Cyber Resilience

← ISO 27001 Annex A

A.8.2 Technological

Privileged access rights

AttributesPreventive C·I·A Protect Identity and access management Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (16)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-2←M →M AC-3←M →M AC-6←F →M AU-2←P →P CM-5←M IA-2←P IA-4←M MA-5←M

Why these map — AI rationale (under review)

AC-2mostlyaligns with — Both require formal authorization, periodic review, and timely revocation or expiry of privileged accounts to keep access aligned with current responsibilities.
AC-2mostlycovers — A.8.2's focus on provisioning and restricting privileged access rights directly accounts for the privileges, group/role membership, and authorization-specification portions of ac-2, but leaves a real residual (account types, account managers, approval workflows, and non-privileged accounts) uncovered.
AC-3mostlycovers — A.8.2's focus on provisioning and restricting privileged rights accounts for the bulk of ac-3's enforcement of approved authorizations (especially for elevated privileges), but leaves a residual of ac-3's broader non-privileged logical access enforcement untouched.
AC-6mostlycovers — Both controls focus on restricting elevated privileges to the minimum necessary for role-based duties and enforcing separate identities for privileged versus ordinary tasks.
AC-3partialaligns with — The ISO control’s emphasis on an authorization process and enforcement of privileged rights directly supports the broader access-enforcement objective in AC-3.
AU-2partialaligns with — Mandating audit logging of all privileged access activities satisfies the event-logging requirement for security-relevant actions.
IA-2partialaligns with — Requiring stronger or step-up authentication for privileged sessions aligns with the identification and authentication controls for organizational users.
IA-2covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (21)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

DE.CM-03gov GV.RR-02gov PR.AA-01gov PR.AA-03gov PR.AA-05gov PR.PS-04gov

Why these map — AI rationale (under review)

PR.AA-01mostlyaligns with — Managing privileged identities, credentials, and their lifecycle (allocation, expiry, temporary use, and non-sharing) fulfills the CSF outcome of managing identities and credentials for authorized users and services.
PR.AA-05mostlyaligns with — The ISO control's authorization process, role-based allocation, periodic reviews, and separation of privileged versus normal identities directly support defining, managing, enforcing, and reviewing access permissions and entitlements.
GV.RR-02partialaligns with — Establishing who can approve privileged rights, maintaining authorization records, and reviewing role qualifications help define and communicate roles, responsibilities, and authorities for access-related risk management.
PR.AA-03partialaligns with — Elevated authentication requirements, step-up authentication, and break-glass procedures strengthen the authentication of users and services when privileged rights are exercised.
PR.PS-04partialaligns with — Mandating audit logging of all privileged access activities contributes to generating log records that enable continuous monitoring and accountability.
GV.RR-02implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-01implements — A.8.2 operationalizes privileged-access management (a core subset of identity/credential lifecycle for authorized users/services) that PR.AA-01 requires; the link is within the identity-and-access domain but the outcome does not name privileged rights explicitly
PR.AA-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-05implements — A.8.2 directly operationalizes the management and enforcement of privileged access rights (least privilege, authorization, review) that PR.AA-05 names as its outcome
PR.PS-04implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (13)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V16.3.2←M →P V6.3.2→P V6.3.3←P →P V7.3.2←P V7.5.3←M →P V8.2.1←M →M V8.3.1←M →M V8.4.2←P

Why these map — AI rationale (under review)

V8.2.1mostlyaligns with — Both require that privileged or administrative functions are only reachable by identities that have been explicitly granted the necessary permissions.
V8.3.1mostlyaligns with — The ISO control’s insistence on an authorization process and trusted service-layer enforcement mirrors the ASVS requirement that authorization decisions must be made at a trusted backend rather than by client-side controls.
V16.3.2partialaligns with — Logging every use of privileged access rights satisfies the ASVS requirement to record all authorization decisions, including those granting elevated privileges.
V6.3.2partialaligns with — The explicit prohibition of shared generic administration accounts (root, admin) directly supports the ASVS rule that default privileged accounts must be disabled or removed.
V6.3.3partialaligns with — Requiring stronger or step-up authentication for privileged access rights aligns with the ASVS mandate that privileged or high-impact actions must be protected by multi-factor or equivalent controls.
V7.5.3partialaligns with — The ISO guidance that privileged actions should trigger re-authentication or step-up authentication corresponds to the ASVS requirement for additional authentication before performing highly sensitive operations.

Related weaknesses / CWE (99)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-1231nonemitigates — Privileged access rights can limit who can change lock bits, but does not enforce hardware-level immutability.
CWE-271nonemitigates — Privileged access rights explicitly require least-privilege assignment and timely revocation, directly mitigating failure to drop privileges.
CWE-279nonemitigates — Privileged access rights management directly constrains the permissions a process may assign at runtime.
CWE-282nonemitigates — Privileged access rights management requires accurate ownership to prevent unauthorized privilege escalation.
CWE-648nonemitigates — Privileged access rights directly govern the correct use of privileged APIs and reduce misuse.
CWE-673nonemitigates — Restricting privileged access reduces the ability of external actors to change sphere definitions.
CWE-1191mitigates — Privileged-access rules may extend to hardware debug interfaces, yet the control is not hardware-specific.
CWE-1220prevents — Specifies management of privileged access rights, where overly broad privileges are a common manifestation of the weakness.
CWE-1234mitigates — Privileged access rights can restrict debug-mode overrides but do not specifically address hardware lock bypass.
CWE-1244mitigates — Privileged access rights management can limit debug-level access but does not specifically address hardware debug interface misconfiguration.
CWE-1256mitigates — Privileged access rights limit who can invoke hardware-control interfaces, reducing the attack surface for unauthorized register/memory manipulation.
CWE-1259prevents — Privileged access rights help ensure only authorized processes can assign or modify tokens.
CWE-1262prevents — Privileged access rights directly restrict who can read/write hardware registers.
CWE-1268prevents — Specifies management of privileged access rights, mitigating discrepancies between control-plane and data-plane privileges.
CWE-1274prevents — Privileged access rights can limit who or what can write to volatile memory used for boot code.
CWE-1334prevents — Restricting privileged access rights limits the ability of insiders or compromised accounts to tamper with redundancy mechanisms.
CWE-15prevents — Privileged access rights reduce the number of users who can alter configuration.
CWE-214mitigates — Privileged access rights reduce exposure of sensitive command-line arguments to unauthorized observers.
CWE-250prevents — Mandating separate non-privileged identities for routine work and restricting privileged accounts to administrative tasks reduces the chance that everyday operations run with unnecessary elevated rights.
CWE-266prevents — Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
CWE-267mitigates — Privileged access rights control can restrict unsafe privileges, yet does not ensure the privilege definition itself is safe.
CWE-268prevents — Restricting privileged access rights directly mitigates the risk of privilege chaining.
CWE-269prevents — Enforcing minimum-necessary privileges, temporary grants, and separation of administrative versus normal identities prevents the over-assignment of rights that CWE-269 describes.
CWE-270prevents — Privileged-access-rights control directly addresses improper privilege elevation during context switches.
CWE-272mitigates — Privileged access rights explicitly require least-privilege assignment and timely revocation after elevated operations.
CWE-274prevents — Privileged-access-rights control directly limits the situations in which insufficient privileges can occur.
CWE-283prevents — Privileged access rights assignment should verify ownership to prevent unauthorized elevation on critical resources.
CWE-284prevents — Requiring explicit authorization, role-based allocation, and periodic review of privileged rights directly stops the assignment of excessive or unauthorized administrative capabilities that CWE-284 captures.
CWE-286prevents — Privileged access rights assume correct user accounts exist; the control does not manage user creation or removal.
CWE-288prevents — Privileged access rights control reduces risk of bypass through elevated or alternate paths.
CWE-290prevents — Privileged access rights reduce attack surface but do not prevent spoofing of authentication.
CWE-291prevents — Privileged-access rules require authenticated users rather than implicit IP trust.
CWE-408prevents — Privileged access rights limit who can perform costly actions but do not enforce authentication order.
CWE-412mitigates — Privileged access rights limit who can create or manipulate locks, reducing external influence.
CWE-419prevents — Privileged access rights directly restrict who can use the primary administrative channel.
CWE-422mitigates — Privileged access rights reduce the attack surface by limiting processes that run elevated and can be targeted via shatter attacks.
CWE-424prevents — Privileged access rights must be enforced on every possible route to privileged functions.
CWE-507mitigates — Privileged access rights reduce the ability to install or run Trojan Horse code but do not eliminate it.
CWE-520mitigates — Restricting privileged access rights directly limits the ability to grant impersonation privileges that escalate .NET process rights.
CWE-556mitigates — Privileged access rights policy limits the use of impersonation to only what is strictly required.
CWE-612prevents — Privileged access rights may be used to enforce index restrictions but are not the primary control.
CWE-638prevents — Privileged access rights management reduces risk but does not mandate per-access mediation.
CWE-639mitigates — Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
CWE-642prevents — Restricting privileged access rights reduces the chance that state data can be tampered with by unauthorized users.
CWE-653mitigates — Privileged access rights require strict isolation from ordinary user contexts.
CWE-708prevents — Privileged-access rules often include ownership checks, yet the control focuses on elevated rights rather than ownership correctness.
CWE-732prevents — Documented authorization, expiry rules, and audit logging of privileged accounts make it harder for critical resources to retain overly permissive or stale permission assignments.
CWE-749prevents — Privileged access rights limit who can invoke dangerous methods, but do not address whether the method itself should exist.
CWE-782prevents — Privileged access rights directly restrict who may invoke sensitive IOCTLs.
CWE-842prevents — Privileged access rights depend on correct groups, yet the control focuses on elevated privileges rather than group assignment accuracy.

Mitigated MITRE ATT&CK techniques (879)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001.001←M T1001.003←M T1003←P →P T1003.001→M T1003.002←M →P T1003.003←M →P T1003.004→P T1003.005←M →P T1003.006→M T1003.007←M →P T1003.008→M T1006←F →P T1014←M T1021→P T1021.001←P →P T1021.002→M T1021.003←P →P T1021.004→P T1021.005←P →P T1021.006←P →P T1021.007←P →P T1021.008→M T1027.002←M T1027.005←M T1027.006←M T1027.007←M T1027.008←M T1027.009←M T1027.010←M T1027.011←M T1027.014←M T1027.016←M T1030←P T1036←M T1036.003←M T1036.004←M T1036.005←M T1036.007←M T1036.008←M T1036.009←M T1036.010←M →P T1036.011←M T1037→P T1037.001→P T1037.002←P →P T1037.003←M →P T1037.004→P T1037.005→P T1047←M →P T1053→P T1053.002→P T1053.003→P T1053.005←M →P T1053.006→P T1053.007→P T1055←M →P T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M →P T1055.005←M T1055.008←M →P T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1056.002←M T1056.004←M T1057→P T1059←M →P T1059.001→P T1059.003←M →P T1059.004→P T1059.008←M →P T1059.009→P T1059.012→P T1059.013→P T1068←M →P T1070←M T1070.003←M T1070.010←M T1071←M T1071.001←M T1071.004←M T1072→M T1078→P T1078.001→P T1078.002→P T1078.003→P T1078.004→M T1082→P T1083→P T1087.001→P T1087.003→P T1087.004→P T1095←M T1098→P T1098.001→P T1098.002→P T1098.003→P T1098.004→P T1098.005→P T1098.006→M T1098.007→M T1102←M T1102.001←M T1102.002←M T1102.003←M T1104←P T1110→P T1110.001→M T1110.002←P →P T1110.003→P T1110.004→P T1111←M T1112←M →P T1114.002→P T1114.003→P T1127←M T1127.001←M →P T1127.002←M T1127.003←M T1133←M →P T1134→P T1134.001→P T1134.002→P T1134.003→P T1134.004←M →P T1134.005←M →P T1136←P →M T1136.001←M →P T1136.002←P →P T1136.003→P T1137→P T1137.001→P T1137.005→P T1137.006→P T1176←M T1185←M →P T1187→P T1189←P T1199→P T1202←M T1204←P T1204.001←M T1204.002←M T1204.003←M T1204.004←M T1205←P T1205.002→P T1207→P T1211←M T1212←M T1213→P T1213.002→P T1213.003→P T1213.006→P T1216←M T1216.001←M T1216.002←M →P T1218←M T1218.001←M T1218.002←M →P T1218.003←M →P T1218.004←M →P T1218.005←M →P T1218.007←M →P T1218.008←M →P T1218.009←M T1218.010←M →P T1218.011←M T1218.012←M →P T1218.013←M →P T1218.014→P T1219←M →P T1219.002←M →P T1219.003←M T1220←M T1221←M T1222←M →P T1222.001←M →P T1222.002←M →P T1480.001←M T1484→P T1484.001→P T1484.002←M →P T1485→P T1485.001→P T1489←P →P T1490←M T1496.004→P T1497←M T1505→P T1505.001→P T1505.002→P T1505.003→P T1505.004→P T1505.005←P →P T1505.006←P →P T1528←M →P T1529→P T1530→P T1535←M T1537←M →P T1538→P T1539←F T1542←M T1542.002←M T1542.003←M T1543←P →P T1543.001→P T1543.002←M →P T1543.003←M →P T1543.004←M →P T1543.005←M →P T1546→P T1546.001→P T1546.002→P T1546.003←M →P T1546.004←M →P T1546.005→P T1546.007→P T1546.008←M →P T1546.009→P T1546.010→P T1546.011←M →P T1546.012←M →P T1546.013←P →P T1546.014→P T1546.015→P T1546.016←M →P T1546.017→P T1547←P →P T1547.001←M →P T1547.003→P T1547.004←P →P T1547.005←F →P T1547.006←M →P T1547.010→P T1547.012←M →P T1547.014→P T1547.015→P T1548→P T1548.001←M →P T1548.002→P T1548.003→M T1548.004→P T1548.005→M T1548.006←M →P T1550→P T1550.001→P T1550.002←M →P T1550.003→P T1550.004←F →P T1552→P T1552.001→P T1552.006←M →P T1552.007→P T1553←P T1553.001←M T1553.002←M T1553.003←M →P T1553.004←P T1553.005←M T1553.006←M →P T1555←M →P T1555.001→P T1555.002←P →P T1555.004→P T1555.006→P T1556→P T1556.001→P T1556.002←F T1556.003←M →P T1556.004←M T1556.005←P →P T1556.006←M →P T1556.007←M →P T1556.008←M →P T1556.009←M →P T1558←M →P T1558.001←M →P T1558.002←M →P T1558.003→P T1558.004→P T1558.005←M →P T1559.003←M →P T1561→P T1563→P T1563.001←M →P T1563.002→P T1564.002→P T1564.004←M T1564.008→P T1564.013→P T1565→P T1565.001→P T1566.002←M T1566.003←M T1566.004←M T1569→P T1569.001→P T1569.002→P T1569.003→P T1571←M T1572←M T1574←M →P T1574.001←M →P T1574.004←M →P T1574.005←P →P T1574.006←M →P T1574.007→P T1574.008←P →P T1574.009→P T1574.010←M →P T1574.011←M →P T1574.012←M →P T1574.013←M →P T1574.014→P T1578←M →P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005←M →P T1580→P T1583.007←M T1586←P T1586.003←M →P T1589.001←P T1598.003←M T1599←M T1599.001←P T1600←P T1600.001←P T1601←P →P T1601.001←P →P T1601.002←P T1602.001→P T1602.002→P T1606←M T1606.001←F T1606.002←M →P T1609→P T1610←P →P T1611←M →P T1612←P T1620←M T1621←M →P T1622←F T1647←M T1648←P →P T1649←M →P T1650←M T1651←P →P T1666←M →P T1671←M →P T1675→P T1677←P T1684→P T1684.002←P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M T1685.004←M →P T1685.005←M →P T1685.006←M T1686←F →P T1686.001←M →P T1686.002←M →P T1686.003←M →P T1687←M T1688←M T1689←M T1690←M

Why these map — AI rationale (under review)

T1003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces credential-dumping attempts that use or abuse privileged rights; this is genuine detection but only a minority slice of T1003 (most OS credential dumping does not require privileged rights or leave a privileged-access footprint).
T1003prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth, regular review, break-glass temporaries, no generic IDs, and separation of admin vs daily identities directly stop most paths that would let an adversary obtain the elevated rights or sessions needed to run OS credential dumping tools.
T1003.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces (i.e. detects) the administrative/SYSTEM-level access needed to harvest LSASS credentials; the remainder of the technique (SSP modification, WerFault abuse, non-privileged dump vectors) is outside the clause's scope.
T1003.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged access directly stop most administrative/SYSTEM-level harvesting of LSASS credential material (the dominant vector described), with a bounded remainder for non-privileged in-memory or SSP-modification paths that do not require elevated rights.
T1003.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of SYSTEM-level privileges needed to access the SAM; this is genuine detection of the technique's prerequisite but does not address the credential extraction itself or non-privileged vectors.
T1003.002prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, re-authentication, review, and non-sharing rules for privileged rights directly stop many (but not all) paths to the SYSTEM-level access required to enumerate the SAM database
T1003.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged identities or tools (e.g. ntdsutil.exe, Volume Shadow Copy under admin context) needed for this technique; this is genuine detection of a slice but leaves the bulk (non-privileged access paths, backup searches, or unmonitored tools) unreached.
T1003.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher authentication requirements for privileged access directly stop many (but not all) paths to obtaining the elevated rights needed to run Volume Shadow Copy, ntdsutil.exe or similar on a DC, while leaving some residual paths (e.g. already-compromised admin sessions, misconfigured backups, or non-privileged enumeration vectors) unaddressed.
T1003.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of SYSTEM-level privileges needed to reach LSA secrets; this is genuine detection of a prerequisite but does not instrument the registry read, memory dump, or Mimikatz execution itself.
T1003.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication requirements for privileged access directly constrain who can obtain the SYSTEM-level rights needed to read LSA secrets, but do not block all paths (e.g. initial compromise granting SYSTEM without using a managed privileged account, or post-compromise techniques that never touch the controlled identity layer).
T1003.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged access directly stop many (but not all) paths to the SYSTEM/sudo level required to reach and dump the cached credential stores.
T1003.006detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces DCSync execution by privileged accounts (the only ones that can perform it), but this is only one narrow slice of possible detection (no requirement for real-time monitoring, anomaly detection on replication APIs, or coverage of non-privileged precursors).
T1003.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication requirements for privileged rights directly constrain who can obtain the Domain Admin/Enterprise Admin membership needed to run DCSync, preventing the technique for most legitimate paths; residual exists for already-compromised accounts, misconfigurations, or sanctioned exceptions.
T1003.007prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop the root-privilege slice of T1003.007 (the dominant vector described in the source prose); they do not constrain the non-privileged self-process or browser-permission vectors, which is a genuine minority remainder
T1003.008detects — A.8.2 point (j) explicitly requires logging all privileged access, which surfaces the root-level read of /etc/shadow that the technique depends on; the remainder (non-privileged vectors or unmonitored logs) keeps it from mostly.
T1003.008prevents — A.8.2 directly controls allocation, approval, temporary/just-in-time issuance, re-authentication, least-privilege separation, and revocation of root-level rights; the technique requires privileged (root) read access to /etc/shadow, which these measures stop in most cases, with a bounded remainder for break-glass or misconfigured exceptions.
T1006detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged identities or tools (e.g. vssadmin, NinjaCopy) that enable T1006; this is genuine detection of a slice of the technique but leaves the bulk (non-privileged direct volume access, non-privileged shadow-copy utilities, or unmonitored platforms) unreached.
T1006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights directly constrain the elevated access needed to run volume-bypass tools such as NinjaCopy, vssadmin, or raw disk I/O, but only for the subset of T1006 that relies on explicit privilege escalation rather than the technique's full scope (including unprivileged shadow-copy utilities or direct volume handles obtainable without admin rights).
T1021detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of privileged users, which can surface anomalous privileged remote logins after the fact; this is a genuine but minority slice of T1021 (most remote service abuse uses non-privileged valid accounts or abused legitimate apps, which the control does not address).
T1021prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights directly stop many (but not all) valid-account abuses of remote services such as SSH/RDP that rely on privileged or domain-admin credentials; ordinary user accounts and non-privileged remote logons remain outside its scope.
T1021.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces RDP logons that use privileged accounts; this is genuine detection of the technique when it uses the privileged slice, but the technique also succeeds with ordinary non-privileged accounts that fall outside the control's scope.
T1021.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged rights directly constrain use of privileged accounts (including domain admins or local admins) with RDP, which is the dominant vector for this technique; it does not address normal/least-privilege accounts that can also be used with RDP.
T1021.002detects — A.8.2 clause j explicitly requires logging all privileged access for audit purposes, which surfaces use of admin-level accounts over SMB admin shares; this is genuine detection but only a slice (no requirement for real-time alerting, anomaly detection on SMB traffic, or coverage of non-privileged vectors).
T1021.002prevents — A.8.2 directly controls allocation, approval, review, temporary/break-glass issuance, re-authentication, non-sharing, and admin-only use of privileged accounts, which stops most administrator-level Valid Accounts from being available or usable for SMB admin share access; the bounded remainder is stolen credentials, pass-the-hash, or already-compromised admin sessions that the control does not reach.
T1021.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged accounts (the prerequisite for this technique) after the fact; this is genuine but only a slice because the control does not require or address detection of the DCOM lateral-movement activity itself once the account is already in use.
T1021.003prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain the 'appropriately privileged user' prerequisite that the technique relies on, but only for the administrative slice of valid accounts rather than all accounts that can invoke DCOM.
T1021.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged rights directly stop most SSH logins that abuse valid but over-privileged accounts, with the bounded remainder being non-privileged SSH use of stolen credentials.
T1021.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, higher authentication, and no-generic-ID rules for privileged rights directly constrain abuse of privileged VNC sessions (especially those using admin/root accounts), but leave ordinary-user VNC sessions (the technique's dominant case) and non-privileged VNC configuration untouched.
T1021.006detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged accounts over WinRM when those accounts qualify as privileged; this is genuine detection of the technique but only a minority slice, as the bulk of T1021.006 executions can use non-privileged valid accounts that fall outside the control's scope.
T1021.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged access directly stop many (but not all) abuse paths that rely on valid privileged accounts for WinRM, leaving a remainder when normal-user accounts, misconfigurations, or already-compromised credentials are used.
T1021.007prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth/step-up, review, temporary/break-glass, non-shared identities and admin-only use directly constrain the subset of T1021.007 that relies on privileged synchronized/federated accounts; it does not address normal/regular accounts, application access tokens or the login mechanisms themselves.
T1021.008prevents — A.8.2 directly controls allocation, approval, temporary/just-in-time issuance, higher authentication, expiry, review, and non-sharing of privileged rights (including root/SYSTEM), which stops most abuse of valid privileged accounts for direct cloud VM console access; residual slice remains for initial compromise paths that obtain already-authorized privileged credentials.
T1036.010detects — A.8.2 requires logging all privileged access (j) plus regular review of privileged users/rights (g) and awareness measures (e), which can surface masquerading attempts that create or rename privileged accounts with names like root/admin; this is a genuine but minority slice of the technique that also targets non-privileged accounts and non-privileged naming patterns across many platforms.
T1036.010prevents — A.8.2's rules on identifying/allocating/reviewing privileged rights, avoiding generic IDs like “root”/“admin”, using temporary/break-glass access, and separate identities directly constrain the creation or long-term use of masquerading privileged/service accounts, but do not stop all name approximation (especially non-privileged or post-discovery modeling) on every platform.
T1037detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged accounts or escalation in boot/logon scripts when they trigger higher-privilege execution; this is genuine detection of a slice of the technique but leaves the bulk (non-privileged script placement, persistence without privilege, or unmonitored platforms) unreached.
T1037prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop adversaries from obtaining or retaining the admin-level rights most boot/logon scripts require to run with elevated privileges or achieve persistence/escalation; the remainder is the minority slice where local-credential (non-privileged) execution paths or already-installed scripts on unmanaged platforms still succeed.
T1037.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of an admin account (one of the two access configurations the technique depends on) but does not surface the technique when only local credentials are used or when the logon script runs without triggering a privileged-access event.
T1037.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separation of privileged vs. day-to-day identities directly constrain the administrator-account prerequisite for configuring HKCU logon scripts, but do nothing against the local-credentials path that the technique explicitly allows.
T1037.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the administrator-permission modification of the login hook plist that the technique requires; this is genuine detection of the technique in flight or after the fact, but only a minority slice because the control is silent on log review, alerting, or coverage of non-privileged precursor steps and the technique is deprecated post-10.11.
T1037.002prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly constrain the administrator/root-level modification of the login hook plist that the technique requires, but the control is silent on the specific plist mechanism, on non-privileged vectors, and on already-deprecated hooks, leaving a genuine minority slice prevented.
T1037.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of an admin account (or equivalent elevated rights) to configure or assign a network logon script; this is genuine detection of the technique when it requires privileged rights, but the technique can also succeed with only local credentials on non-privileged accounts, which the control does not address.
T1037.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights directly constrain the admin-account prerequisite for assigning and running network logon scripts as persistence, but do not block the local-credential path or all possible assignment vectors.
T1037.004detects — A.8.2 point (j) explicitly requires logging all privileged access (including the root-level modifications to RC scripts needed for this technique), which surfaces the abuse when audited; this is only a slice of the full technique surface because the control does not require monitoring of the resulting boot-time execution or non-privileged precursor steps, and many lightweight/embedded platforms in the technique's scope have limited or no audit logging.
T1037.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged (root) access directly constrain the root-level modification of RC scripts on covered Unix-like systems; it does not reach the full set of platforms, deprecated/legacy cases, or non-privileged vectors that still allow the technique.
T1037.005prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly constrain who can create or modify the privileged root-level StartupItems directory and its boot-time executable, preventing the technique for the bulk of managed identities while leaving a remainder for unmanaged/default configurations or break-glass scenarios.
T1047detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of who holds rights; this surfaces anomalous or unauthorized WMI use when it occurs through privileged identities, but the control does not mandate detection of WMI abuse itself, non-privileged local execution vectors, or post-execution artifacts outside the privileged-access lens.
T1047prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher-authentication requirements for privileged access directly constrain abuse of WMI (an administration feature) by limiting who can legitimately invoke it and under what conditions, but leaves a nameable remainder: already-authorized admins, remote WMI via WinRM/DCOM, and non-privileged local WMI calls that do not require elevated rights.
T1053detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of privileged accounts to create or modify scheduled tasks/jobs (the core of T1053); this is genuine detection but only a minority slice of the technique (most T1053 executions do not require privileged rights, and the control is silent on analyzing the logs or detecting the scheduling itself).
T1053prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many (but not all) paths to obtaining the admin/privileged group membership required to schedule remote or elevated tasks, especially on Windows and similar platforms; residual paths remain via initial compromise, un-reviewed local accounts, or non-privileged scheduling vectors.
T1053.002detects — A.8.2 requires logging all privileged access (item j) plus awareness measures and periodic review of who holds rights; this surfaces use of at by privileged accounts (the dominant Windows path and the sudo path on Linux) after the fact, but does not instrument the at utility itself, non-privileged at.allow paths, or WMI scheduling, leaving a large unmonitored slice.
T1053.002prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly constrain who can obtain the administrator/superuser rights required to invoke at, preventing the technique for most non-privileged users; it does not reach the baseline superuser case, sudo allowances, or at.allow/at.deny misconfigurations that still permit the technique.
T1053.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces cron-based abuse when it uses elevated rights (e.g. root crontab), but the control is silent on non-privileged cron jobs, non-privileged detection mechanisms, and real-time alerting rather than post-facto audit review.
T1053.003prevents — A.8.2's authorization, approval, least-privilege allocation, temporary/break-glass rules, re-authentication, review, and non-generic-ID requirements constrain who may create or modify privileged cron jobs (especially root/system-level ones), but do not stop an already-authorized user or compromised privileged account from abusing cron for persistence.
T1053.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of privileged rights to create or hide scheduled tasks (e.g. via schtasks or SYSTEM-level registry changes); this is genuine detection of the technique but only a minority slice, as most T1053.005 execution paths (normal-user persistence, WMI, lateral movement without privilege escalation) fall outside privileged-access logging.
T1053.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic-ID, and separate-identity rules for privileged access directly stop many (but not all) abuse paths that require elevated rights to create or hide scheduled tasks under SYSTEM or other privileged contexts; the remainder is abuse under already-authorized admin sessions or non-privileged local task creation.
T1053.006detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged paths and systemctl commands that install or activate privileged systemd timers; this is genuine detection of the root-persistence slice but leaves user-level timers and non-privileged activation entirely unreached.
T1053.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop adversaries from obtaining the root-level privileges needed to write timers to /etc/systemd/system or /usr/lib/systemd/system, but user-level timers in ~/.config/systemd/user require no privilege and are untouched.
T1053.007detects — A.8.2 requires logging of all privileged access (item j) plus awareness, re-authentication, and regular review of privileged users/roles, which can surface anomalous or unauthorized use of container-orchestration privileges to create malicious CronJobs, but does not mandate detection of the resulting job execution or persistence itself.
T1053.007prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain who can create or schedule orchestration jobs (a privileged cluster operation), but leave open non-privileged vectors, misconfigurations, and already-compromised accounts that can still abuse CronJobs.
T1055prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separation of privileged vs. day-to-day identities constrain who can obtain the elevated rights often needed to perform many process-injection techniques, but do not stop injection itself when those rights are legitimately held or when the technique runs without privilege escalation.
T1055.001prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass grants, re-authentication, and review of privileged rights prevent many privilege-elevation paths that DLL injection relies on, but do not stop the core technique of writing/loading into a process that already holds rights or the evasion of process-based defenses.
T1055.002prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass grants, re-authentication, review, and separation of admin vs. daily identities constrain which processes can be created with elevated rights and therefore which processes an adversary can target for PE injection, but do not stop an already-privileged process from using VirtualAllocEx/WriteProcessMemory/CreateRemoteThread against another privileged or same-user process.
T1055.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous privileged behavior that can indicate Thread Execution Hijacking when it elevates privileges or uses privileged handles; this is a genuine but minority slice of the technique (most instances do not require or visibly use privileged rights).
T1055.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the elevated-privilege slice of T1055.003 (and the prerequisite handles/rights needed for SuspendThread/SetThreadContext), but do not stop the core memory-unmapping and code-injection steps that can succeed at the same integrity level.
T1055.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces APC injection when it is performed with or results in privileged rights (the technique's own stated goal), but the control is silent on non-privileged APC injection and on detection mechanisms beyond privileged-access logging.
T1055.008prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass grants, re-authentication, and review of privileged rights directly constrain the elevated-privilege slice of ptrace injection (which the technique itself notes is often impossible against higher-privilege targets), but do not address the core mechanism of attaching to and modifying a non-privileged running process.
T1057prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly block the elevated-privilege slice of T1057 that yields richer process details; normal-user discovery paths (ps, tasklist, /proc, CLI show processes) remain available, so the coverage is a genuine but minority slice of the technique.
T1059prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many abuse paths that rely on elevated interpreters (e.g. root shells, admin PowerShell), but ordinary-user interpreters and non-privileged script abuse remain untouched.
T1059.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic, and separate-identity rules for privileged access directly stop many (but not all) abuse paths for PowerShell that require elevated rights, such as remote Invoke-Command or certain admin-level cmdlets; non-privileged execution vectors, in-memory DLL usage, and non-elevated discovery remain outside its reach.
T1059.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many (but not all) abuse paths that rely on elevated rights to launch or control cmd.exe, while ordinary-user cmd abuse and non-privilege aspects of the technique remain untouched.
T1059.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of elevated Unix shell commands (the subset of T1059.004 that requires elevated privileges); this is genuine detection but only a minority slice of the technique, which also covers non-privileged shell abuse, scripts, and interactive shells via C2 or SSH on unprivileged accounts.
T1059.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher authentication requirements for privileged rights directly constrain the elevated-privilege slice of Unix shell abuse (the technique's own text flags that certain commands require elevated privileges), but leave the non-privileged shell execution vector untouched.
T1059.008detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of elevated CLI commands on network devices; this is genuine detection but only a slice (no requirement for real-time alerting, anomaly detection on command content, or coverage of non-privileged interpreter abuse).
T1059.008prevents — A.8.2's authorization, allocation, review, temporary/break-glass, least-privilege separation, and higher-authentication rules for privileged rights directly constrain who can legitimately reach the elevated CLI commands that T1059.008 abuses on network devices; this stops the technique for the bulk of ordinary users but leaves a bounded remainder (legitimate admins whose credentials are still phishable or whose sessions can be hijacked).
T1059.009detects — A.8.2 requires logging of all privileged access (item j) plus periodic review of who holds rights (item g), which surfaces anomalous or unauthorized cloud-API use when it occurs via privileged identities, but does not mandate detection of the API abuse itself or cover non-privileged credentialed abuse.
T1059.009prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged rights directly stop many abuse paths that rely on over-provisioned or persistent cloud API permissions, but leave open slices such as legitimate admin identities that are later phished or abused via session cookies/tokens.
T1059.012detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of hypervisor CLIs when they are used with privileged identities; this is genuine detection but only a slice (no requirement for real-time alerting, anomaly detection on non-privileged use, or coverage of all hypervisor platforms).
T1059.012prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop most unauthorized abuse of hypervisor CLIs (which require admin-level rights on the hypervisor), but leave a bounded remainder: legitimate privileged users who are already authorized can still run the CLI maliciously, and the control does not reach every hypervisor configuration or non-privileged vector.
T1059.013detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged container CLIs/APIs (e.g. docker/kubectl by admins) after the fact; this is genuine detection of the technique when it uses elevated rights, but the bulk of T1059.013 (non-privileged SDK/API abuse, image pulls, discovery) sits outside privileged-access logging.
T1059.013prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic-ID, and separate-identity rules for privileged access directly stop many (but not all) abuse paths that rely on obtaining or using elevated rights to reach the Docker/K8s CLI or API.
T1068detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of who holds rights, which can surface anomalous or unauthorized privilege-escalation events after they occur; this is genuine but only a minority slice of T1068 because the bulk of the technique (vulnerability exploitation, BYOVD, kernel-mode execution) is not inherently revealed by privileged-access logging or review alone.
T1068prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and higher-authentication rules for privileged rights directly constrain the permission constructs that T1068 must circumvent via vulnerability exploitation, but do not address the underlying vulnerable code or driver itself.
T1072prevents — A.8.2 directly controls the identification, allocation, review, temporary/break-glass issuance, non-sharing, and higher-authentication of privileged rights needed to access or administer deployment tools, so the technique cannot run on systems built under it; the bounded remainder is pre-existing or externally provisioned tools reached via already-compromised credentials that the clause does not retroactively revoke.
T1078prevents — Requiring explicit authorization, time-bound allocation, separate privileged identities, and regular reviews sharply limits the ability of an adversary to abuse valid accounts with elevated rights.
T1078detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous use of valid (including compromised or inactive) privileged accounts; this is genuine detection but only a minority slice of the technique, which also covers non-privileged accounts, credential theft itself, and non-audited vectors across its broad platform scope.
T1078.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of default privileged accounts (e.g. root, Administrator, vpxuser) after the fact; this is genuine detection but only a minority slice of the technique, which also covers non-privileged defaults, unchanged factory credentials on appliances, and credential abuse that never triggers a privileged-access log.
T1078.001prevents — A.8.2's authorization, allocation on-event/minimum-privilege, expiry, review, temporary/break-glass, no-generic-ID, and separate-identity rules directly stop many default privileged accounts (built-in root/Administrator, factory appliance accounts, post-integration vpxuser) from remaining usable, but leaves the initial creation of the default account itself and the post-installation change-it requirement unaddressed.
T1078.002prevents — Domain accounts granted privileged rights must be individually authorized, time-limited, and reviewed, reducing the window and scope for domain-level abuse.
T1078.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use/abuse of domain accounts with high privileges after the fact; this is a genuine but minority slice of the technique (credential compromise, password reuse, initial access, persistence, and non-privileged domain accounts sit outside the privileged-access logging scope).
T1078.003prevents — Local privileged accounts are issued only after authorization, with expiry and non-sharing rules, making long-term or shared local-admin compromise harder.
T1078.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of local privileged accounts (a core slice of T1078.003) after the fact; this is genuine detection but only partial because the control is scoped to privileged/admin identities and does not address non-privileged local accounts, credential dumping, or password reuse on standard user accounts.
T1078.004prevents — A.8.2 directly controls allocation, review, temporary/break-glass use, higher authentication, non-shared identities, and least-privilege rules for privileged cloud accounts, stopping most T1078.004 abuse vectors (over-privileged accounts, persistence via extra creds, role-assumption misconfigs); residual slice remains for initial compromise of non-privileged cloud accounts later elevated or for hybrid/federated credential theft outside the clause's direct reach.
T1082prevents — A.8.2's authorization, allocation, review, temporary/break-glass, and non-sharing rules for privileged rights directly block the technique's explicit privileged-access vectors (e.g. systemsetup on macOS, esxcli on ESXi, many admin CLI/API calls) but leave the non-privileged discovery paths (systeminfo, normal-user APIs, network-device show commands) untouched.
T1083prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, re-authentication, and non-sharing rules for privileged accounts stop many (but not all) discovery attempts that require elevated rights, while ordinary-user discovery and non-privileged paths remain untouched.
T1087.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged accounts directly prevent many (but not all) local-account-enumeration paths that rely on privileged execution of net/id/dscl/esxcli or direct /etc/passwd reads by non-privileged users.
T1087.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many authenticated Exchange/Outlook GAL-enumeration paths that rely on elevated rights, but the technique also succeeds with normal authenticated sessions that need no privilege at all.
T1087.004prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, re-authentication, review, and non-generic-ID rules constrain which identities can call the discovery APIs listed in the technique, so the technique cannot run for many accounts; it remains possible for any identity that legitimately holds the enumerated privilege.
T1098prevents — Any manipulation or addition of privileged rights must pass the same authorization and logging controls, limiting an adversary’s ability to persist via account changes.
T1098detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces account manipulation when it touches privileged identities or rights; this is a genuine but minority slice of the broad technique that also covers non-privileged accounts, credential changes, and permission-group manipulations outside the privileged-access scope.
T1098.001prevents — A.8.2's authorization process, role-based allocation, temporary/break-glass grants, re-authentication, expiry, regular reviews, and prohibition on generic/shared IDs directly stop adversaries from adding unauthorized credentials or keys to cloud accounts and service principals.
T1098.002detects — A.8.2 requires logging of all privileged access (item j) plus regular review of who holds such rights (item g), which surfaces anomalous or unauthorized delegation/permission grants after the fact in monitored environments, but only for the subset of cases that trigger privileged-access logging or review rather than all mailbox-permission changes.
T1098.002prevents — A.8.2's authorization, allocation, review, temporary-grant, non-sharing, and admin-only rules for privileged rights directly stop most legitimate-user or post-compromise escalation paths that add mailbox/folder delegate permissions, but do not block an already-privileged adversary from invoking the same mechanisms (Add-MailboxPermission, Admin console, etc.) against other accounts.
T1098.003detects — A.8.2 requires logging of all privileged access (item j) plus regular reviews of who holds privileged rights (item g), which can surface anomalous role additions after the fact; this is genuine detection of the technique but only a slice, as the control does not mandate real-time monitoring, anomaly detection on IAM/policy changes, or coverage of external-account role additions.
T1098.003prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly stop many of the account/role modifications the technique names, but the control is silent on external-tenant role additions and on the initial compromise that supplies the permissions needed to call AttachUserPolicy/CreatePolicyVersion.
T1098.004prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules directly stop many (but not all) ways an adversary can add an unauthorized key to authorized_keys or escalate via it; the control addresses the privilege-management slice of the technique but leaves residual paths (e.g., direct file edits after initial compromise, config-file changes, or already-authorized but misused keys) outside its scope.
T1098.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous device-registration events performed with privileged rights (e.g. MFA/Intune enrollment under a compromised account); this is genuine but only a slice, as the technique can also be executed without privileged rights or via self-enrollment paths that fall outside the privileged-access logging scope.
T1098.005prevents — A.8.2's authorization process, approval, temporary grants, higher authentication, expiry, and review requirements constrain who can register devices (especially in MFA/Intune/Entra ID contexts) and limit abuse of privileged enrollment paths, but do not stop credential-compromised or self-enrollment scenarios that require only username/password or bypass conditional access.
T1098.006detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the creation or modification of elevated container roles when performed through privileged identities; this is genuine but only a slice because the technique can also be performed via direct policy/ABAC edits that do not route through a monitored privileged session, and detection depends on subsequent audit review rather than real-time instrumentation mandated by the control.
T1098.006prevents — A.8.2's authorization process, role-based allocation on least-privilege/event basis, expiry, re-auth, regular reviews, temporary/break-glass use, no generic IDs, and separation of admin vs. daily identities directly stop an adversary from successfully adding extra ClusterRoles/RoleBindings or ABAC policy changes to maintain persistence; the bounded remainder is post-compromise abuse of already-approved privileged identities that still satisfy the policy.
T1098.007detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the addition of groups to accounts when that action uses or results in privileged mode; this is genuine detection of the technique but only a slice, as the control does not mandate monitoring of the group-addition commands themselves, non-privileged precursors, or all platforms/contexts where the technique can occur.
T1098.007prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separation rules directly stop most adversary additions of groups to controlled accounts by gating who may legitimately modify privileges and how; residual is post-compromise abuse of already-approved privileged identities or un-reviewed changes.
T1110detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces brute-force attempts against privileged accounts when reviewed; this is a genuine but minority slice of T1110 (most brute force targets non-privileged accounts, occurs offline, or evades logging via external services or conditional-access bypass).
T1110prevents — A.8.2's authorization, allocation, expiry, re-authentication, temporary/break-glass, non-generic IDs, separate identities, and review requirements for privileged accounts raise the bar for brute-force success on those accounts (higher auth, limited windows, no shared/root IDs), but do not stop brute force against normal accounts, offline hashes, or the bulk of T1110's described vectors.
T1110.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces guessing attempts that succeed or reach privileged accounts; this is genuine detection but only a minority slice of the technique, which primarily targets normal accounts, non-privileged services, and non-privileged vectors such as external SSO, email, or wifi authentication.
T1110.001prevents — A.8.2 directly controls allocation, approval, temporary/just-in-time issuance, higher authentication, expiry, review, non-generic IDs, and separation of privileged vs normal identities; these stop guessing from succeeding against the accounts that matter, with a bounded remainder on exempted/legacy/service accounts that the clause itself acknowledges.
T1110.002prevents — A.8.2's authorization, allocation, expiry, re-authentication, temporary/break-glass, non-generic IDs, and review requirements constrain how privileged accounts are issued and used, which directly raises the bar for cracked credentials to be usable on those accounts; this is a genuine but minority slice of T1110.002 (most cracking targets normal-user or dumped hashes, and the control does not stop hash acquisition or the cracking computation itself).
T1110.003prevents — A.8.2's authorization, allocation, expiry, re-authentication, review, temporary/break-glass, non-shared identities and admin-only rules for privileged accounts directly stop many password-spraying vectors that rely on guessing or reusing weak/default creds against privileged or management-service accounts, but the control is silent on normal-user accounts, non-privileged services, throttling evasion, and the bulk of the technique's listed low-privilege targets.
T1110.004prevents — A.8.2's authorization, allocation, expiry, re-authentication, temporary/break-glass, non-shared identities, and no-generic-ID rules constrain privileged credential overlap and reuse that credential stuffing exploits on management services and admin accounts, but leave normal-user credential stuffing, SSO/federated targets, and non-privileged accounts untouched.
T1112prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged accounts directly constrain the administrator-level access required for many T1112 Registry modifications (especially defense-evasion, persistence, and remote cases), but leave ordinary-user Registry areas, already-compromised admin sessions, and non-privilege-dependent sub-techniques untouched.
T1114.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces credentialed abuse of Exchange/Office 365 admin rights (a common vector for T1114.002); this is genuine detection of the technique when it uses privileged identities, but the technique can also succeed with ordinary user credentials or external tokens that never touch privileged rights, leaving a large unaddressed slice.
T1114.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher authentication for privileged rights prevent many (but not all) paths to credentialed Exchange/Office 365 access that enable T1114.002, especially admin-level collection; normal-user credential theft and external token abuse remain outside its scope.
T1114.003prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly stop many (but not all) abuse paths that rely on admin or elevated rights to create forwarding rules or transport rules; normal-user creation paths and post-compromise credential abuse remain outside its scope.
T1127.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized use of MSBuild (a common privileged build tool) after the fact; this is genuine detection but only a minority slice of the technique, which can be invoked by non-privileged processes or without triggering privileged-access logging.
T1127.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access can prevent an adversary from obtaining the elevated rights typically needed to abuse MSBuild for arbitrary code execution, but this is only a slice — the technique can still run from non-privileged user context or via other unaddressed vectors such as compromised build processes.
T1133prevents — A.8.2 controls allocation/review/expiry of privileged rights and higher authentication for them (including on remote-service gateways), which stops many valid-account and privileged-abuse vectors for T1133 but leaves unauthenticated exposed services, Tor hidden services, and non-privileged remote access untouched.
T1134detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces token manipulation performed under elevated context; this is genuine detection but only a minority slice of the technique (standard-user runas/impersonation and non-privileged AD-field manipulation sit outside the privileged-access scope the control governs).
T1134prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher-authentication rules for privileged rights directly constrain the prerequisite privileged context and token-stealing paths that T1134 requires, but standard-user runas/impersonation and AD-field mechanisms sit outside its scope.
T1134.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces token-impersonation activity when it uses or results in privileged context; this is genuine detection but only a slice of the technique (non-privileged impersonation, in-memory theft without subsequent privileged use, or non-audited sessions remain unseen).
T1134.001prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth/step-up, regular review, break-glass temporality, no-generic-IDs, and separate-admin-identity rules constrain when and how privileged tokens exist and can be duplicated/impersonated, but do not stop an already-compromised process/thread from calling DuplicateToken(Ex) on a valid token it can access.
T1134.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged tokens to create processes; this is genuine detection but only a slice (no requirement for real-time monitoring, anomaly detection on token duplication, or coverage of non-privileged precursor steps).
T1134.002prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth, review, no-generic-ID, temporary/break-glass, and separate-identity rules directly constrain the prerequisites (specific privileges, token access, impersonation rights) needed to create a process with a foreign token, but do not stop all paths (e.g. already-compromised admin sessions or unmonitored duplication).
T1134.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the creation and use of new/impersonated tokens when they exercise elevated rights; this is genuine detection but only a slice, as the technique can succeed without triggering privileged-mode logging (e.g. early in escalation, non-audited tokens, or non-Windows).
T1134.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged rights directly constrain the creation and use of new tokens to impersonate/escalate, but only for authorized/competent users and processes under policy — leaving the technique executable by an already-compromised account or via unmonitored paths.
T1134.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, and non-sharing rules for privileged rights directly constrain the 'given appropriate access rights to the parent process' slice that enables elevation via PPID spoofing, but do not address the larger evasion-of-monitoring use case or block the CreateProcess API itself.
T1134.005prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly constrain who can obtain the Domain Administrator (or equivalent) rights needed to perform SID-History injection, so the technique is prevented for accounts that never receive those rights; the remainder is the already-privileged accounts that the control still allows to exist and that can still execute the injection.
T1136prevents — Privileged account creation is gated by an authorization process and recorded, preventing attackers from creating stealthy new privileged accounts without detection.
T1136.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the creation of privileged local accounts when performed with elevated rights; this is a genuine but minority slice of the technique (most local-account creation uses ordinary user context or occurs outside monitored privileged sessions).
T1136.001prevents — A.8.2's authorization, allocation-on-demand, expiry, review, temporary/break-glass, non-generic, and non-shared rules for privileged rights directly stop many (but not all) adversary-created local accounts used for persistence, especially admin ones; it does not reach non-privileged local accounts or creation before the control applies.
T1136.002prevents — A.8.2's authorization, allocation-on-demand, expiry, review, temporary/break-glass, non-generic-ID and separate-identity rules constrain creation of privileged domain accounts (including admin/service ones), but do not stop an already-privileged adversary from creating ordinary domain user accounts that still achieve the persistence goal described in the T1136.002 prose.
T1136.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces creation of privileged cloud accounts when they are used; this is genuine detection of the technique but only a minority slice because most T1136.003 accounts can be created with minimal privileges that avoid triggering privileged-access logging.
T1136.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic, and least-privilege rules for privileged rights directly stop many adversary-created cloud accounts (esp. those with elevated or service-principal roles) from being granted or persisting; it does not reach low-privilege service accounts or creation outside the privileged-access process.
T1137prevents — A.8.2's authorization, allocation, review, temporary 'break-glass', non-sharing, and separate-identity rules for privileged access directly stop many Office-addin/macro/rule abuse paths that require elevated rights to install or register at startup, but leave ordinary-user Office persistence mechanisms (e.g. user-level templates or rules) untouched.
T1137.001prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID, separate-identity and higher-authentication rules for privileged rights directly stop an adversary (or insider) from obtaining and using the elevated rights needed to write to protected template locations or change GlobalDotName/trusted locations, but the control does not reach macro-enablement policy, search-order hijacking without privilege, or the initial compromise that lets the adversary reach those rights.
T1137.005prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain the administrative rights needed to create or modify Outlook rules that enable this persistence technique, but the control does not reach non-privileged user mailboxes or rule creation by already-compromised normal accounts.
T1137.006prevents — A.8.2's authorization, review, temporary-grant, least-privilege, and non-generic-ID rules for privileged rights directly stop many (but not all) Office add-in persistence paths that rely on elevated rights to register or auto-execute code at startup.
T1185detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of the high-integrity/SeDebugPrivilege rights the technique needs; this is genuine detection of a prerequisite but does not surface the injection, proxy setup, or session hijacking itself.
T1185prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged rights (including SeDebugPrivilege and admin-level rights needed for browser injection/pivoting) stop many but not all paths to the technique, as normal-user browser processes remain hijackable without any privileged rights.
T1187detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the authentication events central to T1187 when they involve privileged accounts or break-glass use; this is genuine detection but only a slice of the technique (non-privileged victims, non-SMB vectors, or pre-authentication forcing remain outside its scope).
T1187prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID, separate-identity and higher-authentication rules for privileged accounts constrain the privileged-account slice of forced authentication (e.g. .SCF on admin desktop, EFSRPC against privileged service accounts), but leave the far larger normal-user slice (spearphishing documents, ordinary shares) untouched.
T1199prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separation of privileged vs. day-to-day identities directly constrain the elevated/trusted third-party accounts that T1199 abuses, but the control addresses only the defender's own granting and management practices and does not reach the upstream compromise of the third-party organization itself.
T1205.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the elevated-permissions prerequisite for installing socket filters on Unix-like or Windows platforms, but leave a bounded remainder (e.g., initial privileged foothold obtained via other means, or non-privileged filter installation vectors).
T1207detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the Administrator/KRBTGT-level privilege use required to register a rogue DC; this is genuine but only a slice because the technique's bypass of SIEMs, metadata tampering, and post-registration replication changes sit outside the privileged-access logging mandated here.
T1207prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly constrain the Administrator/KRBTGT-level privileges required to register a rogue DC, but leave open the KRBTGT-hash path, post-compromise use of already-privileged identities, and the logging-bypass aspect of the technique.
T1213prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher authentication requirements for privileged access directly constrain the overly-broad or unauthenticated repository access that the technique exploits, but only for the privileged slice of the attack surface while leaving normal-user, misconfigured or public repository access untouched.
T1213.002prevents — A.8.2's authorization, least-privilege allocation, expiry, re-authentication, review, temporary/break-glass, and non-sharing rules for privileged accounts directly stop many privilege-escalation paths that would let an adversary reach and mine a SharePoint repository, but do not address normal-user read access, misconfigured SharePoint permissions, or already-leaked data.
T1213.003prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass, re-authentication, review, and non-sharing rules for privileged rights directly stop many (but not all) unauthorized access paths that let an adversary reach and collect from a private code repository once inside the victim network.
T1213.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged DB access directly stop many (but not all) adversary collection paths that rely on stolen or over-privileged credentials, leaving the remainder of direct credential theft, misconfigured cloud IAM, or already-compromised normal accounts that can still reach the DB.
T1216.002detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and re-authentication that can surface anomalous privileged use; this can detect the technique when it is launched from a privileged context or identity, but the bulk of T1216.002 executions occur from standard user processes via wscript.exe without any privilege escalation or privileged identity, which the control does not instrument.
T1218.002prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, separate admin identities, and higher authentication for privileged rights prevent many (but not all) abuse paths that rely on privileged execution of control.exe or registered CPLs; phishing-delivered or non-privileged proxy use remains outside its scope.
T1218.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces CMSTP.exe abuse when it triggers UAC bypass or elevated COM execution; this is genuine detection of the technique in privileged contexts but only a minority slice of the class (most CMSTP abuse runs at medium integrity without touching privileged rights, and the clause does not mandate host/process monitoring beyond privileged sessions).
T1218.003prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, re-authentication, review, and non-sharing rules for privileged rights directly stop many (but not all) CMSTP UAC-bypass and signed-binary proxy-execution paths that rely on elevated rights or generic admin accounts.
T1218.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of InstallUtil when it is invoked under a privileged identity; this is genuine detection of the technique in a subset of executions but leaves the bulk (non-privileged or non-audited runs) unreached.
T1218.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many (but not all) InstallUtil abuse paths that rely on elevated rights or bypasses of application control via signed binaries.
T1218.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged utilities such as mshta.exe when it is invoked under an elevated identity; this is genuine detection of the technique in a minority slice (privileged context) while the bulk of mshta.exe abuse (normal-user proxy execution, inline scripts, remote HTA) lies outside the control's scope.
T1218.005prevents — A.8.2's authorization, allocation, expiry, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access can prevent an adversary from obtaining or retaining the elevated rights often needed to abuse mshta.exe in realistic attack chains, but the technique itself runs at user level and does not require privileged rights in all cases.
T1218.007detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which can surface msiexec.exe abuse when it results in elevated/SYSTEM execution; this is a genuine but minority slice of the technique (most T1218.007 abuse does not require or trigger privileged-access mode).
T1218.007prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and elevated-authentication requirements for privileged rights directly constrain the AlwaysInstallElevated policy path and the elevation-to-SYSTEM slice of the technique, but leave the signed-binary proxy/DLL/execution-abuse path (the dominant part of the description) untouched.
T1218.008detects — A.8.2 clause j explicitly requires logging all privileged access for audit purposes, which can surface abuse of signed binaries like odbcconf.exe when the execution occurs under an elevated/privileged context; this is only a slice of the technique (most documented abuse runs from unprivileged user context).
T1218.008prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many signed-binary abuse cases that rely on an already-privileged account or process, but leave open the remainder where the adversary already holds a normal (non-privileged) account that can invoke odbcconf.exe to bypass application control.
T1218.010prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, separate admin identities, and no-generic-ID guidance prevent many privilege-escalation paths that enable Regsvr32 abuse for proxy execution or bypass, but do not stop a user who already holds legitimate (even if narrowly scoped) privileged rights from invoking the signed binary
T1218.012detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which can surface anomalous or unauthorized use of verclsid.exe when it is invoked under an elevated/privileged context; this is a genuine but minority slice of the technique (most documented abuse runs under standard user rights without triggering privileged-access logging).
T1218.012prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights can block many abuse paths that rely on elevated COM/shell-extension execution, but the technique can still succeed from a normal user context or via unmonitored CLSID registration without crossing a privileged-rights gate.
T1218.013prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, separate admin identities, and review of privileged rights directly constrain which users/processes can legitimately invoke signed binaries like mavinject.exe with elevated rights, preventing many abuse paths; it does not block all signed-tool proxying or non-privileged invocation vectors.
T1218.014detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged tools such as mmc.exe when it is exercised with elevated rights; this is genuine detection of the technique in its dominant privileged form, but remains only a slice because the technique can also be invoked without privileged rights and the control does not mandate host/process-level monitoring of mmc.exe itself.
T1218.014prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many abuse paths that rely on obtaining or using privileged rights to run MMC as admin or with snap-ins, but leave open non-privileged execution vectors, custom .msc/CLSID abuse without elevated rights, and cases where privileges are already present or misconfigured.
T1219prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, review, and non-sharing of privileged identities constrain which accounts can legitimately run or install remote access tools with elevated rights, but do not stop post-compromise abuse of already-installed legitimate tools under normal-user permissions or built-in features such as Chrome Remote Desktop.
T1219.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged remote-desktop tools when they exercise elevated rights; this is genuine detection of a slice of the technique but leaves the bulk (non-privileged or non-audited use of the same legitimate tools) unreached.
T1219.002prevents — A.8.2's authorization, approval, temporary/break-glass, least-privilege, non-generic-ID, and review rules for privileged rights directly stop many legitimate desktop-support tools (VNC/TeamViewer/AnyDesk/RMM) from being granted or retained as privileged remote-control vectors; the remainder is tools installed under normal-user rights or bundled inside permitted apps such as Zoom/Chrome Remote Desktop, which the clause does not reach.
T1222prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged rights directly constrain the elevated-privilege prerequisite that T1222's modifications (ACL changes, ownership, symbolic-link tampering) routinely depend on, but do not stop an already-privileged adversary or block all non-privileged vectors such as owner-permission changes.
T1222.001detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and re-authentication that can surface anomalous privilege use; this detects some Windows DACL modification via privileged tools (icacls/takeown/etc.) but leaves the bulk of non-privileged or post-grant modifications undetected.
T1222.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights directly constrain who can run the Windows commands (icacls, takeown, etc.) that perform the T1222.001 permission modification, but do not reach the technique when executed under already-compromised normal-user rights or via non-privileged vectors.
T1222.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights directly constrain who can run chown/chmod to change ownership or modes on Linux/macOS, stopping the technique at its prerequisite; it is only partial because the control governs the rights themselves rather than blocking every possible abuse once rights are legitimately held, and does not reach non-privileged vectors or all platform nuances.
T1484detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the elevated permissions needed to perform T1484; this is genuine detection coverage for the permission-abuse vector but only a minority slice of the technique (most T1484 vectors, GPO/trust/federation changes, and post-modification reversion live outside privileged-access logging).
T1484prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic-ID, and separate-identity rules for privileged access directly constrain the 'sufficient permissions' prerequisite for T1484, but leave open vectors such as initial compromise of an already-privileged account, abuse of approved GPO changes, or post-modification reversion that do not violate the control's requirements.
T1484.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged rights to modify GPOs; this is genuine detection of the technique but only a minority slice because most of the technique (reading GPOs, writing to SYSVOL paths, using delegated non-privileged write rights, or post-modification effects) occurs without privileged access and is unreached by the control.
T1484.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged rights directly constrain the delegation and use of the write access needed to maliciously modify GPOs, but leave open slices such as already-delegated rights, misconfigured SYSVOL ACLs, and non-privileged read paths that can still enable follow-on abuse.
T1484.002prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly stop many (but not all) trust-modification actions that require elevated rights on AD, ADFS, Okta or AWS IAM tenants; the remainder is trust changes performed with already-compromised privileged identities or via paths outside the privileged-access gate.
T1485prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, re-authentication, review, and non-sharing rules for privileged rights directly block the Valid Accounts, credential dumping, and admin-share propagation vectors that T1485 malware relies on to reach and destroy data at scale; this is only a slice of the technique because local destruction by already-resident malware or non-privileged deletion commands remains possible.
T1485.001prevents — A.8.2's authorization process, role-based allocation, temporary 'break-glass' grants, re-authentication, regular reviews, and prohibition on generic/shared IDs directly constrain who can obtain the PutLifecycleConfiguration permission needed to modify a bucket's lifecycle policy, preventing the technique in most cases (with a bounded remainder for misconfigurations or insider abuse after legitimate grant).
T1489detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces (detects) the use of privileged identities to stop/disable services; this covers only the privileged subset of T1489 executions and leaves non-privileged service stops (or direct API use in cloud) undetected.
T1489prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID and separate-identity rules for privileged accounts directly prevent many (but not all) T1489 executions that rely on obtaining or abusing privileged rights to stop/disable services; the remainder includes non-privileged service stops, direct API abuse in cloud without privilege escalation, and cases where the adversary already holds valid privileged access.
T1496.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many hijacking paths that require elevated SaaS or cloud-admin rights to enable/abuse services, but leave open compromise of ordinary user-level SaaS accounts that can still send bulk spam or hijack models without ever touching privileged rights.
T1505prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules constrain who can legitimately install server software components, thereby stopping many (but not all) abuse paths that rely on privileged installation rights; the remainder is installation by already-authorized admins or via non-privileged vectors the clause does not address.
T1505.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights directly constrain who can create or modify stored procedures (or enable xp_cmdshell/CLR) on a SQL server, but only for the subset of cases that require elevated rights; the technique can still be realized by non-privileged database users or via other vectors.
T1505.002prevents — A.8.2's authorization, approval, least-privilege allocation, expiry, re-authentication, review, and non-generic-ID rules for privileged rights directly constrain who can register a malicious transport agent on Exchange, but the control addresses only the human/administrative slice and leaves developer-written .NET assemblies, automated registration paths, and non-privileged installation vectors untouched.
T1505.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces web shell activity when it exercises elevated rights on the web server; this is genuine but only a slice of the technique (placement, non-privileged execution, and client-side components remain unseen).
T1505.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged rights directly stop many (but not all) ways an adversary can plant and use a web shell that requires elevated rights to write to web root or execute as a privileged context.
T1505.004prevents — A.8.2's authorization, approval, temporary/break-glass, least-privilege, non-generic-ID, and review requirements for privileged rights directly stop many (but not all) malicious IIS component installs that require elevated rights on Windows servers; residual paths remain via already-compromised admin sessions or non-privileged install vectors.
T1505.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized use of privileges that would be required to modify/replace termsrv.dll or the ServiceDll registry value; this is genuine but only a slice of the full technique (DLL replacement can also be done without triggering privileged-access events if the adversary already has equivalent rights or uses other vectors).
T1505.006detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of who holds rights, which surfaces anomalous or unauthorized use of the esxcli/install privileges needed for malicious VIBs; this is genuine detection of the technique in flight or post-install but only a slice, as the control does not mandate host telemetry, integrity monitoring of VIB payloads/descriptors, or detection of the boot-time execution itself.
T1505.006prevents — A.8.2's authorization, approval, least-privilege allocation, temporary/break-glass rules, re-authentication, review, and non-generic-ID requirements for privileged rights directly constrain the administrative/esxcli access needed to install malicious VIBs or alter acceptance levels, but do not block all vectors (e.g. already-compromised admin sessions, force installs, or supply-chain VIBs).
T1528prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights directly constrain many token-theft vectors (service accounts, managed identities, OAuth grants, CI/CD tokens) by limiting who holds elevated rights and how they are used; it does not address social-engineering OAuth phishing or theft after a container/host compromise, leaving a genuine minority slice unaddressed.
T1529detects — A.8.2 requires logging all privileged access (item j) plus awareness measures and re-authentication that can surface anomalous privileged use of shutdown/reboot APIs or commands; this surfaces the technique when it uses SeShutdownPrivilege or admin rights, but the control is silent on non-privileged paths, direct hypervisor calls, or non-privileged BSOD methods, leaving a large remainder.
T1529prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, re-authentication, review, and non-sharing rules for privileged rights directly block the SeShutdownPrivilege (and equivalent admin rights) acquisition path that the technique requires on multiple platforms, but do not address all other vectors such as direct CLI commands, hypervisor consoles, or non-privileged shutdown APIs.
T1530prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged rights directly constrain the credential-abuse vector that lets adversaries reach cloud storage objects, but do not address the dominant misconfiguration vector (public/anonymous buckets outside any IAM).
T1537prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the privileged actions (API calls, SAS URI creation, backup sharing) needed to transfer data to an adversary-controlled cloud account, but only for the subset of T1537 that requires elevated rights rather than normal-user sharing/sync mechanisms.
T1538detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged credentials (including stolen ones) on a cloud dashboard; this is genuine detection of the technique but only a slice, as the control does not require real-time monitoring, anomaly detection on the GUI actions themselves, or coverage of non-privileged dashboard use.
T1538prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities and least-privilege rules for privileged rights directly stop many (but not all) stolen-credential scenarios that would otherwise let an adversary reach a cloud dashboard with elevated rights; the remainder is credential theft against ordinary non-privileged accounts that can still view dashboards.
T1543detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized creation/modification of system processes (services/daemons) when reviewed; this is genuine detection of the technique but only a slice, as the control does not mandate broader behavioral monitoring of process creation outside privileged contexts or automated alerting.
T1543prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many (but not all) unauthorized creations or modifications of system processes/services that rely on admin/root rights, especially on Windows/Linux/macOS where such actions are privilege-gated; residual paths exist via already-compromised admin sessions or non-privileged vectors.
T1543.001prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access rights constrain the subset of Launch Agent persistence that requires elevated rights or admin identities, but the technique's core (user-level .plist placement and execution) is explicitly outside its scope.
T1543.002detects — A.8.2 point j explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged identities when creating/modifying systemd services (especially those using root or elevated User= directives), but does not address non-privileged user-level services, generator-based creation, or symbolic-link placement without a privileged context.
T1543.002prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly stop many (but not all) of the privilege-escalating or persistence-enabling modifications to systemd unit files that T1543.002 describes; residual paths remain via generators, user-level units, or already-approved service accounts.
T1543.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged rights directly stop many (but not all) paths to creating/modifying services that require or yield elevated rights for persistence or escalation.
T1543.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the elevated-privilege installation or modification step required by T1543.004; this is genuine detection of the technique in flight but only a minority slice because the control does not address plist creation, masquerading, or post-install execution.
T1543.004prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain who can install or modify Launch Daemons (which require elevated rights), but leave open poor configurations, writeable directories and post-authorization abuse that the control does not address.
T1543.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the rootful docker/podman/kubelet modifications and DaemonSet deployments that require elevated rights, but do not reach all container-platform service-creation vectors (e.g. unprivileged user namespaces or misconfigured nodeSelector on already-compromised nodes).
T1546detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized use of elevated rights that often accompany T1546 abuse (e.g. via SYSTEM/service accounts), but the control does not mandate detection of trigger creation/modification itself or non-privileged event mechanisms.
T1546prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher-authentication requirements for privileged rights directly constrain the higher-privilege proxy (SYSTEM/service) slice that lets an adversary escalate via event triggers, but do not stop creation/modification of the triggers themselves or their use by already-privileged accounts.
T1546.001prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly constrain the subset of T1546.001 that requires admin or privileged Registry writes, but leave the user-level and non-privileged vectors untouched.
T1546.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous privileged use of screensaver-based persistence when it involves elevated rights; this is a genuine but minority slice of the technique (most instances use normal user context and registry manipulation without privileged access).
T1546.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized WMI event subscriptions that trigger elevated SYSTEM privileges; this is genuine detection of the technique but only a minority slice because the control is scoped exclusively to privileged-access events rather than the broader set of WMI subscriptions an adversary can create for persistence.
T1546.003prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly constrain the SYSTEM-elevating subscription step that requires admin rights to install filters/consumers/bindings, but leave the normal-user persistence slice (and many post-compromise execution paths) untouched.
T1546.004prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly stop the root-level slice of the technique (modifying /etc/profile and similar system files that require root), but do not constrain the larger user-level slice (modifying ~/.bash_profile, ~/.bashrc, ~/.zshrc etc. under a normal unprivileged account).
T1546.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged shells/commands where trap could be registered as persistence; this is genuine detection of a slice (privileged context) but leaves non-privileged trap registration and post-facto log review outside the control's scope.
T1546.007detects — A.8.2 requires logging of all privileged access (item j) plus periodic review of who holds rights (item g), which can surface anomalous or unauthorized netsh helper DLL registrations performed via elevated processes, but does not mandate monitoring of the registry paths, DLL loading, or netsh execution itself.
T1546.007prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain who can register a malicious Netsh helper DLL (a privileged registry write under HKLM), but leave open non-privileged vectors, incomplete enforcement, and post-compromise use of already-registered helpers.
T1546.008detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the SYSTEM-level execution that occurs when the accessibility-feature backdoor is triggered at the logon screen or via RDP; this is genuine detection of the technique in flight, but only a minority slice because the control is silent on the binary-replacement or registry-pointer modification steps that precede the trigger and on non-privileged-access variants of the same class.
T1546.008prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly stop most abuse of accessibility-feature binaries that run as SYSTEM, but the technique can still be realized via registry pointer changes or IFEO injection without ever allocating a new privileged identity.
T1546.009detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized use of the elevated-privilege mechanism abused by T1546.009; this is genuine detection of the technique in flight but only a minority slice because the control does not mandate host/process-level monitoring of the AppCertDLLs registry key or DLL loading itself.
T1546.009prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the elevated-privilege slice of T1546.009; they do not constrain the persistence slice nor block the underlying registry edit itself.
T1546.010detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized use of the elevated privileges obtained via AppInit DLLs; this is genuine detection of the technique's privilege-elevation outcome but only a minority slice, as the control does not address detection of the registry modification, DLL loading, or persistence aspects themselves.
T1546.010prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the elevation slice of T1546.010 but do not address the persistence slice, the underlying registry write that seeds the DLL list, or the technique on non-privileged processes.
T1546.011prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly constrain who can install or activate shims (an admin-only action per the technique description), but do not reach the many non-privileged persistence paths or the post-install abuse of already-present shims.
T1546.012detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized debugger/IFEO use that yields elevated SYSTEM processes; this is genuine detection of the technique in flight but only a minority slice of the class (most IFEO abuse is Registry manipulation or silent-exit registration that does not itself constitute privileged access).
T1546.012prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly stop many (but not all) IFEO-based privilege-escalation and persistence paths that rely on obtaining or abusing privileged rights to write the debugger/silent-exit Registry values.
T1546.013detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized use of elevated rights (including profile-driven escalation by a privileged account); this is genuine detection but only a minority slice of the technique, which can also abuse non-privileged user profiles for persistence without ever touching privileged access rights.
T1546.013prevents — A.8.2's authorization, allocation on event-by-event/minimum-privilege basis, expiry, re-authentication, regular review, temporary/break-glass use, no-generic-IDs, and separate-admin-identity rules directly constrain who can reach and modify privileged PowerShell profiles, preventing the technique for most privilege-escalation paths; partial because the control does not reach unprivileged profile modifications that still grant persistence, nor does it stop all admin-account abuse vectors.
T1546.014prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly constrain the admin/root-level abuse needed to write emond rules or alter its plist, but leave open non-privileged vectors, misconfigurations, and post-compromise persistence that do not require new privileged rights.
T1546.015prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain the elevated rights typically needed to hijack COM registry references for persistence, but the control is silent on the underlying registry-write mechanism itself and on non-privileged COM objects, leaving a genuine minority slice prevented.
T1546.016detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the elevated-privilege execution step central to this technique; this is genuine detection but only a slice, as the control does not require monitoring of the installer-script content, pre-execution modification, or non-privileged precursor steps.
T1546.016prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged rights directly constrain the elevation path that lets installer scripts inherit and abuse root/admin rights, but do not stop modified legitimate installers from being supplied to users who then willingly grant the elevated permission the technique requires.
T1546.017detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the root-level rule-file modifications that enable the technique; this is genuine but only a slice, as the control does not require monitoring of rule execution, background processes, or non-privileged indicators of the udev abuse.
T1546.017prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged (root) access directly constrain the root-level modification of udev rules that the technique requires; the slice left is non-privileged vectors or already-compromised root sessions that bypass the allocation process.
T1547prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly constrain the higher-privilege slice of T1547 (autostart mechanisms leveraged for elevation), but do not address the persistence-only slice or kernel modifications that do not require approved privileged rights.
T1547.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-privilege rules constrain which accounts can write the privileged HKLM run keys or all-users startup folder that enable this technique; they do not constrain the far larger set of per-user HKCU run keys or user-writable startup folders that the same technique routinely abuses under a normal account.
T1547.003detects — A.8.2 requires logging of all privileged access (item j) plus periodic review of privileged users (item g), which can surface the administrator-level registration step required by this technique; it does not instrument or surface the subsequent Local Service execution of the malicious time-provider DLL.
T1547.003prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain the admin rights needed to register a malicious time-provider DLL, but do not reach the underlying boot-time loading architecture itself or block all paths to privileged registration.
T1547.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which can surface anomalous or unauthorized Winlogon helper modifications when they involve privileged accounts or processes; this is only a slice of the technique (most abuse can be done without new privileged sessions and without touching monitored privileged identities).
T1547.004prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules for privileged access directly constrain who can legitimately modify the Winlogon registry keys (a privileged operation), thereby stopping many abuse paths; it leaves open attacker-controlled code already running with privileges or non-privileged persistence vectors that do not require privileged rights.
T1547.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized SSP registration activity when reviewed; this is genuine detection of the technique but only a minority slice because the control is scoped to privileged identities and does not mandate monitoring of the Registry keys, LSA process, or boot-time loading itself.
T1547.005prevents — A.8.2's authorization, review, temporary-grant, least-privilege, and non-generic-ID rules constrain who may legitimately modify the SSP registry keys or load a malicious SSP, preventing the technique for authorized users acting outside their approved roles; it does not stop an already-privileged adversary or a non-privileged user who first escalates by other means.
T1547.006prevents — A.8.2's authorization, approval, least-privilege allocation, temporary/break-glass issuance, re-authentication, review, and non-generic-ID rules for privileged rights directly stop non-privileged adversaries from obtaining the root-level rights needed to load malicious LKMs/kexts, but do not reach already-privileged users, kernel-signing bypasses, or SIP-disabled loading paths.
T1547.010detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the SYSTEM-level execution that occurs when a malicious port monitor DLL is loaded by spoolsv.exe; this is genuine detection of the technique's privileged outcome, but only a minority slice because the control does not require monitoring of the registry writes, AddMonitor API calls, or boot-time loading itself.
T1547.010prevents — A.8.2's authorization, allocation, review, temporary-grant, least-privilege separation, and generic-ID rules constrain who can legitimately write the registry value or call AddMonitor to install a malicious port monitor, blocking the technique for non-privileged actors; it does not stop an already-privileged adversary or block the boot-time loading itself.
T1547.012detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the SeLoadDriverPrivilege use, registry changes, spooler restart, and elevated execution that install/run the malicious print processor; this is genuine detection of the technique but only a slice (no requirement for real-time alerting, anomaly detection on the specific print-processor path or DLL load, or coverage of non-privileged precursor steps).
T1547.012prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher-authentication requirements for privileged rights directly constrain the SeLoadDriverPrivilege and admin-account steps needed to install a malicious print processor, but do not reach the boot-time loading mechanics, spooler restart, or registry/driver placement themselves.
T1547.014detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the elevated execution context (and associated registry changes under HKLM) after the fact; this is genuine detection of the technique but only a slice, as the control does not require monitoring of the registry writes themselves, the persistence artifact, or non-privileged user-context execution.
T1547.015prevents — A.8.2's authorization, approval, least-privilege allocation, temporary/break-glass rules, re-authentication, and review of privileged rights directly constrain the ability of an adversary (or compromised account) to add a malicious login item that requires elevated rights, but the control addresses only the privileged slice of the technique while leaving normal-user login-item addition (via AppleScript or shared file list) untouched.
T1548prevents — Stronger authentication, step-up re-authentication, and separate privileged identities raise the bar for bypassing or abusing elevation mechanisms.
T1548detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of elevation mechanisms after the fact; this is genuine detection but only a minority slice of the broad technique (most sub-techniques and platforms are not covered by privileged-access logging alone).
T1548.001prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules directly constrain who may create or retain setuid/setgid bits on binaries, preventing many adversary-created or persistently-abused instances; it does not reach discovery/abuse of pre-existing vulnerable setuid binaries outside the authorization process.
T1548.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces UAC-bypass attempts that result in elevated/privileged execution; this is genuine detection of the technique in flight or after the fact, but only a minority slice because most listed bypasses (COM auto-elevation, eventvwr.exe, process injection, remote lateral movement) can succeed without ever triggering a privileged-access log entry or audit event.
T1548.002prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth/step-up, regular review, temporary/break-glass, no-generic-IDs, and separate-admin-identity rules directly stop many UAC-bypass vectors that rely on permanent admin rights, shared accounts, or insufficiently reviewed privileges, but leave residual paths (auto-elevation of signed binaries, COM hijacks, process injection into already-high-integrity processes, and lateral movement with known admin creds) untouched.
T1548.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces sudo/sudoers abuse after the fact; this is genuine detection but only a minority slice of the class (the technique can also be realized through NOPASSWD rules, timestamp tampering, or tty_tickets changes without necessarily crossing an observable privileged command boundary).
T1548.003prevents — A.8.2 directly governs the identification, allocation, review, temporary-use, least-privilege, re-authentication and logging of privileged rights (including sudo/sudoers configuration), which stops most misconfigurations and abuse vectors described in T1548.003; the bounded remainder is attacker-controlled modification of the sudoers file after initial compromise.
T1548.004prevents — A.8.2's authorization process, least-privilege allocation, temporary/just-in-time grants, higher authentication, review of privileges, and rules against generic IDs constrain many routes to unauthorized elevated execution via the API, but do not stop a malicious or masquerading program from prompting the user or loading modifiable files when the user supplies credentials.
T1548.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces (detects) the use/abuse of temporary elevated cloud access when it occurs; this is only a slice of the technique (e.g. does not address impersonation or PassRole abuse that evades the privileged-access identity distinction).
T1548.005prevents — A.8.2 directly governs the controlled allocation, temporary/event-based granting, expiry, approval, review, and non-permanent use of privileged rights (including break-glass just-in-time mechanisms), which stops most misconfigurations that enable abuse of temporary elevation paths; the bounded remainder is cloud-specific permission configurations (e.g. PassRole, serviceAccountUser) that still require correct implementation of those rules.
T1548.006prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged rights directly constrain the TCC database manipulation path that grants elevated macOS permissions, but leave the injection/inheritance and SIP-disable vectors untouched.
T1550detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of stolen alternate auth material when it is exercised through a privileged identity; this is genuine detection but only a slice of the technique (non-privileged use, purely in-memory pass-the-hash/ticket without crossing a logged boundary, or use of non-privileged application tokens remain outside the clause).
T1550prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authn rules for privileged rights constrain how and when alternate auth material (tickets, hashes, tokens) can be legitimately issued and used, preventing many lateral-movement scenarios that rely on stolen material; it does not reach theft itself or all caching/issuance paths.
T1550.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights directly constrain issuance and use of application access tokens that act with elevated privileges, but leave the initial theft/compromise vector, token refresh mechanics, and non-privileged token abuse untouched.
T1550.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces PtH use of stolen hashes when it occurs with privileged accounts; this is genuine detection but only a slice of the technique (non-privileged PtH, hash capture itself, and overpass-the-hash ticket creation remain outside the clause).
T1550.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate admin identities and higher authentication requirements for privileged accounts directly constrain the privileged accounts whose hashes are most useful for PtH lateral movement; it does not reach normal-user hashes or the credential-capture step itself.
T1550.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces PtT use of stolen high-privilege Kerberos tickets after the fact; this is genuine but only a slice because the control is scoped to privileged identities and does not address non-privileged service-ticket PtT, ticket creation via overpass-the-hash, or detection of the prerequisite OS Credential Dumping.
T1550.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate admin identities and higher authentication requirements for privileged rights directly constrain the acquisition and use of the high-privilege Kerberos tickets (TGTs, golden/silver) that enable PtT, but do not address credential dumping itself or ticket forgery from hashes/AES keys.
T1550.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous use of stolen session cookies when they confer privileged rights; this is a genuine but minority slice of the technique (most session-cookie abuse targets normal user sessions, not privileged ones).
T1552prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged access directly stop many insecure credential placements (e.g. generic root, shared admin creds, permanent keys in files) from arising on systems; it does not reach all unsecured credential forms (e.g. app-repo plaintext, shell history, or non-privileged-user artifacts) that live outside the privileged-access boundary.
T1552.001prevents — A.8.2's authorization, allocation, expiry, review, temporary/break-glass, non-generic IDs, separate identities, and no day-to-day use of privileged accounts directly constrain how and where privileged credentials are created/stored, preventing many (but not all) insecure credential-in-files scenarios such as shared stores, embedded passwords in configs, or permanent admin accounts.
T1552.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged access directly constrain the administrative use of GPP that embeds credentials, preventing many (but not all) instances of unsecured credential storage in domain policies.
T1552.007prevents — A.8.2's authorization, allocation, review, temporary/break-glass, least-privilege separation, and non-generic-ID rules for privileged rights directly stop many paths that would let an adversary obtain the sufficient permissions needed to call the Docker/Kubernetes APIs and harvest credentials, but leave open cases such as misconfigured service accounts, overly broad RBAC, or already-compromised normal identities that can still reach the APIs.
T1553.003prevents — A.8.2's authorization, least-privilege allocation, expiry, re-authentication, review, and non-generic-ID rules for privileged rights directly constrain the administrative access needed to modify SIP/trust-provider registry values or install hijacking DLLs, but leave open non-privileged vectors (e.g., unprivileged DLL search-order hijacking) and do not address the trust-provider logic itself.
T1553.006detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the elevated commands/utilities (bcdedit, csrutil, registry edits, kernel changes) typically needed to modify code signing policies; this is genuine detection of the technique in privileged contexts but only a slice, as the control does not mandate monitoring of the policy change artifacts themselves, non-privileged vectors, or post-reboot effects.
T1553.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and higher-authentication rules for privileged rights directly constrain the elevated permissions required to run policy-modification commands/utilities (bcdedit, csrutil, registry changes, kernel writes), preventing the technique on systems where those controls are enforced; it is only partial because the clause does not reach non-privileged policy toggles, default-disabled controls, or post-escalation kernel memory writes that bypass the authorization process.
T1555prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged access directly stop many (but not all) password-store accesses that rely on elevated rights, especially on managed systems; the remainder is unprivileged credential theft from user-level stores, browsers, or non-privileged password managers.
T1555.001prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, non-generic IDs, and separation of admin vs. daily identities constrain who can reach the privileged context needed to run `security` commands or read the Keychain file, but do not block the technique once that context is obtained or for non-privileged credential-gathering paths.
T1555.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain who can obtain or retain the root-level access required to read securityd memory, preventing the technique for the bulk of managed accounts and roles; the named remainder is pre-existing root sessions, local misconfigurations, or break-glass activations that still allow the read.
T1555.004prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged access directly stop many (but not all) ways an adversary can obtain and then use a privileged token or session to run vaultcmd, CredEnumerate, or read .vcrd/Policy.vpol files as the credential-manager owner.
T1555.006detects — A.8.2 clause j explicitly requires logging all privileged access for audit purposes, which surfaces the API calls that realize T1555.006 when they use privileged identities; this is genuine detection of the technique in flight, but only a slice (the privileged subset) rather than the full technique surface, which can also be realized through compromised services that hold retrieve permissions without exercising a distinct privileged identity.
T1555.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged access directly constrain the 'sufficient privileges' prerequisite the technique requires to call the secrets-manager APIs, but the control addresses only the human/administrative slice of privilege (roles, accounts, competence) and leaves service-principal or misconfigured IAM paths that can also reach the secrets untouched.
T1556prevents — Elevated authentication requirements and step-up re-authentication for privileged rights hinder attempts to weaken or bypass authentication processes.
T1556detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized privileged use that can indicate a modified authentication process; this is only a slice of the broad technique (which also includes non-privileged credential revealing, PAM/SAM/LSASS tampering without privilege, and non-auditable paths), so partial per the event-lane anchors for monitoring clauses.
T1556.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the anomalous privileged authentications enabled by the domain-controller patch; the remainder (in-memory patch itself, non-privileged use, or unmonitored DCs) is outside the clause's scope.
T1556.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or backdoored PAM use after the fact; this is genuine detection but only a slice of the full technique (credential harvesting or backdoor creation can occur without triggering privileged-access logs).
T1556.003prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules constrain who can legitimately modify PAM (a privileged operation on Linux/macOS), preventing many but not all adversary modifications or backdoors that could be introduced via other vectors such as supply-chain compromise or unmonitored maintenance.
T1556.005detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the Set-ADUser / FGPP / GPO changes an adversary must make to enable reversible encryption; this is genuine detection of the technique but only a slice (the configuration act itself), not the later credential extraction or the bulk of the technique's stealthier paths.
T1556.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged rights directly constrain the adversary's ability to set AllowReversiblePasswordEncryption via privileged means (GPO, FGPP, Set-ADUser, etc.), but do not reach the legacy-software exception case, non-privileged vectors, or already-enabled accounts.
T1556.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication requirements for privileged accounts constrain many of the privilege-abuse vectors used to disable or modify MFA (e.g. Conditional Access exclusions, registering rogue methods, or patching under admin rights), but do not stop all paths (e.g. initial compromise of a non-MFA account, hosts-file edits by already-privileged users, or MFA bypass at the identity-provider level before privilege escalation).
T1556.007detects — A.8.2 requires logging of all privileged access (item j) plus periodic review of privileged users/roles (item g), which can surface anomalous or unauthorized privileged activity on the on-premises side of a hybrid setup; this is genuine detection of a slice of the technique but does not address cloud-side modifications, PTA-agent DLL injection, AD FS config tampering, or backdoored synchronization processes themselves.
T1556.007prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID, separate-identity, and higher-authentication rules for privileged accounts constrain the on-premises privileged vectors (PHS sync account, PTA agent compromise, Global Admin registration) that enable the backdoor, but do not reach cloud-side modification of the hybrid auth process or the post-compromise DLL/config edits themselves.
T1556.008detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous privileged logons (including those on servers/domain controllers that the technique targets) and can reveal the credential-capture outcome; this is genuine detection of a subset of the technique's activity but leaves the bulk (DLL registration, Registry changes, non-privileged execution) unreached.
T1556.008prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged accounts directly constrain the adversary's targeting of admin logons on servers/domain controllers (the technique's explicit focus), but do not address the core registry-based registration of a malicious network provider DLL itself.
T1556.009prevents — A.8.2's authorization, allocation, review, temporary-grant, and higher-authentication rules for privileged rights directly constrain the ability to modify conditional access policies (a privileged act), but only for identities and processes under the control; the technique can still be executed against unmanaged identities, misconfigured policies, or via other vectors such as direct IAM condition edits outside the reviewed privileged set.
T1558detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces Kerberos ticket theft or forgery when performed via privileged accounts or tools, but the control does not mandate detection of the technique itself when executed without privileged rights or outside audited paths.
T1558prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged access directly constrain the privileged-user and credential-management vectors that enable Kerberos ticket theft or forgery on domain controllers and admin workstations, but leave the bulk of the technique (e.g., memory scraping of TGTs from any logged-on session, golden/silver ticket forgery via KRBTGT compromise, or pass-the-ticket from non-privileged processes) untouched.
T1558.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the privileged domain-controller access needed to obtain the KRBTGT hash; the remainder (forgery of the golden ticket itself and its later use) is outside the control's view.
T1558.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged access directly constrain how KRBTGT-level domain admin rights are granted and used on domain controllers, preventing the prerequisite privileged access needed to dump the hash in most cases; it does not address the separate credential-dumping vector itself or all possible compromise paths to the KRBTGT hash.
T1558.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces silver-ticket usage of forged service tickets; the remainder (offline forging without KDC interaction plus non-privileged precursor hash theft) is outside the clause's view.
T1558.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication requirements for privileged rights directly constrain the acquisition and use of service-account hashes needed to forge silver tickets, but leave residual paths (e.g., Kerberoasting of non-privileged service accounts, post-compromise hash theft, or incomplete enforcement of the listed measures).
T1558.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces Kerberoasting requests (TGS for SPNs often tied to service accounts with privileged rights) after the fact; this is genuine detection but only a slice, as the technique can also use sniffed network traffic without privileged access and many implementations do not audit every TGS request.
T1558.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher-authentication rules for privileged accounts directly constrain service accounts that hold SPNs (the root enabler of Kerberoasting), but service accounts are often required by applications and cannot be fully removed, leaving a bounded remainder that the control itself names.
T1558.004prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID and separate-identity rules for privileged accounts reduce the set of accounts an adversary can enumerate and roast (especially those with elevated rights that are most valuable post-crack), but the technique works against any domain account (privileged or not) that has pre-auth disabled, and the control never mandates enabling pre-authentication itself.
T1558.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights directly constrain the elevated-privilege impersonation path that stolen ccache tickets enable on Linux/macOS, but leave ordinary-user ccache theft (and subsequent Pass-the-Ticket) untouched.
T1559.003prevents — A.8.2 controls allocation/review/expiry of privileged rights and requires higher authentication plus separation of admin vs. daily identities, which can stop some XPC abuse paths that rely on over-provisioned or poorly reviewed privileged helper tools, but leaves the dominant slice (improper XPC client validation, poor input sanitization, and protocol-definition flaws in the application itself) untouched.
T1561prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the Valid Accounts, credential dumping, and admin-share propagation vectors that enable the direct-write access required for disk wipe, but leave the technique itself (and non-privileged local execution paths) untouched.
T1563detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces hijacking of privileged remote sessions (e.g. SSH/RDP) after the fact; this is genuine detection but only a minority slice of the technique (non-privileged sessions and non-auditable hijacks remain outside its scope).
T1563prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher authentication requirements for privileged rights directly stop many hijack paths that rely on weak or overly-broad privileged sessions (especially on SSH/RDP), but leave open hijacks of ordinary-user sessions and post-hijack use of already-approved sessions.
T1563.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces SSH agent/socket hijacking when it uses or escalates to privileged sessions, but the clause does not mandate monitoring, anomaly detection on agent sockets, or coverage of non-privileged SSH sessions that the technique can also abuse.
T1563.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights directly stop many root-level or agent-socket hijacks that rely on unmanaged or overly-broad privileged sessions, but leave open non-privileged SSH sessions, agent-forwarding in normal accounts, and key-based trust that the control does not reach.
T1563.002detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of privileged users/rights, which can surface anomalous RDP hijacking that uses or yields privileged sessions, but the control does not mandate detection of the hijacking technique itself or of non-privileged sessions.
T1563.002prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth/step-up, regular review, break-glass temporaries, no generic IDs, and separate admin identities directly constrain the privileged-session theft that RDP hijacking relies on; the remainder is hijacking of already-active non-privileged sessions or implementation gaps in the authorization process itself.
T1564.002prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules constrain who can create or modify the privileged accounts that adversaries then hide, but do not stop the platform mechanisms (plist edits, registry keys, gsettings, dscl, chflags) an already-authorized administrator or compromised privileged session can still use.
T1564.008prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, review, and non-sharing of privileged identities constrain who can create or modify inbox/transport rules that hide emails, but do not stop a legitimately authorized user (or adversary with their valid credentials) from creating the rule once access is granted.
T1564.013prevents — A.8.2's authorization, allocation, review, temporary-grant, and non-sharing rules for privileged rights (including sudo) constrain who can execute the mount command that realises T1564.013, but do not stop a properly authorised user or compromised privileged process from performing it
T1565prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher authentication requirements for privileged access directly stop many (but not all) paths that would let an adversary obtain the elevated rights or specialized access typically needed to perform complex data manipulation on business-critical systems or processes.
T1565.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly block many (but not all) paths to the elevated/specialized access typically required to manipulate stored data at rest on complex systems.
T1569detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of privileged system services/daemons when they require elevated rights; this is a genuine but minority slice of T1569 (most service abuse does not require or use privileged identities, and the control does not mandate service-specific monitoring).
T1569prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many (but not all) abuse paths that rely on privileged service creation/modification/execution, especially on Windows; the remainder is unprivileged service abuse plus remote unauthenticated service interactions outside the privileged-rights boundary.
T1569.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces abuse of launchctl when it is used with elevated rights on macOS; this is genuine detection but only a slice, as the technique can also be used without privileged rights or outside audited sessions.
T1569.001prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, review, and non-generic-ID requirements for privileged rights directly stop many (but not all) launchctl abuse paths that rely on obtaining or retaining elevated rights to load/start agents or daemons.
T1569.002detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of who holds rights; this surfaces anomalous or unauthorized use of the service control manager for execution when it involves privileged identities, but the technique can also be used without privileged rights or via unmonitored non-privileged service manipulation, leaving a large unaddressed slice.
T1569.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-privilege rules directly constrain who can legitimately reach and abuse the service control manager for execution, but only for the subset of T1569.002 that depends on privileged access (most instances do, yet the technique can also be used by unprivileged local users or via already-compromised service contexts).
T1569.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of systemctl (a privileged mechanism for systemd service control) when performed with elevated rights; this is genuine detection but only a slice, as the technique can also be invoked without privileged rights or outside audited sessions.
T1569.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, least-privilege separation, and non-generic-ID rules directly stop many (but not all) unauthorized uses of systemctl to spawn or control systemd services as a privileged technique.
T1574prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separation of admin vs. daily identities constrain several privilege-elevation vectors inside T1574 (e.g. hijacking via privileged processes or poisoned locations reachable only by admins), but leave the bulk of the class (DLL search-order hijacks, unprivileged path poisoning, LD_PRELOAD, etc.) untouched.
T1574.001detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized privileged DLL abuse (especially privilege-escalation paths) when reviewed; this is genuine detection but only a minority slice of the full technique surface (sideloading, search-order hijacking, phantom hijacking, and non-privileged cases are unreached).
T1574.001prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly stop many privilege-escalation paths that rely on a hijacked DLL executing at elevated level, but do nothing against the persistence or defense-evasion slices of the technique that do not require privileged rights.
T1574.004prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID and separate-identity rules constrain who can run with elevated rights and therefore who can place a malicious dylib that inherits those rights, but do not stop the loader-search or weak-link placement itself on macOS.
T1574.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights directly constrain the higher-privilege execution path that the technique relies on, but leave the underlying installer permission weakness (in %TEMP% or elsewhere) untouched.
T1574.006prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separation of privileged vs. day-to-day identities constrain who can set LD_PRELOAD/DYLD_INSERT_LIBRARIES in privileged contexts or on protected processes, but do not stop unprivileged users, developers, or non-privileged processes from using the technique on ordinary binaries.
T1574.007prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass issuance, review, and non-sharing rules for privileged rights directly stop many (but not all) ways an adversary can obtain the write access or privileged context needed to plant a binary in an earlier PATH entry or alter $PATH/$HOME.
T1574.008detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous privileged execution that can result from search-order hijacking when the hijacked payload runs with elevated rights; this is a genuine but minority slice of the technique (most hijacks do not require or yield privileged execution).
T1574.008prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass grants, review of privileged rights, and rules against generic admin accounts constrain who can place or run hijacking binaries with elevated rights, but do not stop the underlying search-order vulnerability in unprivileged programs or force full-path usage.
T1574.009detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized privileged executions that can result from this technique when it leads to privilege escalation; this is a genuine but minority slice of the technique (most path interceptions are not tied to privileged processes or logged as such).
T1574.009prevents — A.8.2's authorization, allocation, review, temporary/break-glass, least-privilege separation of admin vs. daily identities, and logging of privileged rights directly constrain the privilege-escalation slice of unquoted-path hijacking when the vulnerable service/shortcut runs as a privileged process; they do not address the persistence slice or unquoted paths used by non-privileged processes.
T1574.010prevents — A.8.2's authorization, allocation on least-privilege/event basis, expiry, re-auth, review, temporary/break-glass, and non-shared identities directly constrain who can obtain the elevated rights needed to exploit a services-file-permissions weakness, but the control addresses only the rights-management slice and is silent on the underlying file-system permission flaw itself.
T1574.011prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and least-privilege rules for privileged accounts directly stop many (but not all) permission-flaw scenarios that let unprivileged users write service Registry keys; the control does not reach every misconfigured ACL on every service key.
T1574.012detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and periodic review of privileged users/rights; these surface anomalous or unauthorized privileged use that can enable COR_PROFILER abuse for privilege elevation or persistence, but the control does not address non-privileged process injection, in-memory registry-free variants, or .NET-specific profiling hooks outside explicit privileged sessions.
T1574.012prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, and separation of admin vs. daily identities constrain who can set privileged environment variables or run elevated .NET processes that would let COR_PROFILER execute a malicious profiler, but do not block the technique outright (e.g. in-memory process-scope abuse or non-privileged .NET hijacks remain possible).
T1574.013detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous privileged behavior that can include this technique when it results in privileged execution; the remainder (in-process memory tampering without a privileged identity or visible privilege transition) is unseen by this control.
T1574.014detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous privileged behavior that can include AppDomainManager hijacking when it triggers elevated rights or process tampering; this is a genuine but minority slice of the technique (most variants are file/env tampering without necessarily crossing a privileged-access boundary).
T1578detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of elevated rights often needed to perform T1578 modifications; this is genuine detection of a key enabling condition but only a minority slice of the full technique (e.g. it does not address unaudited direct API calls, non-privileged modification paths, or post-modification evasion).
T1578prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic, and separation rules for privileged rights directly stop many (but not all) unauthorized modifications of cloud compute infrastructure that rely on illicit privilege escalation or persistent admin accounts.
T1578.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, and non-generic-ID rules for privileged rights directly constrain the adversary's ability to obtain or leverage the permissions needed to create a snapshot for evasion on IaaS, but do not reach all permission-granting paths or non-privileged vectors that could still enable the technique.
T1578.002detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the creation of a cloud instance when performed with elevated rights (a common prerequisite for the technique on IaaS); this is genuine detection but only a slice, as the technique can also be executed without privileged rights or via unmonitored non-privileged vectors.
T1578.003detects — A.8.2 requires logging of all privileged access (item j) plus periodic review of privileged users (item g), which can surface anomalous deletion of cloud instances performed via privileged accounts, but does not require monitoring or detection of the deletion action itself when performed without privileged rights or via other vectors.
T1578.004detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of the privileged APIs/dashboard commands that perform the revert; this is genuine detection of the technique when it uses privileged rights, but the control is silent on non-privileged vectors, ephemeral storage resets, or post-revert forensic indicators, leaving an open remainder.
T1578.005prevents — A.8.2's authorization, approval, least-privilege allocation, temporary/break-glass, re-auth, review, and non-generic-ID rules for privileged rights directly stop many (but not all) unauthorized configuration-modification paths that adversaries use after initial compromise, especially those requiring elevated cloud-admin rights; residual paths remain via already-authorized accounts or non-privileged vectors.
T1580prevents — A.8.2's authorization, allocation, review, temporary/break-glass, least-privilege-like, and non-generic-ID rules for privileged rights directly stop many (but not all) compromised or over-privileged accounts from successfully calling the discovery APIs that T1580 relies on; the remainder is discovery performed with normal (non-privileged) credentials that still have read access to some resources.
T1586.003prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged rights directly constrain the compromise and use of privileged cloud accounts (especially service-provider ones), but do not address the many non-privileged cloud account compromise vectors (phishing, spraying, token theft, purchased creds) named in the technique.
T1601prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop most paths that would let an adversary obtain the rights needed to replace or modify the monolithic OS image on a network device.
T1601.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic-ID, and separate-identity rules for privileged access directly stop the administrative-level access required for the primary in-memory debug-command method of patching a live network-device OS image; they do not address boot-loader/ROMMONkit paths, storage-file replacement via TFTP/SCP, or post-compromise use of already-privileged sessions.
T1602.001prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, and non-generic admin IDs directly stop many unauthorized SNMP queries that rely on privileged read access to MIB OIDs, but the control addresses only the privilege-management slice and leaves community-string, unauthenticated SNMPv1/2c, or misconfigured read-only exposures untouched.
T1602.002detects — A.8.2 requires logging of all privileged access (item j) plus awareness measures and re-authentication that can surface anomalous privileged use; this surfaces a slice of T1602.002 that routes through privileged accounts or management protocols, but most of the technique (SNMP queries, Smart Install, unauthenticated config exports) sits outside privileged-access monitoring.
T1602.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities, and higher authentication requirements for privileged access directly stop many (but not all) paths to using management tools like SNMP/SMI to dump configs on network devices
T1606.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities, and higher-authentication rules for privileged rights constrain the issuance and use of highly-privileged SAML tokens, but do not stop an adversary who already possesses (or can generate) a valid token-signing certificate from forging one with any claims.
T1609detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces use of privileged container administration commands (e.g. docker exec, kubectl exec) after the fact; this is genuine detection but only a minority slice of the technique, which also includes non-privileged entrypoint abuse at deployment time.
T1609prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID, and separate-identity rules for privileged access directly stop many (but not all) paths to the 'sufficient permissions' the T1609 description requires for kubelet/Kubernetes API/Docker daemon abuse.
T1610prevents — A.8.2's authorization, least-privilege allocation, temporary/break-glass rules, re-authentication, and review of privileged rights directly stop adversaries from obtaining the elevated rights needed to deploy privileged/vulnerable containers that bypass defenses or enable host escape; this covers the privileged-container slice of T1610 but leaves ordinary (non-privileged) container deployment and many deployment vectors untouched.
T1611prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and higher-authentication rules for privileged rights directly block the privileged-container and privilege-escalation vectors named in T1611, but do not address bind-mount configuration, docker.sock exposure, or hypervisor vulnerabilities that do not require privileged rights.
T1621prevents — A.8.2's requirements for higher authentication strength, re-authentication/step-up before privileged actions, temporary/just-in-time access, awareness of privileged mode, and avoiding generic/shared IDs constrain the credential-abuse and fatigue vectors that rely on privileged or elevated accounts, but do not address the core technique of generating MFA requests against normal/valid accounts or SSPR paths.
T1648prevents — A.8.2's authorization, allocation, review, temporary 'break-glass', non-generic IDs, and separation of privileged vs. normal identities constrain who can create/abuse privileged serverless functions or roles, but do not stop all abuse vectors (e.g. event-triggered execution by compromised normal identities or SaaS/Office Suite automation under existing perms).
T1649detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces anomalous or unauthorized certificate-related activity when it involves privileged identities or enrollment rights; this is genuine detection but only a minority slice of the technique (theft from stores, forging without privileged enrollment, golden certs via CA keys, or non-privileged misuse).
T1649prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic-ID, and separate-identity rules for privileged access rights constrain enrollment rights, SAN/EKU abuse, and root-CA key access that enable certificate theft or forgery for authentication, but leave many non-privileged certificate stores, misconfigurations, and direct theft vectors (e.g. from files or APIs) untouched.
T1651detects — A.8.2 clause j explicitly requires logging all privileged access for audit purposes, which surfaces abuse of privileged cloud admin commands (T1651) after the fact; this is genuine detection of the technique but only a minority slice because the bulk of the control is about authorization, allocation, review and prevention rather than detection, and logging is not required to cover the full technique surface (e.g. delegated/trusted-relationship paths).
T1651prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher-authentication requirements for privileged rights directly constrain the administrative access needed to abuse cloud management services (AWS SSM, Azure RunCommand, etc.), but the control is silent on the downstream VM-agent execution mechanics, delegated/trusted-relationship paths and post-compromise use of already-granted rights, leaving a genuine minority slice prevented.
T1666detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged identities (e.g. Global Administrator) to perform hierarchy-modifying actions such as CreateAccount/LeaveOrganization or subscription hijacking; this is genuine detection of the technique in flight but only a minority slice because most of T1666 can be realised without privileged-access events and the control does not mandate detection of the hierarchy change itself.
T1666prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic-ID, and least-privilege rules for privileged accounts directly constrain the Global Administrator or equivalent permissions needed to call CreateAccount, LeaveOrganization, or perform subscription hijacking, but only for the subset of cases that rely on privileged identities rather than any lower-privilege misconfiguration or inherited org-level rights.
T1671prevents — A.8.2's authorization process, role-based allocation, expiry, re-authentication, reviews, temporary grants, and separation of privileged identities constrain high-privileged consent that creates or approves malicious OAuth integrations, but do not stop low-privileged users from consenting to integrations, co-opting existing ones, or the persistence that survives account disablement.
T1675prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop most abuse paths that require elevated rights on the ESXi host to reach guest VMs via tools daemon or vSphere APIs; residual paths remain via already-compromised normal accounts, misconfigured defaults, or un-reviewed privileges.
T1684prevents — A.8.2's authorization process, approval requirements, temporary 'break-glass' grants, re-authentication, awareness of privileged mode, and regular reviews constrain the slice of social engineering that seeks privileged-access approvals or changes, but do not stop the broader technique of influencing any user action (e.g. password reset by non-privileged staff, disclosure, or routine SaaS consent).
T1685prevents — A.8.2's authorization, review, temporary-grant, non-generic-ID and separate-identity rules for privileged accounts constrain (and in some cases block) the adversary's ability to obtain the elevated rights typically needed to disable/tamper with security tools, but do not address non-privileged vectors, legitimate-driver/debug mechanisms, or already-compromised privileged sessions.
T1685.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, separate identities and higher-authentication requirements for privileged rights directly stop many of the Administrator-privilege paths (registry edits, auditpol changes, service disable) that the technique relies on; they do not stop the non-privileged WMI-Autologger-Security path or every possible misconfiguration, leaving a genuine minority slice unaddressed.
T1685.002detects — A.8.2 requires logging all privileged access (item j) plus awareness, re-auth, and review of privileged rights; this surfaces anomalous privileged use of the exact technique (disable/modify cloud logging) when performed with elevated rights, but does not instrument or surface the technique when executed without privileged rights or via non-privileged vectors such as license downgrade.
T1685.002prevents — A.8.2's authorization, allocation, review, temporary-grant, non-sharing, and separate-identity rules for privileged access directly stop many (but not all) permission paths that let an adversary reach and disable/modify cloud logging settings, leaving a bounded remainder of already-granted or misconfigured privileges and non-privileged vectors.
T1685.004prevents — A.8.2's authorization, allocation, review, temporary 'break-glass', non-shared identities, and higher authentication requirements for privileged access directly constrain the root-level abuse needed to disable/modify auditd, but do not stop all vectors (e.g. once legitimately privileged, an actor can still edit rules or hook functions, and generic-ID rules are conditional on system capabilities).
T1685.005detects — A.8.2 requires logging of all privileged access (item j) and awareness measures that can surface anomalous use of admin rights; this surfaces the administrator-privilege prerequisite for T1685.005 but does not instrument the log-clearing action itself once the rights are obtained.
T1685.005prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly constrain the administrator privileges required to run wevtutil, Remove-EventLog, or direct .evtx deletion, so the technique cannot be exercised by non-privileged users; it is only partial because the control does not reach the post-compromise administrator that already holds those rights, nor does it remove the clearing commands themselves.
T1686prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separate-identity rules for privileged access directly stop many (but not all) paths to the sufficient privileges the technique requires before tampering can begin
T1686.001detects — A.8.2 requires logging of all privileged access (item j) plus periodic review of privileged users/rights (item g), which surfaces anomalous or unauthorized firewall-modifying activity when performed via privileged identities, but does not mandate detection of the technique itself when executed without privileged rights or via non-logged vectors.
T1686.001prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-generic IDs, and separation of admin vs. daily identities directly constrain the 'appropriate permissions' prerequisite for an adversary to modify cloud firewall rules, but do not reach the post-permission modification act itself or non-privileged vectors.
T1686.002prevents — A.8.2's authorization, allocation, review, temporary/break-glass, non-shared identities and least-privilege rules for privileged access directly constrain the Valid Accounts vector that adversaries use to reach network-device management interfaces and alter firewall rules, but do not address exploitation of public-facing application vulnerabilities or indirect host-networking manipulations that also enable the technique.
T1686.003detects — A.8.2 point (j) explicitly requires logging all privileged access for audit purposes, which surfaces the use of privileged identities to run the firewall-modification commands or registry changes; this is genuine detection of the technique when it uses elevated rights, but the technique can also be executed at medium integrity without triggering privileged-access logging, and the control does not mandate host telemetry or anomaly detection on the firewall changes themselves.

Prevented OWASP Web Top 10 (2025) risks (12)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A02→P A06←P A07←P →P A10←P

Why these map — AI rationale (under review)

A01mitigates — A.8.2's authorization, temporary/break-glass, re-auth, least-privilege separation and logging of privileged rights limit the blast radius and detect some Broken Access Control realizations (esp. privilege-escalation paths), but do not bound most members such as path traversal, IDOR, CSRF or missing function-level checks on normal-user paths.
A01prevents — A.8.2 directly controls the allocation, review, temporary use, and separation of privileged rights (and associated authentication), squarely preventing the authorization-decision slice of A01 (CWE-862/863/284/732); it leaves untouched the non-authorization members (path traversal, CSRF, SSRF, information exposure) that dominate the 2025 category.
A02mitigates — A.8.2's authorization, temporary grants, re-auth, logging and separation of admin/normal identities limit the blast radius and exploitability of a misconfigured privileged account or service, but do not address the core weakness of weak defaults or incomplete hardening across the broader attack surface named by A02.
A02prevents — A.8.2's authorization, allocation, review, temporary-grant, non-generic-ID and separate-identity rules directly stop many common misconfigurations (e.g. default admin accounts left enabled, permanent broad privileges, shared root) that are the largest slice of A02; residual misconfigs (e.g. unhardened framework flags, exposed debug modes, insecure cloud IAM defaults) lie outside privileged-access rights and are untouched.
A07mitigates — A.8.2's higher authentication requirements, re-authentication/step-up, expiry, temporary 'break-glass' grants, and non-shared identities for privileged accounts limit the blast radius or success odds of some authentication failures (e.g. hijacking or brute-force on admin sessions), but do not address credential stuffing, weak reset flows, or most session-management mistakes that are the category's core.
A07prevents — A.8.2's authorization, allocation, review, temporary-grant, non-shared-identity and higher-authentication rules for privileged accounts directly block several authentication-failure vectors (e.g. generic/root accounts, permanent elevated sessions, shared credentials, insufficient re-auth), but leave the bulk of A07 (credential stuffing, weak password reset, most session-management flaws, brute-force on normal accounts) untouched.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.