process/command-line monitoring beyond that narrow slice and does not address the Squiblytwo WMI alias path when no separate utility binary is invoked.
T1222detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1222 instances rely on such utilities (icacls, chmod, chown, takeown, fsutil, etc.), so the resulting logs surface the technique when it uses those tools, but the control is silent on non-utility vectors and on actual analysis of the logs.
T1222prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the elevated-privilege slice of T1222 (taking ownership or using tools like icacls/chmod) but leaves ordinary-owner permission changes and many non-utility vectors untouched.
T1222.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the primary tools named for T1222.001 (icacls, cacls, takeown, attrib, and PowerShell cmdlets) are exactly such utilities, so their invocation is logged and thereby surfaces the technique when it runs.
T1222.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that can alter ACLs like icacls/takeown), which stops many Windows permission-modification attacks at source; it leaves open the remainder of unprivileged or in-band tools (attrib, PowerShell cmdlets) and non-utility vectors that still achieve the same T1222.001 outcome.
T1222.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; chown/chmod are the canonical privileged utilities that implement T1222.002 on Linux/macOS, so their invocation is surfaced in logs, but this is only a slice of the technique (no coverage of non-utility vectors, in-memory changes, or unlogged abuse of already-elevated rights).
T1222.002prevents — A.8.18's restrictions on privileged utilities (auth, least use, segregation, removal of unnecessary ones, logging) constrain adversary use of chown/chmod when those are treated as privileged utilities, but do not stop permission modification by ordinary users or unprivileged processes that already hold write access.
T1482detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; because the technique is canonically executed via the privileged Windows utility nltest, that logging surfaces the specific actor and command that performed domain trust discovery.
T1484detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1484 vectors (GPO edits, trust changes, rogue DC setup) are performed via such utilities whose invocation can therefore be surfaced in logs, but the control does not require monitoring/analysis of those logs nor does it reach non-utility vectors such as direct API or UI changes to tenant policy.
T1484prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this reaches the subset of T1484 that abuses privileged utilities (e.g. GPO editors or trust-management tools) but leaves the bulk of the class (ordinary admin accounts, API calls, or non-utility vectors) untouched.
T1484.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many real-world GPO modifications (e.g. via New-GPOImmediateTask, PowerShell, or direct SYSVOL edits) are performed with or invoke such utilities, so the resulting logs can surface the technique, but the control does not mandate monitoring/analysis of those logs nor cover non-utility vectors, leaving a large remainder.
T1484.001prevents — A.8.18's restrictions on privileged utilities (authz, least use, segregation, removal, logging) constrain the tools and accounts that can modify GPOs, but do not stop an already-authorized admin or delegated writer from performing the modification, nor do they address the AD-level ACLs on the GPO objects themselves.
T1484.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1484.002 vectors (e.g. AD FS claim-rule changes, new IdP registration, trust-property edits) are performed via such utilities or their administrative interfaces, so the control surfaces the activity when it occurs, but only for the subset that routes through monitored privileged utilities rather than direct API, GUI, or non-utility paths.
T1484.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the subset of T1484.002 that relies on privileged utilities (e.g. AD FS cmdlets, federation config tools) but leaves the bulk of trust manipulation (GUI, API, cloud console, or non-utility vectors) untouched.
T1485detects — A.8.18 item i) explicitly requires logging of all use of privileged utility programs; many T1485 executions (overwriting via utilities, deletion via admin tools, or propagation via credentialed shares) would be surfaced by that logging when the utilities involved are the privileged ones the control governs, but the technique is not limited to such utilities and many vectors (native delete APIs, cloud console deletions, non-utility malware) remain unseen.
T1485prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be (ab)used to destroy data, thereby stopping many but not all T1485 execution paths (e.g. standard user-level delete commands, cloud API calls, or unlisted utilities remain possible).
T1489detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1489 instances (esp. on Windows/Linux via sc, systemctl, net stop, or privileged tools) are observable in those logs, but the control does not require monitoring/alerting on the logs nor does it reach non-utility/cloud API paths such as DisableAPIServiceAccess.
T1489prevents — A.8.18's limits on privileged utility use (authz, segregation, removal/disable of unnecessary ones, time-bounding) stop many common service-stop methods that rely on such utilities, but the technique has multiple non-utility vectors (API calls, cloud IAM, direct process kills) that the control does not address.
T1490detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface the native Windows utilities (vssadmin, wbadmin, bcdedit, etc.) that are the dominant documented execution path for T1490; this is genuine detection of the technique in flight on covered platforms but only a slice because the control is silent on non-utility vectors (cloud API calls, ESXi vim-cmd, network device commands, direct file deletion of backups) and on whether those logs are actually monitored or alerted.
T1490prevents — A.8.18's restrictions on privileged utilities (authz, least use, removal/disable, segregation, logging) directly constrain the native Windows and ESXi utilities (vssadmin, wbadmin, bcdedit, REAgentC, diskshadow, vim-cmd) that adversaries rely on for T1490, but do not address non-utility vectors such as cloud API disablement of versioning/backups, WMI, network-device disk-wipe+reboot sequences, or online/cloud backup deletion.
T1491.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many forms of internal defacement (e.g. altering login messages, wallpapers, or web content on Linux/Windows/ESXi) require privileged utilities, so the mandated logs surface the technique when it runs, but the control is silent on non-utility vectors, non-privileged changes, and log review/monitoring, leaving a large slice of the technique unreached.
T1495prevents — A.8.18's limits on privileged utility use (auth, least users, removal/disable, segregation, logging) block many vectors that would let an adversary run the firmware-overwriting utility, but firmware corruption on some platforms (e.g. network devices, pre-boot, or via non-utility means) sits outside the utility-program boundary.
T1496.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; crypto-mining hijacking is commonly implemented via such utilities (or via processes that behave like them), so the logging surfaces the anomalous compute consumption, but the control is silent on monitoring for the consumption pattern itself or on non-utility vectors and therefore covers only a slice of the technique.
T1505detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface adversary installation of malicious server components that rely on such utilities; this is genuine but only a slice of the broad technique (many extensible server features and installation vectors do not involve privileged utilities).
T1505prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the installation path for malicious server components on many (but not all) platforms and in many (but not all) deployment patterns, leaving a genuine minority slice (e.g. built-in extension mechanisms, network-device scripting, or already-installed utilities) unreached.
T1505.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could enable or invoke malicious stored procedures such as xp_cmdshell or CLR assemblies), which stops many but not all paths to creating or activating them as persistence.
T1505.002prevents — A.8.18's limits on privileged utility use (authorization, unique ID, removal/disabling of unnecessary ones, segregation, temporary availability) constrain registration and invocation of a malicious transport agent as a privileged utility, but only for a minority slice of the class (Exchange-specific, post-compromise agent registration on Windows; most T1505.002 vectors and Linux cases untouched).
T1505.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; web shells are a form of privileged backdoor that typically rely on such utilities or provide equivalent command-line execution, so the logging surfaces their presence or activity, but only for the subset of web shells that trigger utility-program instrumentation rather than all instances or variants.
T1505.003prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) stop many ways an adversary could install/activate a web shell that relies on elevated or utility-like capabilities, but web shells can be simple non-privileged scripts dropped via other vectors (e.g. app vuln) that the control does not address.
T1505.004prevents — A.8.18's restrictions on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain installation and use of malicious IIS components that act as privileged extensions, but do not stop all vectors (e.g. already-installed modules, non-utility install paths, or authorized admins).
T1505.005detects — A.8.18.i explicitly requires logging of all use of utility programs; replacing or patching termsrv.dll (a privileged system component) would typically be performed via utilities whose execution is logged, surfacing the adversary action after the fact.
T1505.005prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain the ability to replace/patch termsrv.dll or alter its ServiceDll registry value as a privileged operation, but do not stop all such modifications (e.g. via other vectors or on exempted systems).
T1505.006detects — A.8.18.i explicitly requires logging of all use of utility programs; VIB installation and related privileged esxcli activity are utility-program actions whose abuse would be surfaced in those logs, but the control does not require monitoring/analysis of the logs nor does it address non-utility aspects of the technique such as descriptor tampering or payload execution after install.
T1505.006prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities (including those that could install or override controls), which stops many but not all ways an adversary can introduce and abuse a malicious VIB on ESXi.
T1518.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains the subset of discovery commands that are themselves privileged utilities (e.g. certain tasklist/netsh/reg runs under elevated rights), but leaves ordinary user-level discovery commands (dir, cloud API calls, unprivileged process listing) untouched.
T1518.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's listed discovery commands (netsh, reg query, dir, tasklist) are exactly the sort of privileged utilities whose execution would be logged, surfacing the attempt after the fact on covered systems.
T1528prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging) can block some token-theft vectors that rely on compromised utilities or service accounts, but most of the technique (OAuth phishing, IMDS requests, container compromise, CI/CD pipeline theft) occurs outside any privileged-utility boundary.
T1529detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; shutdown/reboot commands and privilege acquisition (SeShutdownPrivilege) are often performed via such utilities, so the logging surfaces the technique when it uses them, but many execution paths (direct APIs, hypervisor consoles, non-utility CLI) sit outside this control.
T1529prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including shutdown/reboot commands that require SeShutdownPrivilege or equivalent), so the technique cannot run for the covered slice of authorized users and unnecessary utilities; it leaves the remainder of already-authorized admins, hypervisor/cloud consoles, and in-memory API paths untouched.
T1530prevents — A.8.18 limits, authenticates, authorizes, logs, segregates and disables privileged utilities that could override controls, which prevents the technique when it would rely on abusing such utilities (e.g. to escalate or bypass IAM), but leaves the dominant misconfiguration and leaked-credential vectors untouched.
T1531detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface adversary use of utilities such as net, passwd, esxcli or PowerShell cmdlets to manipulate accounts, but the control does not require monitoring or analysis of those logs to surface the T1531 behavior itself.
T1531prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those named in the T1531 procedure examples such as net, passwd, esxcli and PowerShell account cmdlets), which stops many legitimate-privilege-abuse paths the technique relies on; it does not stop all abuse vectors (e.g. already-elevated ransomware, Group Policy, or non-utility mechanisms) so the coverage is a genuine but bounded slice.
T1539detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; several T1539 vectors (local malware, browser process memory access, JS injection) rely on privileged utilities or can be surfaced by their audit logs, but network/proxy/AiTM vectors, disk scraping without utilities, and post-theft use of the cookie lie outside this control's view.
T1542.003prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal/disabling, logging, and time-bounding) constrain the raw boot-sector/ESP writes that install a bootkit, but only for utilities that are recognized and governed; direct kernel-mode or firmware-level writes, non-utility vectors, and pre-OS execution sit outside its reach.
T1542.004prevents — A.8.18's limits on privileged utility use (auth, authorization levels, removal/disabling of unnecessary ones, segregation, temporary availability, logging) constrain the ability to load/upgrade unauthorized ROMMON firmware on network devices, but only for a minority slice of the technique (local authorized use of utilities); remote TFTP-based overwrite, boot-time ROMMON replacement, and supply-chain firmware attacks sit outside its scope.
T1542.005prevents — A.8.18's limits on privileged utilities (authz, segregation, removal/disable, logging, time-bound use) constrain the admin-level configuration changes and TFTP server manipulation that enable unauthorized netboot, but leave open network-device boot sequences, non-utility vectors, and physical/ROMMON-like paths outside its scope.
T1543detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; creating or modifying system processes (services/daemons/agents) is a privileged operation that would ordinarily invoke such utilities, so the resulting logs surface the technique when it occurs, but this is only one narrow slice of possible T1543 vectors and the control itself does not mandate analysis or alerting on those logs.
T1543prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging) constrain the admin/root access needed to install or alter system services/daemons, but do not stop all vectors (e.g. unprivileged launch agents, in-memory mods, or non-utility mechanisms) on all platforms.
T1543.001detects — A.8.18.i explicitly requires logging of all use of utility programs; launch agents are commonly manipulated via the launchctl utility (explicitly referenced in the T1543.001 prose), so the mandated logging would surface anomalous or unauthorized use of that utility on macOS, but the control does not require monitoring of the .plist files themselves or non-utility vectors and its scope is limited to privileged utilities rather than all persistence mechanisms.
T1543.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could install/modify launch agents), which stops many but not all instances of this user-level persistence technique on macOS.
T1543.002detects — A.8.18.i explicitly requires logging of all use of utility programs; systemd generators and systemctl are privileged utilities whose use (including creation/modification of .service files) would be logged, surfacing the technique after the fact, but this is only one slice of the class (no requirement to monitor for anomalous service behavior, symbolic links, or generator output itself).
T1543.002prevents — A.8.18's limits on privileged utility use (auth, authorization, removal/disabling, segregation, logging, time-bounding) constrain many of the privileged executables and generators that adversaries abuse to create or alter systemd .service files, but do not stop unprivileged user-level unit creation in $HOME or all generator-based persistence.
T1543.003prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities (including those that could create/modify services), which stops many of the technique's utility-based and driver-installation vectors, but leaves direct Registry, API, and already-present privileged utilities reachable.
T1543.004detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; Launch Daemon creation/modification on macOS is a privileged administrative action typically performed via utilities (launchctl, plutil, file-system tools), so the mandated logs can surface the technique when reviewed, but this is only a slice because the control does not mandate monitoring of the specific plist paths, daemon execution artifacts, or anomalous startup behavior.
T1543.004prevents — A.8.18's restrictions on privileged utilities (authorization, unique ID, limiting use/availability, segregation, removal of unnecessary ones, and logging) constrain the elevated-privilege steps needed to install or modify a Launch Daemon plist and its referenced executable, but leave open paths such as poor configurations enabling write access or use of already-trusted utilities that adversaries can hijack.
T1543.005detects — A.8.18.i explicitly requires logging of all use of utility programs; container management tools (docker, podman, kubelet) are privileged utilities whose modification/use would be surfaced in those logs, but this is only a slice of the full technique surface (e.g. does not instrument the resulting DaemonSet or restart=always side-effects themselves).
T1543.005prevents — A.8.18's restrictions on privileged utilities (authz, least use, removal/disable, segregation, logging) directly constrain the privileged/rootful use of docker/podman/kubelet commands and services that the technique relies on, but only for a minority slice of the technique's surface (ad-hoc privileged execution); most of the class lives in container orchestration, DaemonSets, persistent restart configs, and service modifications that sit outside the utility-program framing.
T1546detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface many (but not all) T1546 abuse cases that rely on privileged utilities or event mechanisms they control; the remainder (non-utility triggers, unlogged cloud/SaaS paths, or non-privileged execution) is outside its scope.
T1546prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be abused to create/modify event triggers or run them with elevated rights, blocking many but not all T1546 vectors (e.g. unprivileged triggers, non-utility mechanisms, or already-installed triggers).
T1546.001prevents — A.8.18's limits on privileged utility use (auth, authorization levels, removal/disabling of unnecessary ones, segregation, temporary availability) constrain admin-level abuse of assoc and similar utilities to change file associations, but do not stop non-privileged users, applications, or Registry-direct edits that the technique also explicitly allows.
T1546.002detects — A.8.18.i explicitly requires logging of all use of utility programs; screensaver execution (a privileged utility that can be repurposed for persistence) is observable in logs when the control is applied, but the clause does not mandate monitoring/analysis of those logs or detection of the specific registry manipulation or malicious .scr path.
T1546.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could override controls like a malicious screensaver PE), which stops many instances of this persistence technique from being introduced or executed, but leaves a remainder where the screensaver is not treated as a privileged utility or where the attacker already has the necessary authorized access.
T1546.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; mofcomp.exe (the cited compiler for malicious WMI subscriptions) and WMI Provider Host (WmiPrvSe.exe) qualify as such utilities on Windows, so their invocation is logged and therefore detectable, but the control reaches only this narrow slice of the technique rather than the broader event-subscription surface.
T1546.003prevents — A.8.18's limits on privileged utilities (authorization, unique ID, logging, removal of unnecessary ones, segregation) constrain the privileged execution path that T1546.003 relies on for installing and triggering malicious WMI subscriptions, but do not block the core WMI event mechanism itself or non-utility vectors.
T1546.004prevents — A.8.18's limits on who may run privileged utilities, its authentication/authorization requirements, its removal-or-disable clause, its segregation rules, and its logging all constrain the root-level modification of /etc/profile and similar system files that the technique requires; they do not constrain user-owned dotfiles (~/.bash_profile, ~/.zshrc, etc.) that the same technique routinely abuses for persistence.
T1546.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the described technique relies on tools that modify Mach-O binaries (a privileged operation on macOS), so the mandated logging would surface that activity when performed with such utilities, but the control does not address non-utility, non-privileged, or in-memory variants of the technique.
T1546.007detects — A.8.18.i explicitly requires logging of all use of utility programs; netsh.exe is a utility program whose helper-DLL registration and subsequent execution are observable events that can be surfaced by that logging (or by monitoring for anomalous netsh activity), but the clause does not mandate collection, analysis or alerting on the specific registry path or DLL-load artifact, leaving most real-world detections outside its direct scope.
T1546.007prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain abuse of netsh.exe itself as a privileged utility, but do not block the registry-based registration of a malicious helper DLL that can be triggered by any netsh execution.
T1546.008detects — A.8.18.i explicitly requires logging of all use of utility programs; accessibility-feature hijacking (binary replacement or registry pointer changes to sethc.exe/utilman.exe/etc.) is a form of privileged-utility abuse that would appear in those logs, but the control does not require monitoring or alerting on the logs and many of the technique's variants (e.g. IFEO debugger injection) sit outside the utility-program boundary.
T1546.008prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling of unnecessary ones, logging) constrain abuse of the accessibility binaries that are themselves privileged utilities, but do not stop registry pointer changes, debugger injection workarounds, or binary replacement of the listed features.
T1546.009detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; AppCert DLL abuse is a form of privileged utility/program execution that would be surfaced in such logs when the technique runs, but the control does not mandate monitoring or analysis of those logs for this specific behavior.
T1546.009prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain abuse of the AppCertDLLs registry mechanism when it is treated as a privileged utility, but do not block the core technique of registering a malicious DLL for ubiquitous process loading.
T1546.010detects — A.8.18.i explicitly requires logging of all use of utility programs; AppInit DLL registration and loading can be surfaced by that logging plus the identification/authentication procedures in b), but this is only a slice of the technique's full surface (registry writes, process injection-like behavior, persistence without obvious utility-program invocation).
T1546.010prevents — A.8.18's limits on privileged utility use, authorization, segregation, disabling of unnecessary utilities, and logging constrain abuse of registry-controlled DLL loading mechanisms that require privileged modification and execution, but do not block the underlying AppInit_DLLs registry values or secure-boot bypasses.
T1546.011detects — A.8.18.i explicitly requires logging of all use of utility programs; because application shimming (including malicious shim installation/activation) is performed via the privileged utility sdbinst.exe and related mechanisms, the mandated logging surfaces the technique when it occurs, but only for the subset of shim activity that routes through logged utilities rather than all possible persistence or UAC-bypass uses.
T1546.011prevents — A.8.18's limits on privileged utility use (auth, least users, removal/disable, segregation, logging) constrain admin-only shim installation and ad-hoc execution that T1546.011 requires, but do not block legitimate shim use, custom .sdb creation by authorized admins, or the core compatibility mechanism itself.
T1546.012detects — A.8.18.i explicitly requires logging of all use of utility programs; IFEO debuggers are a form of privileged utility that can be monitored via process creation, registry changes, or execution logs, but the control does not mandate specific detection of the technique's abuse vectors such as silent-exit monitors or accessibility backdoors.
T1546.012prevents — A.8.18 limits privileged utility use (auth, segregation, removal of unnecessary ones, logging) which constrains some IFEO abuse vectors that rely on installing or invoking debuggers/monitor programs as privileged utilities, but leaves the bulk of the technique (registry modification of IFEO values by any process with write access) untouched.
T1546.013detects — A.8.18.i explicitly requires logging of all use of utility programs; PowerShell profiles are a form of utility that can be abused for persistence/privilege escalation, so the mandated logging can surface the anomalous modification or execution in monitored environments, but the control does not require monitoring of profile content or execution itself and leaves many profile uses outside its scope.
T1546.013prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain the ability to modify and abuse PowerShell profiles as a privileged mechanism, but do not stop profile modification outright (especially for non-privileged users or via indirect means).
T1546.014detects — A.8.18.i explicitly requires logging of all use of utility programs; emond is a privileged utility/daemon whose rule loading and triggered actions are observable events that such logging (plus associated monitoring) would surface, but the control does not mandate coverage of plist rule writes, non-utility precursors, or all macOS-specific emond artifacts.
T1546.014prevents — A.8.18's limits on privileged utilities (authz, unique ID, segregation, removal of unnecessary ones, logging) constrain abuse of emond as a privileged utility that can run rules, but do not stop an admin from writing a rule or fully block the persistence path on macOS
T1546.015prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging) constrain the privileged changes needed to hijack COM registry references, but do not block the core technique of registry tampering itself nor reach non-privileged COM hijacks.
T1546.016detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface anomalous or unauthorized installer-package activity (especially when those packages act as privileged utilities), but the control does not mandate monitoring, alerting, or analysis of those logs and leaves many installer-script executions outside its scope.
T1546.016prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including installer scripts that run as root or with inherited elevated permissions), which stops many but not all abuse paths for T1546.016 (e.g. unmodified legitimate installers still require user-granted admin rights and ad-hoc authorized use remains possible).
T1546.017detects — A.8.18.i explicitly requires logging of all use of utility programs; udev rule modification/creation is a privileged utility action that would be logged, surfacing the T1546.017 technique after the fact, but the clause does not mandate monitoring, alerting, or coverage of the full attack surface (e.g. rule execution vs. only use).
T1546.017prevents — A.8.18's rules on limiting, authorizing, logging, segregating, and disabling utility programs (including those that can override controls) constrain root-level abuse of udev rule files as a privileged utility, but do not block all vectors such as ad-hoc authorized changes or non-utility udev mechanisms.
T1546.018detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; Python startup hooks can be abused via privileged utilities (e.g. pip, python itself when run with elevated rights), so the mandated logging would surface the abuse in those cases, but the control is silent on non-privileged interpreter invocation or on .pth/module inspection and does not require monitoring of the hook files themselves
T1546.018prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain abuse of Python startup hooks when they are treated as privileged utilities, but the control does not address non-privileged Python environments or the automatic interpreter startup mechanism itself.
T1547detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1547 mechanisms (registry changes, kernel module loads, autostart placement) are performed via such utilities, so the logging surfaces the technique when it uses them, but this is only a slice of T1547 vectors (e.g. direct file drops, non-utility boot mechanisms) and does not guarantee detection of the persistence itself.
T1547prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be (ab)used to install or modify boot/logon autostart mechanisms, thereby stopping many but not all instances of the technique (e.g. those using only standard user rights, kernel modules outside utilities, or already-installed autostart before the control is applied).
T1547.001detects — A.8.18.i explicitly requires logging of all use of utility programs; many T1547.001 realizations involve privileged utilities (reg.exe, icacls, etc.) whose invocation can therefore be surfaced in logs, but the control does not require monitoring of the registry keys or startup folders themselves and many non-utility vectors remain unseen.
T1547.001prevents — A.8.18's restrictions on privileged utilities (authorization, segregation, removal, logging) constrain admin-level abuse of registry/run-key mechanisms that require elevated rights, but do not stop user-context persistence via per-user run keys, startup folders, or non-privileged writes.
T1547.002prevents — A.8.18's restrictions on privileged utilities (auth, authorization, limiting use/availability, segregation, removal of unnecessary ones) constrain abuse of LSA authentication package registration as a privileged mechanism, but do not block the core Registry write or DLL loading at boot for all cases.
T1547.003detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; time-provider registration is an administrative act that would be captured in such logs (or in associated privileged-utility monitoring), surfacing the abuse, but the clause does not mandate detection of the resulting boot-time DLL execution itself or of non-utility aspects of the technique.
T1547.003prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain abuse of the time-provider registration path that requires admin rights, but do not block all legitimate utilities or the underlying registry mechanism itself.
T1547.004detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; Winlogon Helper DLL abuse registers malicious DLLs/executables that are then loaded and executed by the privileged Winlogon process, so the logging surfaces the anomalous use of that privileged mechanism.
T1547.004prevents — A.8.18's restrictions on privileged utilities (authz, least use, segregation, removal of unnecessary ones, logging) constrain abuse of Winlogon helper mechanisms that rely on privileged registry-driven execution at logon, but do not reach all vectors (e.g., user-writable HKCU paths or already-installed helpers) and are not specific to this persistence class.
T1547.005detects — A.8.18.i explicitly requires logging of all use of utility programs; SSP abuse can be surfaced by monitoring for anomalous registry writes to the two LSA Security Packages keys or for unexpected DLL loads into LSA, but the control does not mandate instrumentation depth or scope and many implementations will not log or alert on these specific events.
T1547.005prevents — A.8.18's limits on privileged utilities (authz, segregation, removal of unnecessary ones, logging) constrain abuse of SSP loading as a privileged mechanism, but do not block the core Registry/API modification path that adds an SSP.
T1547.006detects — A.8.18.i explicitly requires logging of all use of utility programs; kernel module loaders (kextload, insmod, modprobe, etc.) are privileged utilities whose execution can therefore be surfaced in logs, but the control does not require detection of the malicious payload/behavior once loaded.
T1547.006prevents — A.8.18's limits on who may run privileged utilities, its authentication/authorization requirements, its removal-or-disable clause, its segregation rules, and its time-bound availability directly stop many malicious LKM/kext loads that would otherwise be possible with ordinary user rights or unvetted tools.
T1547.008detects — A.8.18.i explicitly requires logging of all use of utility programs; LSASS driver addition/replacement is a privileged utility action that would be surfaced in those logs, but the control does not mandate monitoring/analysis of the logs nor does it address non-utility vectors such as direct registry or file-based driver hijacks.
T1547.008prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain the ability to add/replace LSASS drivers as a privileged operation, but do not stop all vectors such as initial compromise or non-utility hijacks.
T1547.009prevents — A.8.18's limits on who may run privileged utilities, segregation, removal of unnecessary ones, and logging of use constrain the ability of an adversary to create or modify startup shortcuts that require elevated rights or cross segregation boundaries, but do not stop all shortcut abuse (e.g. user-level .lnk files in a startup folder).
T1547.010detects — A.8.18.i explicitly requires logging of all use of utility programs; port monitor registration (AddMonitor or direct Registry writes to Print\Monitors) is a privileged-utility action that would be logged when the control is applied, surfacing the technique after the fact, but the clause does not mandate monitoring of the resulting boot-time DLL load itself or of non-utility precursors.
T1547.010prevents — A.8.18's limits on privileged utility use (auth, least users, removal/disabling, segregation, time-bounding, logging) constrain the privileged mechanisms (AddMonitor, registry writes to Print\Monitors) an adversary must abuse to install a boot-loaded port-monitor DLL, but do not block the underlying persistence vector when those utilities remain available to authorized admins.
T1547.012detects — A.8.18.i explicitly requires logging of all use of utility programs; a print processor registered via registry or AddPrintProcessor API (especially with SeLoadDriverPrivilege) is a privileged utility whose installation/use would be surfaced in the mandated logs, but this is only a slice of the full technique (no requirement for real-time anomaly detection, spoolsv.exe monitoring, or coverage of non-utility aspects).
T1547.012prevents — A.8.18's limits on privileged utility use (authz, segregation, removal of unnecessary ones, logging) constrain abuse of the print-spooler print-processor mechanism when treated as a privileged utility, but do not block the core registry/API registration path or the SYSTEM-level boot-time load that defines the technique.
T1547.013detects — A.8.18.i explicitly requires logging of all use of utility programs; XDG Autostart abuse can be surfaced by monitoring for anomalous .desktop file creation/modification or Exec directives in the monitored autostart directories, but this is only a slice (depends on what the org logs and reviews, and does not inherently cover masqueraded or non-utility cases).
T1547.014detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; this surfaces anomalous or unauthorized registry changes under Active Setup when performed via such utilities, but the technique itself does not require them and can be performed without triggering this logging.
T1547.014prevents — A.8.18's limits on privileged utility use, authorization, logging, segregation, and disabling unnecessary ones constrain the privileged execution step of a T1547.014 payload (especially if the StubPath invokes a utility), but do not stop the adversary from writing the HKLM Active Setup Registry key itself.
T1547.015prevents — A.8.18's limits on privileged utilities (authz, least use, removal/disable, segregation, logging) constrain the privileged mechanisms (AppleScript to System Events, SMLoginItemSetEnabled, launchd manipulation) an adversary must abuse to install a malicious login item, but do not stop non-privileged user-level login-item creation that still achieves persistence.
T1548prevents — Restricting and logging privileged utility programs directly limits an adversary's ability to abuse elevation mechanisms such as sudo, UAC bypasses, or setuid binaries.
T1548detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces abuse of elevation mechanisms when those utilities are the vector; this is genuine detection but only a slice of T1548 (other sub-techniques such as UAC bypass, sudo caching, or token manipulation do not involve utility programs at all).
T1548.001detects — A.8.18.i explicitly requires logging of all use of utility programs, which surfaces abuse of setuid/setgid binaries (a privileged-utility pattern) when it occurs; this is genuine detection but only a slice of the full technique surface (finding setuid bits, pre-setting on malware, non-utility vectors).
T1548.001prevents — A.8.18's limits on utility-program use, authorization, segregation, removal of unnecessary utilities, and logging constrain both creation of new setuid/setgid binaries and their abuse as privileged utilities, but do not stop an adversary from locating and exploiting already-present vulnerable setuid binaries (the technique's dominant discovery-and-abuse path).
T1548.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface many (but not all) UAC-bypass techniques that rely on or invoke such utilities (e.g. eventvwr.exe, rundll32.exe auto-elevation); it does not address non-utility bypasses, injection into trusted processes, or lateral-movement cases.
T1548.002prevents — A.8.18's restrictions on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain many UAC-bypass methods that rely on auto-elevating or injected utilities, but leave open credentialed lateral movement, non-utility bypasses, and cases where utilities remain authorized.
T1548.003detects — A.8.18.i explicitly requires logging of all use of utility programs (including sudo), which surfaces abuse of sudo caching or sudoers misconfigurations after the fact; this is genuine detection but only a slice, as the control does not mandate monitoring of sudoers changes, timestamp files, or anomalous elevation patterns beyond basic use logs.
T1548.003prevents — A.8.18's guidelines (a,b,c,d,e,f,g,h,i) directly constrain sudo/sudoers use, authorization, logging, segregation, and removal of unnecessary utilities, stopping most abuse paths that rely on poor configuration or unrestricted privileged utilities; the bounded remainder is adversary-controlled modification of sudoers after initial access or in fully exempted environments.
T1548.004detects — A.8.18.i explicitly requires logging of all use of utility programs; privileged utilities on macOS (including those abusing AuthorizationExecuteWithPrivileges) are observable via that logging, but the control does not mandate collection or analysis of the specific API calls, world-writable file loads, or masquerading indicators that realize the technique.
T1548.004prevents — A.8.18's limits on privileged utility use (auth, authorization levels, removal/disabling, segregation, temporary availability, logging) constrain abuse of the deprecated API for unauthorized root escalation on macOS, but do not stop the technique outright when the API is deliberately invoked by a trusted/authorized program or modified legitimate binary.
T1548.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; this surfaces abuse of temporary elevation mechanisms (JIT, impersonation, PassRole) when they are exercised through such utilities, but the control is silent on non-utility vectors, non-privileged misconfigurations, and log review itself.
T1548.005prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal, logging, time-bounding) constrain the mechanisms adversaries abuse for temporary cloud elevation, but only for a minority slice of on-prem-style utilities rather than the dominant cloud-native permission-configuration paths (JIT requests, PassRole, impersonation tokens) that the technique actually names.
T1548.006prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this bounds the subset of TCC-manipulation paths that rely on privileged utilities (e.g. launchctl, database editors), but leaves the dominant in-process/abuse-of-already-authorized-app vectors (Finder+AppleScript, process injection) untouched.
T1550detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which can surface adversary use of stolen alternate auth material (e.g. via pass-the-hash or pass-the-ticket utilities), but this is only one narrow slice of the broad technique that also covers in-memory token theft, application access tokens, and non-utility vectors.
T1550prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could extract or misuse alternate auth material (e.g. hashes/tickets), thereby stopping many but not all ways the technique can be executed.
T1550.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; PtH is commonly performed by such utilities (e.g. Mimikatz, PsExec) whose execution can therefore be surfaced in logs, but the control does not require monitoring/analysis of those logs nor does it address non-utility PtH vectors.
T1550.002prevents — A.8.18 limits, segregates, authorizes, logs, and removes privileged utilities that could be abused to capture hashes or perform PtH, but does not address credential theft itself, non-utility vectors, or the core hash-authentication bypass once a hash is obtained.
T1550.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; PtT often relies on such utilities (e.g. Mimikatz or similar tools that dump/export tickets), so the logging surfaces the technique when those utilities run, but the control is silent on non-utility vectors, ticket forgery without utilities, or log review itself.
T1550.003prevents — A.8.18's limits on privileged utilities (authorization, unique ID, logging, removal/disablement, segregation) constrain the high-privilege tools and accounts most often used to dump tickets or forge golden/silver ones, but do not stop lower-privilege credential dumping or PtT use of already-stolen tickets.
T1552prevents — A.8.18's limits on privileged utilities (f/g/h: remove/disable, segregate, time-bound availability; plus a/b: authz) stop many privileged utilities that could otherwise be abused to locate unsecured credential stores, but do not stop non-privileged search techniques or utilities that remain authorized.
T1552.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be used to search/read credential files, thereby stopping many (but not all) instances of the T1552.001 technique from succeeding.
T1552.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the listed tools/scripts (Metasploit gpp module, Get-GPPPassword, gpprefdecrypt.py) and the dir /s *.xml enumeration are utility programs whose execution on a domain controller or admin workstation would be logged, surfacing the technique in flight, but this is only a slice because the technique can also be performed by simply browsing the SYSVOL share without invoking any privileged utility.
T1552.006prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged-admin actions that create GPP-embedded credentials in the first place (and the post-creation use of privileged tools to read them), but leaves the default SYSVOL readability by any domain user untouched.
T1553prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls, which directly stops many subversions of trust mechanisms that rely on such utilities (e.g. permission/registry changes or installing stolen certs), but leaves open-ended other subversion vectors such as social engineering users or abusing already-trusted signing paths.
T1553.003prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling, logging) constrain the hijack steps that rely on installing/running malicious utilities or DLLs, but do not stop registry modifications, search-order hijacks, or already-present DLL redirection that achieve the same SIP/trust-provider subversion.
T1553.004detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the macOS example (and equivalent Windows/Linux tools) are privileged utilities whose execution can therefore be surfaced in logs, but the control does not require monitoring of the resulting certificate store state or of non-utility vectors such as supply-chain pre-installation.
T1553.006detects — A.8.18.i explicitly requires logging of all use of utility programs; many of the documented modification vectors (bcdedit, csrutil, GUI utilities, registry changes) are privileged utilities whose execution would be logged, surfacing the technique, but kernel-memory alteration, debug-mode reboots, and non-utility vectors lie outside that logging scope.
T1553.006prevents — A.8.18's limits on privileged utility use (auth, authorization levels, removal/disabling of unnecessary ones, segregation, temporary availability, and logging) constrain many of the documented methods for modifying code signing policy (e.g. bcdedit, csrutil, registry edits), but do not stop all vectors such as kernel memory modification via exploited signed drivers or debug/recovery mode boots.
T1554detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface anomalous or unauthorized binary modifications when performed via those utilities (a common vector for T1554), but the control does not require or address detection of the binary modifications themselves or of in-memory/runtime patching.
T1554prevents — A.8.18's limits on who may run privileged utilities, segregation, removal of unnecessary ones, and logging directly constrain the ability to modify binaries on the host, but only for the privileged-utility slice of T1554; many binaries (browsers, email clients, etc.) are routinely modified without invoking such utilities.
T1555prevents — A.8.18's restrictions on privileged utilities (authz, least use, removal/disable, segregation, logging) stop many common ways adversaries run tools to dump password stores, but do not reach non-privileged access, in-memory extraction, or utilities outside the privileged set.
T1555.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including the security command-line tool that dumps Keychain), which stops many but not all paths to credential extraction from Keychain storage.
T1555.004detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; several T1555.004 vectors rely on such utilities (vaultcmd.exe, rundll32.exe keymgr.dll, password recovery tools) whose invocation would therefore be logged and detectable, but other vectors (direct file reads of .vcrd/.vpol, direct CredEnumerateA API abuse) do not involve those utilities and are unreached.
T1555.004prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could read Credential Manager lockers or call CredEnumerate), so it stops many of the listed mechanisms from being usable; it does not stop every possible way an adversary could reach the lockers or the .vcrd/.vpol files.
T1555.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; this surfaces anomalous or unauthorized use that can enable T1555.005 (e.g. via memory scraping utilities or brute-force tools), but does not broadly detect the technique's core memory-extraction or database-access steps when performed without such utilities.
T1555.005prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains the subset of T1555.005 vectors that rely on privileged utilities (e.g. memory scraping tools or brute-force utilities), but leaves the dominant in-memory extraction, master-password guessing, and direct database-file access vectors untouched.
T1555.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's listed commands (get-secret-value, gcloud secrets describe, az key vault secret show) are exactly such utilities when performed with elevated privileges, so their execution is logged and therefore detected, but only for the subset of executions that route through those utilities rather than all paths to secret retrieval.
T1555.006prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging) constrain the high-priv Cloud Account or service-compromise step that enables secret-retrieval commands, but do not block the technique once those privileges exist and the secrets-manager APIs themselves are not utilities under the clause.
T1556detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface malicious modifications to auth mechanisms (e.g. via PAM or LSASS utilities) when those utilities are the vector, but the control does not require or address detection of the modification itself when performed by other means.
T1556prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be used to modify auth mechanisms like PAM/LSASS/SAM, thereby stopping many (but not all) instances of the technique from being executable
T1556.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; patching LSASS to install Skeleton Key is exactly such a privileged utility action on a domain controller, so the required logging would surface the technique when performed, but the clause does not mandate monitoring/analysis of those logs nor does it reach non-utility vectors or post-reboot persistence.
T1556.001prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling, logging) constrain the deployment of a Skeleton Key-style patch on LSASS, but do not stop an already-privileged adversary from executing the patch via other means or on unmanaged domain controllers.
T1556.002detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; registering a malicious password filter DLL is an administrative act that would be performed by such a utility and is therefore surfaced in those logs, but the control does not require monitoring or analysis of the logs themselves nor does it address non-utility registration paths.
T1556.002prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal of unnecessary ones, logging) constrain malicious registration and use of a password-filter DLL as a privileged mechanism, but do not block all vectors (e.g. initial admin compromise or non-utility loading paths) and the control is not specific to authentication-process filters.
T1556.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; PAM modifications are performed by (or result in) privileged utilities whose execution would be logged, surfacing the technique after the fact on covered systems, but the control does not mandate monitoring/analysis of those logs nor cover non-utility vectors such as direct library patching.
T1556.003prevents — A.8.18's restrictions on privileged utilities (auth, segregation, removal of unnecessary ones, logging) constrain modification of PAM components like pam_unix.so that act as privileged utilities, but do not stop all such modifications (e.g. by already-authorized insiders or via non-utility vectors).
T1556.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's primary vector (Set-ADUser, FGPP, or Local Group Policy Editor) is performed through such utilities, so the mandated logging surfaces the enabling action when it occurs.
T1556.005prevents — A.8.18 limits, authorizes, logs, segregates and disables unnecessary privileged utilities (including those that could alter AD encryption properties via GPO/PowerShell), which stops many abuse paths; partial because the control is agnostic to this specific reversible-encryption setting and does not reach every possible privileged mechanism an adversary could leverage.
T1556.006detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's core actions (patching MFA binaries/configs, editing hosts files, registering rogue MFA methods, altering Conditional Access policies) are performed via privileged utilities or equivalent admin tools whose execution would be logged, surfacing the activity after the fact, but this is only a slice because many of the technique's abuse-of-legitimate-feature vectors (e.g. GUI-based policy edits, non-utility API calls) fall outside the utility-program boundary and the control does not mandate review or alerting.
T1556.006prevents — A.8.18's restrictions on privileged utilities (authz, segregation, removal, logging) limit the ability of an adversary to run or abuse the high-privilege utilities needed to patch MFA programs, alter config files, edit hosts, or change Conditional Access policies, but do not stop all listed vectors such as abusing legitimate GUI features or registering a new MFA method.
T1556.007detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the described technique (DLL injection into PTA/AD FS processes, config edits, agent registration) necessarily exercises such utilities or their backing privileged processes, so the mandated logs surface the activity when those utilities are the vector, but this is only a slice of the hybrid-identity backdooring surface (cloud-side Global Admin actions, non-utility config changes) and does not guarantee detection of the technique itself.
T1556.007prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging) constrain on-prem modification of PTA/AD FS processes but do not address cloud-side backdooring of hybrid identity or the privileged accounts that enable it.
T1556.008detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; registering a malicious network provider DLL (via Registry or similar) is an administrative/privileged act that would be surfaced in those logs, but the control does not require monitoring of the logs themselves or detection of the credential-capture behavior once planted.
T1556.008prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain the privileged actions needed to register a malicious network provider DLL via the Registry or as a credential manager, but do not block all installation vectors or the underlying credential-capture mechanism itself.
T1556.009detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; conditional-access policy modification is performed via privileged utilities or APIs in the listed identity-provider/IaaS platforms, so the required logs surface the technique when it occurs, but the control does not mandate monitoring, alerting, or analysis of those logs.
T1558detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface adversary use of klist (and similar utilities) to inspect or manipulate Kerberos tickets; this is genuine detection of the technique in flight but only a minority slice of T1558, which is dominated by theft/forgery methods that do not rely on such utilities.
T1558prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal/disable, logging) constrain use of tools like klist or similar ticket-dumpers that adversaries rely on, but only for a minority slice of T1558 vectors (many involve memory scraping, LSASS access, or forgery without calling a privileged utility).
T1558.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; domain controllers run the KDC as a privileged service and obtaining the KRBTGT hash (the root step of T1558.001) is performed by privileged utilities, so the mandated logs can surface the technique when those utilities execute, but the control does not require monitoring/analysis of the logs nor does it address the many non-utility vectors for the same technique.
T1558.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could dump KRBTGT hashes from a DC), which stops the credential-dumping prerequisite for forging a golden ticket on many but not all paths.
T1558.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; silver-ticket forging is performed with such utilities (e.g. Mimikatz, Rubeus) whose execution can therefore be surfaced in logs, but the control does not mandate monitoring/analysis of those logs nor does it address the technique's offline nature or hash-acquisition precursors.
T1558.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be abused to dump hashes or perform related actions needed for silver ticket forgery, but does not address the forgery itself, Kerberos weaknesses, or non-utility vectors like Kerberoasting.
T1558.005prevents — A.8.18's limits on privileged utility use (authz, segregation, removal of unnecessary ones, logging) constrain the built-in Kerberos utilities (kinit/klist) and any privileged tools that could read/write ccache files, but do not stop an adversary who already has session-level access from reading the on-disk /tmp files or memory-resident ccache without invoking a privileged utility.
T1559.003prevents — A.8.18's limits on privileged utilities (auth, least use, segregation, removal of unnecessary ones, logging) constrain the privileged-helper/XPC daemon surface that T1559.003 abuses for local root execution, but only for the subset of utilities under organizational control; the technique also reaches third-party app-provided XPC services outside that boundary.
T1560prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains (but does not eliminate) an adversary's ability to use such utilities for compression/encryption in T1560, while 3rd-party libraries and custom methods remain untouched.
T1560.001detects — A.8.18.i explicitly requires logging of all use of utility programs, which surfaces adversary use of archiving utilities (tar/zip/7-Zip/etc.) when they run; this is genuine detection of the technique but only a minority slice because the clause does not require monitoring/analyzing those logs for anomalous use, nor does it address non-privileged or pre-installed utilities outside its authorization regime.
T1560.001prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities, which stops many (but not all) of the pre-installed or third-party utilities named in T1560.001 from being available or usable by an adversary.
T1561detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface (i.e. detect) adversary use of disk-wiping utilities that qualify as such, but the control is silent on detecting the wipe itself when performed by other means (raw device writes, CLI erase commands, non-utility malware).
T1561prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls (including those granting direct disk write access needed for wiping); this stops many but not all T1561 vectors such as network-device CLI erase commands or non-utility malware already inside an authorized session.
T1561.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1561.001 implementations rely on such utilities or drivers (e.g. RawDisk) whose execution would therefore be logged and detectable, but the technique can also be realized through other non-utility means that the control does not surface.
T1561.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls, which stops many (but not all) of the direct-disk-access and third-party-driver methods used by T1561.001; the remainder includes non-utility vectors, already-installed malware, and propagation via valid accounts that the clause does not address.
T1561.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1561.002 instances (MBR overwrite, format command, admin-share propagation) are performed via such utilities and would therefore be surfaced in the resulting logs, but the control does not require monitoring or alerting on those logs and leaves non-utility vectors (direct raw-disk writes) untouched.
T1561.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be (ab)used to overwrite MBR/partition structures or run format commands; this stops the technique on systems where such utilities are the vector, but leaves other vectors (custom malware, direct kernel writes, non-utility admin tools) untouched.
T1563detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; session hijacking (especially via utilities like RDP/SSH tools) is an observable privileged-use event that such logging would surface, but the control is scoped only to utility programs rather than all remote-service sessions or hijack indicators.
T1563prevents — A.8.18's limits on privileged utilities (auth, segregation, removal, logging, time-bounding) stop many hijack vectors that rely on abusing or installing privileged utilities to capture/steal sessions, but do not address all session-hijacking methods (e.g. network-level MITM or app-level token theft) and are scoped only to privileged utilities rather than all remote-service sessions.
T1563.001detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; SSH agent hijacking on Linux/macOS is commonly performed via privileged utilities (ssh-agent, ssh-add, root-level socket access), so the mandated logging surfaces the technique when it runs, but only for the bounded subset of cases that route through those utilities rather than direct memory manipulation or non-privileged agent sockets.
T1563.001prevents — A.8.18's limits on privileged utilities (authz, unique ID, removal/disable, segregation, time-bound use, logging) directly constrain the root-level or agent-socket access that makes SSH hijacking trivial, but only for the subset of utilities an org treats as privileged; ordinary SSH-agent use, non-utility sockets, and already-compromised sessions remain outside its scope.
T1563.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; tscon.exe is the canonical privileged utility used to perform RDP hijacking, so its invocation is logged and therefore detectable, but the control does not require monitoring/analysis of those logs nor does it address non-utility vectors for the technique.
T1563.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including tscon.exe used to hijack RDP sessions), which stops many but not all instances of the technique (e.g. non-utility tools, already-elevated sessions, or incomplete segregation).
T1564prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls, which stops many (but not all) T1564 techniques that rely on abusing or installing such utilities to create hidden artifacts or isolated regions.
T1564.006detects — A.8.18.i explicitly requires logging of all use of utility programs; the technique's dominant path on ESXi (and several others) is the /bin/vmx utility (or equivalent privileged virtualization utilities), so the mandated logging would surface that usage, but many other vectors (native Hyper-V, dropped QEMU/VirtualBox binaries, Windows Sandbox .wsb, shared-folder setup) do not rely on such utilities and are invisible to this control.
T1564.006prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities (including VM-related ones such as /bin/vmx, VirtualBox binaries or Hyper-V tools), which stops many of the described ways the technique is launched; it leaves open the use of built-in OS virtualization (Windows Sandbox, native Hyper-V without extra binaries) that requires no added utility program.
T1564.012prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains the creation or abuse of hardcoded AV exclusions (a privileged-utility action on many platforms) but leaves the bulk of pre-existing/default exclusions, non-privileged configuration of exclusions, and discovery of them untouched.
T1564.013prevents — A.8.18's limits on privileged utility use (authorization, unique ID, logging, segregation, removal of unnecessary ones) constrain sudo-based mount commands that enable bind-mount hiding, but do not stop all instances (e.g., authorized admins, non-utility vectors, or post-mount concealment).
T1564.014prevents — A.8.18 limits, authorizes, logs, segregates and removes unnecessary privileged utilities (including xattr/setfattr/getfattr used to write/read xattrs), which stops the technique for non-authorized users and unnecessary cases but leaves a nameable remainder for authorized admins on required systems.
T1565prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the specialized access and tools often required for complex T1565 data manipulation but does not stop simpler forms that need no such utilities.
T1565.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls, which stops many (but not all) ways an adversary could obtain the specialized privileged access needed to manipulate stored data at rest.
T1565.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be the interception/modification tools described in T1565.002, thereby stopping many (but not all) such manipulations at source.
T1565.003prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains the privileged modification path to runtime data and binaries described in T1565.003, but leaves many non-privileged, non-utility vectors (file association changes, masquerading, direct in-memory manipulation) untouched.
T1569detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface abuse of system services/daemons when those are implemented as such utilities; this is genuine detection but only a minority slice of T1569 (most service abuse does not route through privileged utilities, and the control is silent on service-specific monitoring).
T1569prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could create/start services), which stops many but not all T1569 abuse paths such as unprivileged service creation or remote service interaction.
T1569.001detects — A.8.18.i explicitly requires logging of all use of utility programs; launchctl is a privileged utility that can override controls, so its abuse is surfaced in those logs, but the clause does not mandate monitoring/analysis of the logs nor cover non-privileged or non-utility launchctl usage
T1569.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that can override controls like launchctl on macOS), which stops many abuse paths, but leaves a nameable remainder (authorized admins, ad-hoc use, and non-utility launchctl invocations).
T1569.002detects — A.8.18.i explicitly requires logging of all use of utility programs, which would surface abuse of sc.exe, PsExec and similar service-control utilities; this is genuine detection of the technique but only a slice, as the control does not require monitoring of service creation/execution artifacts beyond utility invocation nor does it mandate analysis or alerting.
T1569.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that could invoke or manage services), which stops many abuse paths for sc.exe/PsExec/service-control-manager execution but leaves the core Windows service mechanisms themselves intact and usable by authorized admins.
T1569.003detects — A.8.18.i explicitly requires logging of all use of utility programs; systemctl is a privileged utility that can start/stop services, so its use is logged and thereby detected, but the control does not mandate monitoring/analysis of those logs or detection of abuse (only the act of use).
T1569.003prevents — A.8.18's limitations on use, authorization, segregation, removal/disabling of unnecessary utilities, and logging directly constrain abuse of privileged utilities like systemctl on Linux, but only for the subset of uses that qualify as utility programs rather than core init-system management, leaving a nameable remainder
T1572detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many tunneling implementations (e.g. SSH port forwarding, custom tools) rely on such utilities and would therefore be surfaced in those logs, but the control does not address non-utility tunneling, in-memory or non-privileged implementations, or the network-layer observables of the technique itself.
T1572prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal, logging) stop many tunneling tools (e.g. SSH port forwarding, custom encapsulators) from being installed/used as privileged utilities, but cannot stop all protocol tunneling (DoH in browsers, built-in OS facilities, non-privileged tools).
T1574prevents — A.8.18's limits on who can run privileged utilities, their segregation, removal of unnecessary ones, and logging directly stop many hijack vectors that rely on abusing or introducing such utilities (e.g. via poisoned paths, libraries, or registry entries), but leave untouched the many non-utility-based hijack methods described in T1574.
T1574.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which surfaces anomalous or unauthorized DLL-related activity when those utilities are involved in sideloading/hijacking, but the control does not broadly instrument or detect the technique across non-utility program loads or the full range of described mechanisms.
T1574.001prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain some DLL-abuse vectors that rely on privileged or system-level utilities (e.g., search-order hijacking or substitution via elevated processes), but do not address the dominant non-privileged sideloading, phantom hijacking, or user-mode DLL planting vectors described in the technique.
T1574.004detects — A.8.18.i explicitly requires logging of all use of utility programs; a malicious dylib inserted to hijack a privileged utility would be surfaced in those logs when the utility runs, providing detection of the technique (though many non-utility dylib hijacks and the insertion step itself remain outside this control).
T1574.004prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain some hijack vectors that rely on privileged or unnecessary dylibs, but do not address the core search-path, weak-linking, or runtime loader behaviors that enable most T1574.004 instances.
T1574.005prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary ones, and logging constrain the attack surface for installer binary hijacking that relies on weak permissions and elevated execution, but do not address the root installer permission-setting flaw itself or non-utility vectors.
T1574.006detects — A.8.18.i explicitly requires logging of all use of utility programs; privileged utilities that could set LD_PRELOAD/DYLD_INSERT_LIBRARIES or install hijacking libraries would be logged, surfacing the technique in authorized or anomalous cases, but this is only a slice of possible hijacking vectors (e.g. non-utility, non-privileged, or subverted processes).
T1574.006prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary utilities, and logging constrain the attack surface for LD_PRELOAD-style hijacking (a privileged-utility technique), but do not stop an adversary who already has the ability to set environment variables for a target process.
T1574.007detects — A.8.18.i explicitly requires logging of all use of utility programs; anomalous or unauthorized utility execution (including PATH hijacks that rely on placing malicious binaries early in the search path) would surface in those logs, but the control does not mandate monitoring, alerting, or detection of the PATH modification or interception itself.
T1574.007prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal, logging) constrain some PATH hijacking vectors that rely on privileged utilities or shell config changes, but leave the bulk of the technique (user-level PATH manipulation, unprivileged binaries, or non-utility execution) untouched.
T1574.008detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface anomalous or unauthorized executions that realize search-order hijacking of system utilities (e.g. a rogue net.exe), but the control does not require monitoring for the placement of malicious files or other precursors and is scoped only to privileged utilities rather than all search-order-vulnerable programs.
T1574.008prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain some hijack vectors that rely on privileged utilities or their directories, but do not stop placement of malicious files in arbitrary non-privileged program directories or the underlying search-order flaw itself.
T1574.009detects — A.8.18.i explicitly requires logging of all use of (privileged) utility programs; this surfaces anomalous or unauthorized utility execution that can realize path interception, but does not broadly instrument for the technique's core (unquoted path resolution in arbitrary services/shortcuts).
T1574.009prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal of unnecessary ones, logging) constrain the privileged-process slice of unquoted-path hijacking but do not address the core weakness of unquoted paths in non-privileged services, shortcuts, or application launchers.
T1574.010prevents — A.8.18's limits on privileged utility use, authorization, segregation, removal of unnecessary ones, and logging constrain the attack surface for service binary hijacking via weak permissions, but do not address the core permission flaw on service binaries/directories themselves.
T1574.011prevents — A.8.18's limits on who may use privileged utilities, its authentication/authorization requirements, its segregation rules, its removal of unnecessary utilities, and its logging directly constrain the privileged-tool (sc.exe, reg.exe, PowerShell) abuse that exploits weak service-registry ACLs, but do not reach the initial misconfiguration of those ACLs themselves nor every possible non-utility vector.
T1574.012detects — A.8.18.i explicitly requires logging of all use of utility programs; COR_PROFILER abuse registers/loads a profiler DLL that can be surfaced in process, registry, or environment monitoring as anomalous utility behavior, but in-memory process-scope use, non-registered DLLs, and lack of mandated depth leave a genuine slice undetected.
T1574.012prevents — A.8.18's restrictions on privileged utilities (authorization, unique identification, limiting availability, segregation, disabling unnecessary ones) constrain abuse of COR_PROFILER as a privileged .NET profiling mechanism that can override controls for persistence, privilege escalation, and defense evasion, but only for a minority slice of the technique's scopes and vectors (e.g., does not block in-memory process-scope or non-privileged .NET CLR loading).
T1574.013detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's steps (WriteProcessMemory to PEB, NtQueryInformationProcess, Windows message dispatch) are observable as privileged-utility or anomalous process behavior when that logging/monitoring is enabled, but the control does not mandate detection of the technique itself and many implementations will miss in-process memory tampering masked under a legitimate process.
T1574.013prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal, logging) constrain the process-injection and reflective-loading steps that enable KernelCallbackTable hijacking, but do not block the technique when performed by already-authorized debug/admin processes or via non-utility vectors.
T1574.014detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface anomalous or unauthorized use that could indicate AppDomainManager hijacking when the technique abuses utilities or runtime configuration changes
T1578detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface (i.e. detect) an adversary's use of such utilities to modify cloud compute infrastructure on IaaS where those utilities are the vector.
T1578prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged actions an adversary would need to perform T1578 (create/delete/modify IaaS compute components), but only reaches a slice of the technique because many cloud modifications use native APIs or IAM rather than distinct privileged utility programs.
T1578.001prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; a snapshot-creation API or CLI is exactly such a utility in IaaS, so the control constrains the technique for authorized admins, but leaves the permission itself (and therefore the technique) available to those admins, which is a genuine minority slice rather than the bulk.
T1578.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; creating a cloud instance (especially via privileged APIs or management utilities) is observable in those logs when the utilities are covered by the control, but the control's scope is limited to a narrow slice of privileged utilities rather than all instance-creation paths or cloud control-plane events.
T1578.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; cloud-instance deletion is typically performed via such a utility (CLI/API), so the logging surfaces the technique when it runs, but this is only a slice of possible deletion vectors and does not guarantee detection of the act itself.
T1578.003prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal/disabling, temporary availability, logging) can stop an adversary from using delete-instance utilities in IaaS, but only for the subset of cases where deletion is performed via such a privileged utility rather than native cloud APIs or console actions.
T1578.004detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; snapshot-revert APIs and cloud management dashboard actions that perform the technique qualify as such utilities in IaaS, so their invocation is surfaced in logs, but the control does not require monitoring or alerting on those logs and the technique's ephemeral-storage variant leaves even less detectable residue.
T1578.005detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; tenant-wide policy, quota, and compute-configuration changes in IaaS are performed via such privileged utilities or APIs, so the logging surfaces the adversary action, but the control is silent on analysis, alerting, or coverage of non-utility configuration paths, leaving a genuine minority slice detected.
T1599.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; NAT configuration changes on network devices are performed via such utilities, so the resulting logs surface the technique when it runs, but this is only a slice (logging exists but does not guarantee detection of the modification's intent or effect, and many network devices surface NAT changes outside general-purpose utility programs).
T1601detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface attempts to run the utilities needed to modify a monolithic system image on a network device; this is only a slice of the full technique (e.g., in-memory changes or direct firmware writes that bypass utilities are outside its view).
T1601prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling, logging) constrain the tools and access paths typically needed to replace or patch a monolithic system image on a live or at-rest network device, but do not block all possible modification vectors (e.g. supply-chain, out-of-band, or non-utility methods).
T1601.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; native debug commands, console access, and standard operator procedures (TFTP/FTP/SCP) cited in the T1601.001 description are exactly the sort of privileged utilities whose use would be logged, surfacing the activity, but the technique also supports bootloader/ROMMONkit paths and in-memory patching that sit outside normal utility-program invocation and therefore outside the logging mandated here.
T1601.001prevents — A.8.18's restrictions on privileged utilities (authz, logging, removal of unnecessary ones, segregation) directly constrain the admin-level debug commands and standard operator procedures that the technique relies on to patch the image in storage or memory, but leave the ROMMONkit/bootloader vector and post-compromise command compromise untouched.
T1602.001detects — A.8.18 item i) explicitly requires logging of all use of utility programs; SNMP queries that dump MIBs are a form of privileged-utility access on network devices, so the mandated logging would surface the technique when it occurs, but the control is scoped only to utility programs rather than all SNMP traffic or queries and does not mandate monitoring or alerting on the logs.
T1602.001prevents — A.8.18 limits, authenticates, authorizes, segregates, disables and logs privileged utilities (including those that can read/set SNMP MIB OIDs), which stops many but not all ways an adversary can perform an SNMP MIB dump from a managed device.
T1602.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's use of management tools/protocols (SNMP/SMI) to dump config is a form of privileged-utility activity that would surface in those logs, but this is only a slice of the technique (e.g. does not cover non-utility access vectors or post-dump exfil).
T1602.002prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including management tools like SNMP/SMI that adversaries use to dump configs), which stops many but not all paths to the technique on network devices.
T1609detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface container administration commands (docker exec, kubectl exec, etc.) when performed via such utilities; this is genuine detection but only a slice, as the technique can also be realized through direct API server or kubelet abuse that may not route through a logged privileged utility.
T1609prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the subset of T1609 that relies on privileged container-management utilities (docker/kubectl/kubelet), but leaves the remainder where the adversary already holds sufficient non-utility permissions or uses non-privileged entrypoints.
T1610detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface container-deployment actions performed via such utilities (e.g. docker CLI, kubectl, or Kubernetes APIs when privileged), but the control does not require monitoring or detection of container deployment performed through other means such as web dashboards, workloads, or non-privileged paths.
T1610prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including container-management tools such as Docker/K8s APIs or dashboards), so the adversary cannot freely invoke the deployment mechanisms named in T1610; the remainder is deployment paths that do not rely on those privileged utilities (e.g. compromised developer credentials, CI/CD pipelines, or already-privileged workloads).
T1611detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many documented T1611 paths (privileged container, bind-mount cron, kernel module load, docker.sock abuse, unshare/keyctl) exercise such utilities and would therefore be logged when the control is present, but the technique also includes pure exploit paths (e.g. ESXi hypervisor vuln, symbolic-link privilege escalation) that do not require or visibly use a utility program and therefore go undetected by this clause.
T1611prevents — A.8.18's limits on privileged utilities (authorization, segregation, removal, logging) block several documented escape vectors that rely on privileged containers, host-mount utilities, or control utilities such as cron, but do not address kernel exploits, socket abuse, or hypervisor vulnerabilities that do not involve utility programs.
T1612detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; a build API call that invokes such utilities (e.g. docker build) can be surfaced in those logs, but the control does not mandate monitoring/analyzing those logs for the specific adversarial pattern of building malicious images on-host.
T1612prevents — A.8.18's limits on privileged utilities (authz, segregation, removal, logging, time-bounding) can stop ad-hoc use of docker/build utilities that realize T1612, but the control is silent on container-specific build APIs, image construction, and does not reach all possible build mechanisms or non-utility vectors.
T1615detects — A.8.18.i explicitly requires logging of all use of utility programs; the technique's dominant implementations (gpresult.exe and PowerShell cmdlets) are themselves privileged utilities whose execution is therefore logged, surfacing the discovery activity, but this is only a slice because non-utility discovery vectors and post-execution log review are outside the clause.
T1620detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; reflective code loading is often performed by or through such utilities (e.g. PowerShell, debuggers, or other system tools), so the mandated logging can surface the anomalous use, but the control does not require behavioral monitoring of in-memory execution or non-utility vectors and the technique is designed to evade process-based detection.
T1620prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the privileged process context and tooling (e.g. debuggers, custom loaders) most often abused for reflective loading, but leaves ordinary in-process reflective mechanisms (e.g. Assembly.Load in benign PowerShell) untouched.
T1649prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be used to steal or forge certificates (e.g. via crypto APIs, CA private-key mechanisms, or enrollment tools), but leaves many non-utility vectors (misconfigurations, enrollment rights, SAN/EKU abuse, golden-certificate key compromise) untouched.
T1651detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface abuse of cloud management services (themselves privileged utilities) when performed via authorized accounts or agents; this is genuine detection of the technique in flight but only a slice, as the control does not mandate monitoring of the broader anomalous behaviors, network segregation violations, or delegated-account compromises described in the T1651 prose.
T1651prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging, time-bounding) constrain the administrative accounts and cloud management services that T1651 abuses, but only for a minority slice of the technique's surface (on-prem-style utilities and VM agents); most cloud-native admin paths remain untouched.
T1653prevents — A.8.18's limits on privileged utility use (authorization, logging, segregation, disabling unnecessary ones) constrain abuse of powercfg and similar privileged utilities, but do not stop configuration changes or file deletion by already-privileged malware
T1654prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities (including those that read/export logs such as wevtutil, PowerShell, or CollectGuestLogs.exe), which stops many instances of the technique from running; it does not address all log-enumeration vectors (e.g. direct SIEM queries, non-privileged access, or already-available tools).
T1675detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface abuse of ESXi administration services and related tools when they qualify as such utilities; this is genuine detection but only a slice of the technique (e.g., does not address non-utility API abuse or guest-side behaviors).
T1675prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that can override controls; this constrains the abuse of ESXi admin services and guest-execution APIs (which are a form of privileged utility), but leaves many implementation-specific and ad-hoc uses untouched.
T1677prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could override controls; this constrains Direct and some Indirect poisoning that relies on privileged build utilities or runners, but leaves Public Pipeline Execution, unprivileged script injection, and most SaaS CI config tampering untouched.
T1685detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; such logs can surface the technique when an adversary uses or tampers via a utility program, but the control is silent on detection of non-utility-based tampering, direct process kills, ETW/sensor disruption, or broader defensive-operation interference.
T1685prevents — A.8.18's limits on who can run privileged utilities, segregation, removal of unnecessary ones, and logging directly stop many of the legitimate-utility and admin-privilege vectors an adversary would use to disable or tamper with security tools, but do not address non-privileged tampering, driver-based bypasses, or direct attacks on sensors/telemetry.
T1685.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's primary methods (auditpol.exe, sc.exe, reg modifications of EventLog/Autologger keys, secpol.msc) are exactly the sort of privileged-utility actions that would be logged when the control is applied, surfacing the adversary's actions, but the control does not require or address logging of the EventLog service's own output or non-utility paths.
T1685.001prevents — A.8.18's restrictions on privileged utilities (authz, unique ID, logging of use, limiting availability, segregation, removal of unnecessary ones) constrain the admin-level commands, registry edits, and auditpol.exe invocations that realize T1685.001, but only for the subset of utilities that are formally managed this way; many native Windows mechanisms (sc.exe, reg.exe, auditpol.exe itself, or direct service manipulation) remain reachable by any sufficiently privileged user.
T1685.002prevents — A.8.18's limits on privileged utility use (authz, segregation, removal/disabling of unnecessary ones, logging of their use) constrain an adversary's ability to run the utilities or commands that disable/modify cloud logging, but only for a minority slice of the technique's surface (privileged utilities on IaaS/SaaS where segregation or removal applies); most of T1685.002 (API calls, license changes, cmdlets, config tampering) is reached only indirectly via permission hygiene that lives in other clauses.
T1685.004detects — A.8.18.i explicitly requires logging of all use of utility programs; because auditctl, systemctl stop, and direct edits of audit.rules/audit.conf are themselves privileged utilities, their invocation is logged and therefore surfaces the technique when it runs.
T1685.004prevents — A.8.18's limits on privileged utility use (auth, least users, removal/disable of unnecessary ones, logging of use, segregation) constrain the root-privileged auditctl/systemctl/hooking actions that disable or alter auditd, but do not stop all vectors (e.g. direct kernel hooks or already-installed malicious utilities) and the control is not specific to audit.
T1685.005detects — A.8.18.i explicitly requires logging of all use of utility programs; wevtutil (and similar privileged utilities) is the exact mechanism named for clearing the logs, so its use is surfaced by the mandated logs, but the technique also supports non-utility vectors (PowerShell, direct file deletion, GUI) that sit outside this control's scope.
T1685.005prevents — A.8.18's limits on privileged utility use (authorization, unique ID, temporary availability, removal of unnecessary ones, segregation) stop many admin-privileged clearing utilities from being available or runnable by an adversary, but do not block all listed mechanisms such as PowerShell, GUI, or direct file deletion.
T1685.006detects — A.8.18 requires logging of all use of privileged utility programs; clearing logs (T1685.006) is typically performed by such a utility, so the control surfaces the actor's use of the utility that performed the clearing, but does not surface the clearing action itself when performed without a privileged utility.
T1685.006prevents — A.8.18 limits, authorizes, segregates, disables and logs privileged utilities that could be used to clear /var/log contents (e.g. via rm, truncate, or logrotate), thereby stopping many but not all instances of the technique.
T1686detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; many T1686 behaviors (e.g. esxcli, netsh, sc, ufw, iptables, pfctl) are performed via such utilities, so the logging surfaces the technique when it runs, but the control is silent on what is logged, on non-utility vectors, and on analysis/alerting, leaving a large remainder.
T1686prevents — A.8.18 limits privileged utility use (auth, least users, disable unnecessary, segregate, log, time-bound), which constrains the privileged execution of utilities like esxcli, netsh, or firewall-cmd that T1686 relies on, but does not stop all paths (e.g. direct kernel tampering, non-utility mechanisms, or already-elevated actors).
T1686.001detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; the technique's core example is an adversary using a script/utility with permissions to modify firewall rules, so the logging surfaces that privileged usage (a detection vector) but does not broadly cover non-utility modifications or post-change effects.
T1686.001prevents — A.8.18's limits on privileged utility use (authz, segregation, removal, logging) constrain the scripts/utilities adversaries use to modify cloud firewall rules, but only for a minority slice of the technique (privileged-utility subset on IaaS); most T1686.001 vectors use standard IAM/API calls that the control does not reach.
T1686.002detects — A.8.18.i explicitly requires logging of all use of privileged utility programs; this surfaces (i.e. detects) adversary use of such utilities to disable/modify network device firewalls (a privileged action on network devices), but only for the utility-execution slice and not the broader technique (e.g. direct management-interface changes via valid accounts or public exploits).
T1686.002prevents — A.8.18's limits on privileged utility use (auth, authorization levels, removal/disabling of unnecessary ones, segregation, temporary availability, logging) constrain the privileged tools and accounts adversaries use to reach and alter network device firewall rules, but do not stop initial access via valid accounts, exploited vulnerabilities, or public-facing apps, nor do they block all possible utilities or host-side manipulations.
T1686.003detects — A.8.18.i explicitly requires logging of all use of privileged utility programs, which would surface adversary use of netsh/PowerShell/registry utilities to disable or modify the firewall; this is genuine detection of the technique but only a slice, as the control does not require monitoring of the firewall state changes themselves or non-utility mechanisms such as Control Panel.
T1686.003prevents — A.8.18's limits on privileged utility use (auth, authorization, removal/disabling of unnecessary ones, segregation, temporary availability, logging) constrain many of the command-line and privileged mechanisms adversaries use to modify the host firewall, but do not stop all vectors such as registry edits or non-utility interfaces.
T1687prevents — A.8.18's limits on privileged utility use (authorization, segregation, removal/disabling, logging) constrain the privileged execution path that many defense-impairment exploits rely on, but do not stop exploitation of the vulnerabilities themselves or non-utility vectors.

Prevented OWASP Web Top 10 (2025) risks (12)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A02→P A05→P A07←P →P A08→P A09←M →P A10→P

Why these map — AI rationale (under review)

A01mitigates — A.8.18 limits who can run privileged utilities (via auth, authorization, segregation, temporary availability, and logging), which bounds the blast radius or consequence when a broken access-control flaw (e.g. IDOR, missing function-level check) would otherwise let an ordinary user invoke such a utility; it does not fix the authorization decision itself.
A01prevents — A.8.18 limits privileged utilities that can override access controls (via authz, segregation, removal, logging), which stops some Broken Access Control vectors (esp. those relying on privileged bypasses), but leaves the bulk of A01 members (IDOR, path traversal, CSRF, missing function-level checks) untouched.
A02mitigates — A.8.18 limits who can run, when they can run, and how privileged utilities are isolated and logged; this bounds the blast radius and detectability of a misconfiguration that leaves such utilities exposed, but does not address weak defaults, incomplete hardening, or exposed cloud/framework/server settings themselves.
A02prevents — A.8.18's restrictions on privileged utilities (authorization, segregation, removal/disabling, limited availability) directly close many misconfiguration vectors that expose attack surface via overly permissive or unnecessary tools, but leave the broader category (weak defaults, incomplete hardening, cloud/framework settings) mostly untouched.
A05mitigates — A.8.18's restrictions on privileged utilities (auth, logging, segregation, temporary use) can bound the blast radius or consequence of a realized injection (esp. OS command or code injection that reaches a utility), but does not address the core neutralization failure at the interpreter boundary for the category's dominant members (SQLi, XSS, LDAP).
A07mitigates — A.8.18's restrictions on privileged utilities (auth, logging, segregation, limited availability) bound the blast radius or consequence of some realized authentication failures (e.g. hijacked sessions or stolen credentials used to invoke utilities), but do not address the dominant members of A07 such as weak passwords, credential stuffing or broken reset flows.
A08mitigates — A.8.18 limits who can run and how they run privileged utilities (auth, logging, temporary use, segregation), which bounds the blast radius or consequence when a privileged utility is the vector for an integrity failure (e.g. unsigned update or CI/CD compromise), but does not address the core weakness of trusting code/data without verification.
A09mitigates — A.8.18's logging of privileged utility use (item i) plus its segregation and disablement rules (f,g,h) limit the blast radius and improve post-facto detection of some security events that would otherwise be invisible, but the control does not address the bulk of the A09 class (missing application-level event logging, alert configuration, or log-integrity mechanisms).
A10mitigates — A.8.18 limits privileged utilities that could be abused on error paths or to force inconsistent states, bounding the blast radius of mishandled exceptions without addressing the error-handling defects themselves.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.