Cyber Resilience

← ISO 27001 Annex A

A.8.20 Technological

Networks security

AttributesPreventive Detective C·I·A Protect Detect System and network security Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (21)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-18←P AC-4←M →P AU-2←P →P CM-2←P CM-6←M →P IA-3←P SC-23←P SC-32←P SC-5←P SC-7←M →M SC-8←M →M

Why these map — AI rationale (under review)

AC-4mostlyaligns with — Both enforce information flow controls through network segmentation, protocol restrictions, and filtering to prevent unauthorized data movement between systems.
SC-7mostlycovers — Both controls establish boundary protection mechanisms such as firewalls, connection filtering, and device authentication to safeguard network traffic and connected systems.
SC-8mostlyaligns with — Both require cryptographic and other controls to protect the confidentiality and integrity of data transmitted over networks, including public and wireless segments.
SC-8mostlycovers — A.8.20's broad mandate to protect network information and facilities from compromise directly accounts for the bulk of SC-8's transmission confidentiality/integrity requirement (via network protections like encryption and integrity controls), but leaves a residual slice of SC-8 uncovered for non-network transmission paths or mechanisms.
AC-4partialcovers — A.8.20's broad network protection objective (preventing compromise via the network) addresses a slice of ac-4's information flow enforcement but leaves the bulk of the target's specific authorization-based flow control mechanisms and policy enforcement uncovered
AU-2partialaligns with — Both mandate logging and monitoring of network activities to detect actions that could impact information security.
CM-6partialaligns with — Both require hardening of network devices and consistent application of secure configuration settings across the infrastructure.
SC-32partialaligns with — Both promote partitioning and logical separation of networks, including virtualized environments, to isolate critical components and limit exposure.
SC-32covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (21)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

PR.IR-01←F →M PR.PS-04←P DE.CM-01gov ID.AM-03gov PR.AA-03gov PR.AA-05gov PR.PS-01gov PR.PS-05gov

Why these map — AI rationale (under review)

DE.CM-01mostlyaligns with — Mandating logging, monitoring, and detection of actions affecting network security aligns with the CSF outcome of monitoring networks and network services to identify potentially adverse events.
PR.IR-01mostlycovers — The ISO control's emphasis on network segmentation, connection filtering, device authentication, and protocol hardening directly implements the CSF outcome of protecting networks and environments from unauthorized logical access.
PR.PS-01mostlyaligns with — Requiring up-to-date network diagrams, configuration files, and hardening of network devices aligns with the CSF outcome of establishing and applying configuration management practices.
ID.AM-03partialaligns with — Maintaining current network diagrams and configuration files contributes to the CSF outcome of documenting authorized network communication and data flows.
PR.AA-03partialaligns with — The requirement to authenticate systems on the network and restrict device connections supports the CSF outcome of authenticating users, services, and hardware.
PR.PS-05partialaligns with — Filtering and restricting systems that can connect to the network aligns with the CSF outcome of preventing installation and execution of unauthorized software.
DE.CM-01implements — A.8.20's technical network-protection measures give operational effect to DE.CM-01's monitoring outcome within the shared network-security domain, but without either naming the other
ID.AM-03implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.AA-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (13)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V12.2.1←M V12.3.1←M →M V12.3.2←P V12.3.3←M →M V12.3.5←P V13.2.4→P V13.2.5←P →P V13.4.3→P V3.4.1←P V4.1.4→P

Why these map — AI rationale (under review)

V12.3.1mostlyaligns with — The ISO control's requirement to encrypt traffic over public, third-party, and wireless networks directly supports the ASVS mandate that all inbound and outbound connections use an encrypted protocol such as TLS.
V12.3.3mostlyaligns with — Both the ISO guidance on safeguarding data over networks and the ASVS requirement for TLS between internal HTTP-based services address the need to protect service-to-service communication with encryption.
V13.2.4partialaligns with — The ISO directive to restrict and filter systems connecting to the network (via firewalls) aligns with the ASVS requirement to use an allowlist for defining permitted external resources and systems.
V13.2.5partialaligns with — The ISO control's emphasis on restricting network connections and hardening devices corresponds to the ASVS requirement that the web or application server be configured with an allowlist of resources it can reach.
V13.4.3partialaligns with — The ISO guidance on hardening network devices and disabling vulnerable protocols supports the ASVS requirement to prevent web servers from exposing directory listings unless explicitly intended.
V4.1.4partialaligns with — The ISO control's call to restrict and filter network connections aligns with the ASVS requirement that only explicitly supported HTTP methods are permitted by the application or its API.

Related weaknesses / CWE (84)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-296nonemitigates — Network security controls often enforce TLS certificate validation.
CWE-441nonemitigates — Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.
CWE-515nonemitigates — Network controls can limit covert storage across networks but not within a single system.
CWE-673noneprevents — Network security controls limit external reach into systems that define control spheres.
CWE-940nonemitigates — Network security controls enforce source verification and channel authentication for incoming communications.
CWE-1125mitigates — Network security controls (firewalls, segmentation, hardening) shrink the externally reachable attack surface.
CWE-1323prevents — Network-security measures protect trace data in transit to external agents.
CWE-1327mitigates — Network security controls directly require restricting listening interfaces to specific addresses rather than 0.0.0.0.
CWE-1334prevents — Network segmentation can hinder remote injection paths into hardware redundancy controllers.
CWE-200prevents — Encryption and integrity controls on traffic traversing public or wireless networks reduce the chance that sensitive data is disclosed to eavesdroppers.
CWE-204mitigates — Network security controls can enforce uniform responses and suppress observable discrepancies.
CWE-284mitigates — Network-level connection filtering, device authentication, and administrative-channel segregation directly block unauthorized actors from reaching resources they should not access.
CWE-288mitigates — Network security can limit exposure of alternate channels but does not address authentication logic itself.
CWE-290mitigates — Network security can limit spoofing vectors but does not address application-level authentication.
CWE-291mitigates — Network-security measures can enforce authenticated access rather than IP-based trust.
CWE-294mitigates — Network security controls such as encryption and integrity protection reduce the feasibility of capturing and replaying authentication traffic.
CWE-300mitigates — Network security controls directly address channel integrity and endpoint authentication.
CWE-322mitigates — Network security policies can require authenticated channels, indirectly reducing the risk of unauthenticated key exchange.
CWE-345mitigates — Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.
CWE-346mitigates — Network security controls enforce origin validation at network boundaries.
CWE-350mitigates — Network security controls can enforce authenticated, non-DNS-based host identification.
CWE-353mitigates — Network security controls can mandate integrity mechanisms on transmission protocols.
CWE-360mitigates — Network security controls can limit spoofing vectors but do not fully address trust in system event data.
CWE-385mitigates — Network segmentation reduces attack surface but does not address intra-process timing channels.
CWE-400prevents — Ability to isolate critical segments and apply traffic filtering limits an attacker’s capacity to consume network resources or cause denial-of-service conditions.
CWE-402mitigates — Network-security controls can limit exposure paths but do not address the root resource-leak logic.
CWE-406mitigates — Network security controls include traffic filtering and rate-limiting that prevent amplification attacks.
CWE-412mitigates — Network security measures can block external access paths to locks but do not address the design flaw itself.
CWE-419prevents — Network security measures can help isolate or protect the primary channel.
CWE-420mitigates — Network security controls ensure all channels receive equivalent protection, directly addressing unprotected alternate channels.
CWE-421mitigates — Network segmentation and hardening reduce the exposure of alternate channels to unauthorized actors.
CWE-424mitigates — Network security can limit some alternate paths but is not the primary control for application-level path protection.
CWE-5prevents — Mandates network security controls including encryption of traffic to prevent interception.
CWE-509mitigates — Network security controls limit lateral movement and replication of worms.
CWE-523prevents — Requires network security controls that can protect credential transmission.
CWE-553mitigates — Network controls can limit exposure of the directory but do not address the presence of the shell itself.
CWE-605mitigates — Network security controls can enforce exclusive port binding and service registration policies.
CWE-669mitigates — Network-security controls can block improper cross-sphere transfers.
CWE-693mitigates — Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.
CWE-799mitigates — Network security controls can enforce rate limiting and throttling at the perimeter.
CWE-862mitigates — Requiring authentication of systems and restricting which devices may join the network prevents missing-authorization flaws from being exploitable across network boundaries.
CWE-923mitigates — Network security controls directly enforce endpoint validation and channel restrictions.
CWE-924prevents — Mandates network security controls that can enforce message integrity on channels.

Mitigated MITRE ATT&CK techniques (1314)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M →P T1001.001←M →P T1001.002←M →P T1001.003←M →P T1003→P T1003.001→P T1003.002→P T1003.003→P T1003.004→P T1003.005→P T1003.006→P T1003.007→P T1003.008→P T1005→P T1006←M T1007→P T1008←M →P T1011←M →P T1011.001←M →P T1014←M →P T1016→P T1016.001→P T1016.002→P T1018←M →P T1020←M →P T1020.001←M →P T1021←M →P T1021.001←M →P T1021.002←M →P T1021.003→P T1021.004→P T1021.005←M →P T1021.006←P →P T1021.007←M →P T1021.008←M →P T1025→P T1027→P T1027.001←P T1027.002←M T1027.003←P →P T1027.005←M T1027.006←M →P T1027.008←M T1027.010←M T1027.011←P →P T1027.014←M T1027.015←P T1027.016←M T1027.017←M →P T1027.018←M T1029←P →P T1030←M →P T1033→P T1036←M →P T1036.001→P T1036.003←M →P T1036.004→P T1036.005←M T1036.007←M T1036.008←M →P T1036.009←P →P T1036.012←M →P T1037→P T1037.001→P T1037.002→P T1037.003→P T1037.004→P T1037.005→P T1039→P T1040→P T1041←M →P T1046←M →P T1047←M →P T1048←M →P T1048.001←M →P T1048.002←M →P T1048.003←M →P T1049→P T1052←P →P T1052.001←P →P T1053→P T1053.002→P T1053.003→P T1053.005→P T1053.006→P T1053.007→P T1055←M →M T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M →P T1055.005←M →P T1055.008←M →P T1055.009←M →P T1055.011←M →P T1055.012←M →P T1055.013←M →P T1055.014←M →P T1055.015←M →P T1056→P T1056.001→P T1056.003←M →P T1056.004→P T1057→P T1059←M →P T1059.001→P T1059.002→P T1059.003→P T1059.004→P T1059.006→P T1059.007→P T1059.008←M →P T1059.009→P T1059.011→P T1059.012→P T1059.013→P T1068←P →P T1069→P T1069.002→P T1069.003→P T1070←M →P T1070.003←M →P T1070.007←M →P T1070.009→P T1070.010←M T1071←M →P T1071.001←M →P T1071.002←M →P T1071.003←M →P T1071.004←M →P T1071.005←M →P T1072←M →P T1074→P T1074.001→P T1074.002→P T1078→P T1078.001←M →P T1078.002←P →P T1078.003←P →P T1078.004←M →P T1080→P T1082→P T1083→P T1087→P T1087.002→P T1087.003→P T1087.004→P T1090←M →P T1090.001←M →P T1090.002←M →P T1090.003←M →P T1090.004←M →P T1091←M →P T1092→P T1095←M →P T1098→P T1098.001→P T1098.003→P T1098.004→P T1098.005→P T1098.006→P T1098.007→P T1102←M →P T1102.001←M →P T1102.002←M →P T1102.003←M →P T1104←M →P T1105←M →P T1106→P T1110→P T1110.001→P T1110.002→P T1110.003→P T1110.004→P T1111←M →P T1113→P T1114→P T1114.001→P T1114.002→P T1114.003→P T1119→P T1120→P T1123→P T1125→P T1127←M →P T1127.001→P T1127.002→P T1127.003→P T1129→P T1132←P →P T1132.001←P →P T1132.002←P →P T1133→P T1134←M →P T1134.001←P →P T1134.003→P T1134.004←P →P T1134.005→P T1135→P T1136→P T1136.001→P T1136.002→P T1136.003→P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1176→P T1176.001→P T1176.002→P T1185←M →P T1187→P T1189←M →P T1190←M →P T1197→P T1199←M →P T1200→P T1202←P →P T1203←M →P T1204→P T1204.001←M →P T1204.002→P T1204.003→P T1204.004←P →P T1204.005→P T1205←M →P T1205.001←M →P T1205.002←M →P T1207←M →P T1210←M →P T1211←M →P T1212←P →P T1213→P T1213.001→P T1213.002→P T1213.003→P T1213.005→P T1213.006→P T1216←P →P T1216.001→P T1216.002→P T1218←M →P T1218.001→P T1218.002→P T1218.003→P T1218.004→P T1218.005←M →P T1218.007←M →P T1218.008←P →P T1218.009→P T1218.010→P T1218.011←M →P T1218.012←P →P T1218.013←M →P T1218.014→P T1218.015→P T1219←M →P T1219.001←M →P T1219.002←M →P T1219.003←M →P T1220→P T1221←M →P T1222←P →P T1222.001←P T1222.002→P T1480←P T1480.001←M T1482→P T1484←M →P T1484.001→P T1484.002←M →P T1485←P →P T1485.001→P T1486→M T1489←P →P T1490→P T1491→P T1491.001→P T1491.002→P T1495←P →P T1496←P →P T1496.001←P →P T1496.002←P →P T1496.003→P T1496.004→P T1497←M T1497.001←P T1498←M →P T1498.001←M →P T1498.002←M →P T1499←P →P T1499.001←M →P T1499.002←M →P T1499.003←P →P T1499.004←P →P T1505→P T1505.001→P T1505.002→P T1505.003←M →P T1505.004→P T1505.005→P T1505.006←P →P T1518→P T1518.001→P T1518.002→P T1525→P T1526→P T1528→P T1529→M T1530→P T1531→P T1534→P T1535←M →P T1537←M →P T1538→P T1539←F →P T1542←M →P T1542.002←M →P T1542.003←P →P T1542.004←M →P T1542.005←M →P T1543→P T1543.001→P T1543.002→P T1543.003→P T1543.004→P T1543.005→P T1546→P T1546.001→P T1546.002→P T1546.003→P T1546.004→P T1546.005→P T1546.006→P T1546.007→P T1546.008→P T1546.009→P T1546.010→P T1546.011→P T1546.012→P T1546.014→P T1546.015→P T1546.016→P T1546.017→P T1546.018→P T1547→P T1547.001→P T1547.002→P T1547.003→P T1547.004→P T1547.005→P T1547.006→P T1547.008→P T1547.009→P T1547.010→P T1547.012→P T1547.013→P T1547.015→P T1548←P →P T1548.002→P T1548.005→P T1548.006→P T1550←M →P T1550.001←M →P T1550.002←F →P T1550.003←M →P T1550.004←F →P T1552→P T1552.001→P T1552.003→P T1552.004→P T1552.005←M →P T1552.006→P T1552.007→P T1552.008→P T1553←P →P T1553.001←P T1553.002←P T1553.003←M →P T1553.004←P →P T1553.005←M →P T1553.006←P →P T1554→P T1555→P T1555.003→P T1555.004→P T1555.005→P T1555.006→P T1556←M →P T1556.001←M →P T1556.002←P →P T1556.003←P →P T1556.004→P T1556.005→P T1556.006←M →P T1556.007←M →P T1556.008←M →P T1556.009←M →P T1557←M →P T1557.001←M →P T1557.002←M →P T1557.003←M →P T1557.004→P T1558←M →P T1558.001←M →P T1558.002←M →P T1558.003←M →P T1558.004→P T1558.005→P T1559→P T1559.001→P T1559.002→P T1559.003→P T1560←P →P T1560.001→P T1560.002→P T1561←P →P T1561.001→P T1561.002←P →P T1563→P T1563.001→P T1563.002←M →P T1564→P T1564.005→P T1564.006→P T1564.008→P T1564.011→P T1564.013→P T1564.014→P T1565→P T1565.001→P T1565.002←P →P T1565.003→P T1566→P T1566.001→P T1566.002←M →P T1566.003←M →P T1566.004→P T1567→P T1567.001←P →P T1567.002←M →P T1567.003←P →P T1567.004←M →P T1568←M →P T1568.001←M →P T1568.002←M →P T1568.003←M →P T1569→P T1569.001→P T1569.002→P T1569.003→P T1570←M →P T1571←M →P T1572←M →P T1573←M →P T1573.001→P T1573.002→P T1574←M →P T1574.001←M →P T1574.004←P →P T1574.005→P T1574.006→P T1574.007→P T1574.008→P T1574.009→P T1574.010→P T1574.011→P T1574.012→P T1574.013←P →P T1578←M →P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005←M →P T1580→P T1583←M T1583.001←M T1583.003←M T1583.005←M T1583.007←M T1584←M →P T1584.001←M T1584.002←M →P T1584.003←M T1584.004←M →P T1584.005←M →P T1584.007←M →P T1584.008←M →P T1586.003→P T1587.001←P T1590→P T1590.002→P T1590.004→P T1590.006→P T1592.002→P T1595→P T1595.001←M →P T1595.002→P T1595.003→P T1598→P T1598.002→P T1598.003←M →P T1599→P T1599.001←M →P T1600←M →P T1600.001→P T1600.002←P →P T1601←M →P T1601.001←M →P T1601.002←M →P T1602←P →P T1602.001→P T1602.002→M T1606←M →P T1606.001←M →P T1606.002→P T1608.004←P →P T1608.005←P T1609→P T1610←P →P T1611←M →P T1612←P →P T1613→P T1615→P T1619→P T1620←M →P T1621←M →P T1622←F T1647←P T1648→P T1649←P →P T1651→P T1653→P T1654→P T1657→P T1659←M →P T1665←M →P T1666←M →P T1667→P T1669←M →P T1671→P T1673→P T1674→P T1675→P T1677→P T1678←P T1680→P T1684.002←M →P T1685←M →P T1685.001←M →P T1685.002←M →P T1685.003←M T1685.004←M →P T1685.005←M →P T1685.006←M T1686←M →P T1686.001→P T1686.002→P T1686.003→P T1687←P →P T1688←M T1689→P T1690←P →P

Why these map — AI rationale (under review)

T1001detects — A.8.20 explicitly requires logging/monitoring of network actions relevant to security (item f, cross-referencing 8.16), which surfaces obfuscated C2 traffic when it deviates from baselines or exhibits detectable anomalies, but the control's scope is network-level and omits many stealth methods (e.g. steganography in legitimate-looking flows) that fall outside its instrumentation.
T1001prevents — A.8.20 requires network-level protections (segmentation, protocol hardening/disabling, filtering/firewalls, monitoring, authentication of systems/devices) that can stop many T1001 variants (e.g. impersonation of legitimate protocols, use of vulnerable protocols, conspicuous traffic) from succeeding on the network, but leaves real residual methods such as steganography or junk-data obfuscation inside otherwise-allowed flows that the listed controls do not block.
T1001.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous C2 traffic patterns even when junk data is added; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating detection of protocol-obfuscation techniques like junk data (cf. A.8.16 event-lane anchor grading partial on T1055).
T1001.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces hidden C2 traffic (including stego in files or protocols) when it is observable in network flows or anomalies; this is only a slice because the clause sets scope by organizational requirements rather than mandating instrumentation that reliably extracts or identifies steganographic payloads.
T1001.002prevents — A.8.20 requires safeguards for data confidentiality/integrity over networks (incl. encryption, filtering, monitoring, protocol hardening and segmentation), which can block or render unusable many steganographic C2 embeddings in transit; it does not stop all possible stego techniques or embedding in files that are transferred without violating those controls.
T1001.003detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces protocol/service impersonation in network traffic as anomalous; however the clause sets scope by organizational requirements rather than mandating universal deep packet or behavioral inspection, leaving a large slice of implementations that would miss it (same reading as A.8.16 vs T1055).
T1001.003prevents — A.8.20 explicitly requires hardening network devices, disabling vulnerable protocols, segregating admin channels, restricting/filtering connections (e.g. firewalls), authenticating systems/devices, and protecting confidentiality/integrity over networks, which stops many protocol-impersonation C2 techniques at the network boundary; it does not reach all impersonation variants (e.g. malleable HTTP headers or fake certs on allowed ports inside permitted flows).
T1001.003responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once impersonated C2 traffic is recognised as an active attack, which is the core of `responds`; the remainder of the clause is detection, prevention and hardening that sit on other verbs
T1003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces credential-dumping activity on monitored networks or devices; this is only a slice because the control's scope is network-focused and does not mandate host-level detection of in-memory or local OS credential access.
T1003.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface LSASS dumping or related anomalous process behavior when network or host telemetry is in scope, but the control is network-centric and does not mandate host-process monitoring of credential dumping.
T1003.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces in-memory/registry credential dumping on Windows hosts when those events fall inside the monitored scope; the remainder is the slice of implementations whose monitoring scope excludes host/process behavior.
T1003.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces NTDS access/copy attempts on domain controllers or related network activity; this is only a slice because the clause sets scope by organisational requirements rather than mandating universal coverage of all T1003.003 vectors (e.g. offline backup access or non-networked exfil).
T1003.003prevents — A.8.20 requires network-level protections (segmentation, firewalls, protocol hardening, device authentication, monitoring, and isolating subnetworks under attack) that can stop many common NTDS.dit exfiltration paths (e.g. remote access, lateral movement, backup exfil over networks), but leaves local/privileged access on a domain controller itself (Volume Shadow Copy, ntdsutil.exe, Invoke-NinjaCopy) untouched.
T1003.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related logging/monitoring (f) plus segregation/hardening allow containment of an in-progress NTDS exfil once network activity is detected, but most listed methods (VSS, ntdsutil, Invoke-NinjaCopy, secretsdump) are local on the DC and do not require network transit.
T1003.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces credential-dumping behavior on Windows hosts; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating host-level detection of registry/memory access (most of the technique's dominant mechanisms sit outside network-focused monitoring).
T1003.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces attempts to access or dump cached domain credential stores (e.g. via Mimikatz, tdbdump, or registry reads) when those actions fall inside the monitored scope; the remainder is the slice of implementations whose monitoring scope excludes host/process/file-access telemetry for credential caches.
T1003.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces DCSync replication abuse when it occurs on monitored domain controllers or networks; partial because the control leaves scope and depth of monitoring to the organization (see cross-references to 8.16) and does not guarantee coverage of every possible DCSync vector or unmonitored legacy protocols.
T1003.006prevents — A.8.20 requires network-level protections (firewalls, protocol hardening, authentication of systems/devices, segregation, monitoring, and isolation under attack) that can block many DCSync vectors over the network, but the technique can still succeed from a privileged domain-joined host without traversing those network boundaries.
T1003.006responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once DCSync replication abuse is detected and underway; the remainder of the clause (firewalls, logging, hardening, protocol disablement) is preventive or detective rather than responsive to an in-progress event.
T1003.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which can surface proc filesystem access patterns when that activity is in scope, but the control's network-centric focus leaves most local proc/memory scraping outside its primary detection mechanisms.
T1003.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which would surface attempts to read/dump /etc/passwd and /etc/shadow (especially as root or via unshadow); this is a minority slice of the control whose primary focus is network-level protections rather than host-file-access detection.
T1003.008prevents — A.8.20 requires network-level protections (firewalls, segregation, device authentication, protocol hardening, monitoring) that can stop remote network-based access to /etc/passwd and /etc/shadow on Linux hosts; it does not address local privilege escalation or already-compromised hosts that can read the files directly.
T1005detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces local data collection activity on monitored networks/systems; this is a genuine but minority slice because the control's dominant focus is network boundary protection, device hardening, segregation and isolation rather than host-level collection detection.
T1007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; this surfaces the reconnaissance commands and their outputs on a monitored network or host, but the clause's scope is set by organizational requirements rather than mandating universal coverage of all discovery utilities or offline analysis, leaving a genuine slice unreached.
T1008detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as restricting/filtering connections, detecting device attachments, and isolating subnetworks under attack, which can surface fallback channel use on monitored networks; partial because scope is set by the implementer (network coverage, what is logged) and leaves unmonitored channels or non-network C2 outside its view.
T1008prevents — A.8.20 requires network segmentation, hardening, protocol disabling, connection filtering (firewalls), authentication of systems/devices, logging/monitoring, and temporary isolation of subnetworks under attack, all of which can stop fallback C2 channels from being established or used on the network.
T1008responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once a C2 channel is active and detected, which is the core of `responds`; the remainder of the clause is preventive or detective and does not address an already-running fallback channel
T1011detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (including f, i, j) and detection of equipment/devices connecting to the network, which surfaces anomalous exfiltration over secondary media such as WiFi, Bluetooth or cellular when those are inside the monitored scope; it does not guarantee coverage of every possible medium or post-exfiltration artifacts.
T1011prevents — A.8.20 explicitly requires safeguards for data over wireless/public/third-party networks, hardening devices, restricting/filtering connections (e.g. firewalls), segregating channels, disabling vulnerable protocols, and logical separation via virtualized networks, which directly blocks many exfiltration paths over alternate media like WiFi, Bluetooth, or cellular that bypass the primary enterprise channel.
T1011responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and the broader monitoring/logging in f directly enable containment once exfiltration-over-alternate-medium is detected and underway, but the clause's dominant focus is on preventive network design, hardening, segregation and authentication rather than on-event response actions.
T1011.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and items i/j) on restricting/filtering/detecting device connections plus wireless safeguards can surface Bluetooth exfiltration attempts; however, the control is scoped to organizational network management and does not mandate detection of all proximity-based Bluetooth channels outside enterprise routing.
T1011.001prevents — A.8.20 explicitly requires safeguards for data passing over wireless networks, hardening of network devices, restricting/filtering of connections (incl. via firewalls), detection/restriction/authentication of device connections, and disabling of vulnerable protocols — all of which close the Bluetooth exfiltration path on the bulk of enterprise-managed networks and endpoints; the named remainder is unmanaged personal-area Bluetooth use outside that perimeter or on air-gapped systems where the control's network-centric scope does not reach.
T1014detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces rootkit-induced anomalies (e.g. hidden processes or network connections) in monitored scope; partial because the control sets scope by requirements rather than mandating universal deep instrumentation that would catch all stealthy kernel/bootkit hooks.
T1016detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes discovery activity on network configuration; this is a genuine but minority slice of the control whose dominant focus is protective network design, segmentation, hardening and access restriction rather than detection of the T1016 technique itself.
T1016prevents — A.8.20's network hardening, segregation, authentication, restriction/filtering (firewalls), disabling vulnerable protocols, and isolation under attack constrain some discovery paths (especially on network devices and across boundaries), but do not stop local OS utilities (ipconfig/arp/route/esxcli) once access is obtained.
T1016.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface Internet connectivity checks (e.g. anomalous pings, tracert or outbound GETs) when they fall inside the monitored scope; this is only a slice because the clause sets scope by requirements rather than mandating universal coverage of all discovery techniques on all platforms.
T1016.001prevents — A.8.20 requires network segmentation, firewalls, protocol disabling, device authentication, logging/monitoring, and isolation under attack, which can block many discovery methods (e.g. outbound pings, GETs, or traceroutes to C2) on monitored or restricted segments, but leaves open-ended slices such as allowed outbound connectivity for legitimate services, unmonitored local checks, or virtualized/SDN configurations that still permit the technique.
T1016.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces Wi-Fi discovery activity on the host or network; this is only a slice because the clause's scope is set by organizational requirements rather than mandating universal coverage of all discovery commands, file reads, or API calls on every platform.
T1016.002prevents — A.8.20 explicitly requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and protecting confidentiality/integrity over wireless networks, which directly stops many post-compromise discovery paths for stored Wi-Fi names/passwords and local scanning.
T1018detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces remote system discovery activity (especially active probing or network device CLI use) when it falls inside the chosen monitoring scope; passive/local methods and out-of-scope segments remain unseen, matching the partial reading in A.8.16 vs T1055.
T1018prevents — A.8.20's network segmentation, firewalling, protocol disabling, device hardening, authentication, and isolation measures stop many network-based discovery vectors (especially active probing and infrastructure enumeration), but local/passive methods (hosts file, ARP cache) and already-compromised endpoints remain untouched.
T1018responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once discovery activity is detected and underway, which is the core of `responds`; the remainder of the clause (hardening, logging, segregation, filtering) is preventive or detective rather than responsive to an in-progress T1018 event.
T1020detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces automated exfiltration in flight on the organization's networks (especially via boundary or anomalous traffic patterns); this is bounded by the control's network-scope focus, leaving non-network or pre-transmission collection undetected.
T1020prevents — A.8.20's network protections (firewalls, filtering, protocol disabling, segregation, monitoring, and virtualized separation) can stop automated exfiltration from leaving the network in many cases, but the class can still succeed via allowed channels, misconfigurations, or already-compromised legitimate outbound paths.
T1020responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once exfiltration is underway, but the bulk of the clause is about static network hardening, monitoring, and prevention rather than active incident response to an ongoing automated exfiltration event.
T1020.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (item f, cross-referencing 8.16), which surfaces anomalous traffic-mirroring configurations or sessions on managed networks and devices; this is limited to a slice because the control's scope is set by organizational requirements rather than mandating universal deep packet or configuration inspection that would catch all adversary-enabled mirroring (especially on unmanaged cloud IaaS instances or post-compromise device modifications).
T1020.001prevents — A.8.20 requires network controls including segregation, hardening, protocol disabling, authentication of systems/devices, logging/monitoring, and temporary isolation under attack, which can stop adversaries from enabling or abusing traffic mirroring on managed infrastructure; however, it does not reach adversary-controlled external infrastructure, post-compromise device modifications (e.g. ROMMONkit), or all cloud mirroring configurations.
T1020.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once an attack leveraging traffic duplication is underway, but the bulk of the clause is about preventive network design, hardening, logging, and segregation rather than active response actions.
T1021prevents — Network segmentation, connection filtering, and device authentication limit an adversary's ability to discover and directly interact with remote services for lateral movement.
T1021detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which surface T1021's use of remote protocols (SSH/RDP/VNC) on the network.
T1021responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly contains an in-progress remote-service lateral-movement event once underway, which is the act `responds` names; the remainder of the clause is preventive or detective and does not act on an already-running technique.
T1021.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface RDP logins (especially anomalous ones) as part of network and system monitoring; this is a genuine but minority slice of the technique because the control's scope is set by organizational requirements rather than mandating universal RDP-specific detection.
T1021.001prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which can block unauthorized RDP sessions over the network; this is only a slice because the technique can also succeed via local accounts, misconfigured RDP exposure, or credential abuse that bypasses network-layer controls.
T1021.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once an RDP-based intrusion is underway, but the clause's other items are preventive or detective and the remainder of realized RDP sessions (e.g. those already inside the isolated segment) is not addressed by responding.
T1021.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which includes anomalous SMB/Windows Admin Share access and lateral movement over the network; however, the control is scoped by organizational requirements and does not mandate detection of every possible instance or variant (e.g., pass-the-hash or non-monitored segments).
T1021.002prevents — A.8.20 requires network segmentation, hardening, protocol disabling, authentication of systems, connection filtering (e.g. firewalls), and isolation under attack, all of which can block unauthenticated or unauthorized SMB/Windows Admin Share access used for lateral movement; it does not address the valid-admin-account or Pass-the-Hash vectors that enable the technique.
T1021.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once lateral movement via SMB shares is detected and underway, but the bulk of the clause is about static network hardening, authentication, filtering, logging and segregation that act before the technique runs.
T1021.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface DCOM lateral movement on Windows networks when it is within the monitored scope (e.g. anomalous RPC/DCOM traffic or privileged remote activation); this is a genuine but minority slice because the clause sets scope by business requirements rather than mandating universal DCOM-specific instrumentation.
T1021.003prevents — A.8.20 requires network-level protections (firewalls, connection filtering/restriction, protocol hardening/disabling, segmentation, monitoring, and isolating subnetworks under attack) that can block DCOM's RPC-based remote activation and lateral movement over the network, but leaves the authenticated local-privilege and ACL-misconfiguration slices of the technique untouched.
T1021.004detects — A.8.20 explicitly requires logging and monitoring of network actions (item f, cross-referencing 8.16) that can surface SSH logins and anomalous remote access, but this is scoped by organizational requirements rather than mandating detection of all SSH technique instances (e.g. stealthy or non-network-visible ones).
T1021.004prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, segregating admin channels, authenticating systems, and isolating subnetworks under attack, all of which can stop unauthorized SSH logins from running at all on covered networks; it is only partial because the clause sets requirements rather than mandating universal mechanisms, leaving slices such as already-enabled SSH on exempted systems or insider use of valid accounts inside the perimeter.
T1021.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once an in-network attack is underway, which matches the `responds` verb; the remainder of the clause (hardening, logging, authentication, filtering, disabling protocols) is preventive or detective and does not address an active SSH session.
T1021.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and items i/j/m/n add network-level detection of unauthorized connections, protocol use, and attacks that can surface VNC abuse over the network; this is a genuine but minority slice because the control is scoped to network activity rather than host/process-level VNC session monitoring or the underlying valid-account abuse.
T1021.005prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which can stop VNC abuse over the network before it runs; this is only a slice because the technique can still succeed via valid accounts on already-authenticated sessions or non-network vectors inside the target.
T1021.005responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once VNC remote-control abuse is underway; the remainder of the clause (hardening, logging, authentication, filtering, disabling protocols) is preventive or detective rather than responsive.
T1021.006detects — A.8.20 item f explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces WinRM-based remote interaction when it falls inside the chosen monitoring scope; the remainder is the slice of implementations whose scope (per 8.16) excludes WinRM telemetry.
T1021.006prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which can stop WinRM-based remote interaction from ever succeeding on Windows networks; this is only a slice of the technique because it depends on network exposure and does not block local/loopback WinRM use or non-network vectors.
T1021.006responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once remote access via WinRM is detected as an active compromise, but the bulk of the clause is about static network hardening, authentication, filtering, logging and segregation that act before or independently of an in-flight event.
T1021.007detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces adversary use of valid accounts to access cloud services; this is only a slice of the technique because the control is scoped by what the organization deems relevant rather than mandating detection of every cloud login vector or token use.
T1021.007prevents — A.8.20 requires network-level protections (segmentation, firewalls, protocol hardening, device authentication, logging/monitoring of network actions, and isolation under attack) that can stop an adversary from reaching the cloud service endpoint or using certain vectors (e.g. vulnerable protocols, unauthenticated device connections), but leaves the dominant authentication-via-federated-valid-account path untouched.
T1021.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface direct cloud VM connection attempts or anomalies when the scope includes cloud/virtualized networks; however the clause sets scope by organizational requirements rather than mandating instrumentation of all cloud-native VM console methods, leaving a slice uncovered.
T1021.008prevents — A.8.20 requires network-level protections (authentication of systems, restricting/filtering connections, hardening devices, segregating admin channels, disabling vulnerable protocols, and logical separation via virtualized/SDN networks) that can stop unauthorized direct cloud VM console access when it traverses or depends on the network boundary, but leaves open the dominant remainder of valid-account abuse through cloud APIs, identity providers, and management-plane paths that are outside the network-focused scope of this control.
T1025detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces adversary activity on removable media after initial access; this is a genuine but minority slice of the technique (only the observable collection step, not the connection/search itself, and only where monitoring scope includes it).
T1027detects — A.8.20 item f explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces network-borne obfuscated payloads or transit activity; this is a genuine but minority slice of T1027 (network/in-transit only, not on-system file/command obfuscation across all platforms).
T1027prevents — A.8.20 requires safeguards for data in transit over networks (including encryption per cross-references), network segmentation, protocol hardening, device authentication, connection filtering, and monitoring; these stop some in-transit obfuscation vectors and block delivery of certain obfuscated payloads, but leave the dominant on-system/file obfuscation, command obfuscation, and local encoding untouched.
T1027.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface steganography use in network traffic or exfiltration (e.g. anomalous image payloads), but the control is scoped to networks and does not broadly inspect media/files for hidden data across the event chain.
T1027.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which can surface HTML smuggling as anomalous network/web traffic or payload behavior; however, the control is scoped by organizational requirements rather than mandating detection of this specific technique, leaving many implementations without coverage for obfuscated blobs or data URLs.
T1027.006prevents — A.8.20 requires safeguards for data over networks (incl. public/wireless), content filtering via firewalls/restriction of connections, logging/monitoring for relevant actions, hardening, protocol disabling, and virtualized network separation; these can stop many delivery vectors for HTML smuggling past filters, but the technique's client-side JS Blob/Data URL generation and benign-MIME evasion on the endpoint remain outside the network-focused scope, leaving a genuine residual slice.
T1027.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces fileless storage activity (esp. on network devices and shared-memory paths) when it produces observable anomalies; this is a genuine but minority slice because the clause is scoped to network traffic, device connections, and admin channels rather than endpoint/registry/WMI inspection.
T1027.017detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface SVG smuggling as anomalous network, file, or script behavior; however the clause sets scope by organizational requirements rather than mandating detection of this specific technique, leaving many implementations without coverage for SVG-specific payloads.
T1029detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous scheduled exfiltration traffic blending with normal patterns (especially via referenced 8.16/8.15), but the control's network-focused scope leaves many non-network or unscheduled slices of the technique undetected.
T1030detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface anomalous chunked exfiltration that evades volume thresholds; however, the control is scoped by organizational requirements and does not mandate detection of this specific technique across all network traffic or platforms.
T1030prevents — A.8.20 requires network segmentation, monitoring, logging, protocol hardening, connection restrictions (firewalls), and isolation under attack, which can block or raise the bar for many exfiltration paths and thereby stop the size-limited transfer technique from succeeding in some network configurations; it does not reach adversary-controlled chunking logic inside a already-compromised endpoint process.
T1033detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces T1033 execution (especially on network devices via CLI commands); however, the control's primary focus is network traffic, device hardening, and boundary protection rather than host-level process or command execution, leaving most T1033 instances (whoami, environment variables, file ownership) outside its scope.
T1036detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces masquerading artifacts (e.g. renamed utilities or spoofed metadata) when they trigger observable anomalies; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating detection of all masquerading variants across every platform or layer.
T1036.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface the anomalous use of invalid code signatures on macOS/Windows binaries; however the clause is scoped to network activity and does not mandate endpoint or binary-signature inspection, leaving most of the technique outside its view.
T1036.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface renamed-utility execution as anomalous behavior (especially via network activity, process lineage, or hardened-device telemetry); this is a genuine but minority slice of the technique because the clause's scope is set by network-focused requirements rather than mandating host/process-level detection of all masquerading variants.
T1036.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface masquerading of tasks/services as anomalous behavior; however, the control is scoped to network-level monitoring rather than host/process-level task/service inspection, leaving a large remainder of the technique undetected.
T1036.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and network-based transfer/storage of masqueraded files (T1036.008) is an observable action that can be surfaced by network monitoring, but the control is scoped only to network activity and does not address local file-system masquerading or polyglot detection.
T1036.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces anomalous process-tree behavior on monitored Linux/macOS endpoints; the remainder is that the control's scope is set by organizational requirements and does not mandate host-level process monitoring everywhere the technique can run.
T1036.012detects — A.8.20.f explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous/spoofed browser attributes in network traffic as detectable deviations; this is only a slice of the technique because the control is scoped by organizational requirements rather than mandating universal deep packet inspection or fingerprint-specific detection.
T1037detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous boot/logon script execution on covered platforms; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating universal coverage of all initialization vectors across every platform and virtualization layer.
T1037.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface anomalous logon-script execution or registry changes at runtime; this is limited to a chosen monitoring scope rather than a bounded remainder of the technique itself.
T1037.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous login-hook modifications or executions on monitored macOS endpoints; partial because the control sets scope by organizational requirements rather than mandating universal host telemetry that would catch every instance of this technique.
T1037.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous network logon script execution or related persistence activity on Windows networks; this is only a slice because the control is scoped by organizational requirements rather than mandating universal coverage of this specific technique.
T1037.003prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and logging/monitoring network activity, which can block many vectors for pushing or executing malicious network logon scripts via AD/GPO but leaves open slices such as already-compromised admin accounts or insider-assigned legitimate scripts.
T1037.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface RC script modifications on covered Unix-like or network platforms, but the control's scope is set by organizational requirements and does not mandate coverage of this specific persistence vector on all platforms (e.g. embedded/ESXi).
T1037.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface the creation or execution of a macOS startup item as anomalous boot-time activity; this is only a slice because the control is scoped by organizational requirements rather than mandating universal coverage of all persistence vectors.
T1039detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes adversary activity such as searching or accessing network shares; this surfaces the technique in flight on monitored networks but is scoped by what the organization chooses to log/monitor and does not guarantee coverage of all T1039 instances (e.g. on unmonitored shares or endpoints).
T1039prevents — A.8.20 requires network segmentation, access restrictions/filtering (e.g. firewalls), hardening, disabling vulnerable protocols, and safeguards for data over networks, which can block or limit adversary access to many shared drives; it does not stop all discovery of already-accessible shares from a compromised host.
T1040detects — A.8.20 explicitly requires logging and monitoring (item f, cross-referencing 8.16) to record and detect actions affecting network security, which directly surfaces passive sniffing (promiscuous mode, span ports, traffic mirroring, monitor capture) on covered networks.
T1040prevents — A.8.20 directly mandates safeguards for confidentiality/integrity of data over networks (esp. public/wireless), encryption (via cross-ref to 8.24), hardening, protocol disabling, connection filtering/firewalls, segregation, logging/monitoring, and virtualized network separation — all of which stop passive sniffing from succeeding on the bulk of traffic and vectors, with a bounded remainder (unencrypted protocols inside trusted segments or cloud mirroring that still requires separate controls).
T1040responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once sniffing (T1040) is detected and underway; this is only a slice of the full technique surface (e.g. does not address promiscuous-mode interfaces, cloud traffic mirroring, or device CLI captures).
T1041detects — A.8.20 item f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous exfiltration over an established C2 channel (especially when it deviates from baseline traffic patterns); however, the clause's scope is limited to the organization's own networks and does not guarantee detection of all protocol-conforming exfiltration (e.g. encrypted C2 blending with legitimate traffic or activity outside monitored segments).
T1041prevents — A.8.20 requires safeguards for data confidentiality/integrity over networks (incl. encryption, segregation, filtering/firewalls, protocol disabling, and isolating under attack), which stops many but not all C2 exfil encodings (e.g. those using already-allowed encrypted C2 paths or non-vulnerable protocols).
T1041responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and the overall purpose of protecting networks from compromise directly enable containment once exfiltration-over-C2 is detected as underway, but the clause is silent on eradication of the actor/foothold and most of its listed items are preventive or hardening rather than incident response.
T1046detects — A.8.20 explicitly requires logging/monitoring (f) and detection of device connections plus network attacks (j,m) to surface actions affecting security, which directly catches the scanning/probing activity named in T1046; the remainder is the narrow slice of passive mDNS/Bonjour discovery that may evade active monitoring.
T1046prevents — A.8.20 directly lists network hardening, protocol disabling, connection restriction/filtering (firewalls), segregation, logging/monitoring, and isolation under attack, which stop most forms of port/vulnerability scanning and service enumeration (including mDNS/Bonjour) before they succeed; the bounded remainder is scans that still succeed against services required to remain available and exposed.
T1046responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once discovery activity is underway and detected, which is the core of `responds`; the remainder of the clause is about hardening, prevention, detection and architecture rather than active response to an in-flight event.
T1047detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces WMI abuse (especially remote execution over ports 135/5985/5986 or anomalous management activity); this is a genuine but minority slice because the control's scope is set by organizational requirements rather than mandating host-level instrumentation of all WMI/COM/PowerShell interactions.
T1047prevents — A.8.20 requires network-level protections (firewalls, protocol disabling, authentication of systems/devices, segmentation, monitoring, and hardening) that can block remote WMI abuse over DCOM/WinRM ports or untrusted connections, but leaves local WMI abuse, allowed remote management paths, and non-network vectors (PowerShell/COM) untouched.
T1047responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) plus logging/monitoring in f directly enable containment once WMI abuse is detected over the network, but this is only a slice of the technique (remote network-borne cases) and does not address local execution or eradication of the actor's foothold.
T1048detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as restricting/filtering connections (i), detecting device connections (j), and isolating subnetworks when under attack (m); these surface exfiltration over alternate protocols on monitored networks, with the bounded remainder being fully encrypted/obfuscated channels or activity outside the defined monitoring scope.
T1048prevents — A.8.20 requires network-level safeguards (firewalls, protocol restrictions, segregation, logging/monitoring, device authentication, disabling vulnerable protocols, and virtualized separation) that can block many alternate-protocol exfiltration paths, but leaves open slices such as encrypted/obfuscated channels, approved protocols (HTTP/S, DNS, SMB), cloud-console/API downloads, and insider-initiated exfil over permitted services.
T1048responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus protocol restrictions (i,n) enable containment actions once exfiltration is detected in flight, but most of the technique (choice of alternate protocol, encryption/obfuscation, use of common utilities or cloud APIs) is not addressed by network-level response.
T1048.001detects — A.8.20 item f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous exfiltration over non-C2 symmetric-encrypted channels (especially when coordinated with 8.16); this is limited to a chosen monitoring scope rather than guaranteed coverage of all such traffic or protocols.
T1048.001prevents — A.8.20 requires safeguards for confidentiality/integrity of data over networks (incl. encryption per 8.24, firewalls, protocol hardening, segregation, and isolation under attack), which can stop many symmetric-exfiltration flows; it leaves open adversary-controlled custom symmetric layers, alternate locations, and non-vulnerable protocols that still allow the technique.
T1048.001responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and the overall purpose of protecting networks from compromise directly enable containment once exfiltration is detected as underway, but most of the clause is about static hardening, prevention, and monitoring rather than active incident response.
T1048.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces exfiltration over asymmetric encrypted protocols as anomalous network behavior; this is limited to a slice because the clause sets scope by organizational requirements rather than mandating universal depth or coverage of all such traffic.
T1048.002prevents — A.8.20 requires safeguards for confidentiality/integrity of data over networks (incl. encryption per 8.24, firewalls, protocol hardening, segregation, and isolating subnetworks under attack), which stops many asymmetric exfil paths but leaves residual cases (e.g. exfil over allowed HTTPS to alternate non-C2 sites, or from unmanaged virtualized segments).
T1048.002responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus segregation/hardening allow containment actions once exfiltration is detected in flight, but most of the clause is preventive configuration rather than incident response and the technique's use of baked-in protocol encryption limits the responsive surface
T1048.003detects — A.8.20.f explicitly requires logging and monitoring of network actions that can affect or are relevant to information security, which surfaces exfiltration over unencrypted non-C2 protocols (e.g. via anomalous traffic patterns in HTTP/FTP/DNS); the remainder is traffic outside the chosen monitoring scope.
T1048.003prevents — A.8.20 explicitly requires safeguards for confidentiality/integrity of data over public/third-party/wireless networks, hardening devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, and segregating channels, which directly stops unencrypted exfiltration over protocols like HTTP/FTP/DNS in the bulk of covered network paths; the bounded remainder is exfiltration that evades these via allowed unencrypted channels or alternate locations inside the perimeter.
T1048.003responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus protocol hardening (n) allow containment actions once exfiltration is detected in flight, but most of the technique's surface (obfuscated outbound over common protocols from endpoints) sits outside network-device isolation scope
T1049detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and items i/j/m/n plus virtual-network guidance can surface anomalous connection-discovery behavior; however the clause is scoped by organizational requirements rather than mandating universal coverage of every discovery command or platform (e.g. ESXi CLI, lsof, who -a).
T1049prevents — A.8.20 requires network segmentation, hardening, protocol disabling, connection filtering (firewalls), authentication of systems/devices, logging/monitoring, and virtualized network logical separation, all of which can stop many forms of network-connection discovery (especially from remote systems, on network devices, or across cloud virtual networks) but leave local post-compromise execution of netstat/lsof/esxi commands on an already-accessed endpoint largely untouched.
T1049responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related monitoring/logging items act on an in-progress discovery technique once underway by containing its spread or access, which is exactly what `responds` names; the remainder (most of the listed discovery utilities and passive enumeration) is outside that narrow containment slice.
T1052detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating on detected attack), which can surface physical-medium exfiltration when it traverses or touches a monitored network boundary or device; this is a genuine but minority slice of T1052 (air-gapped removable-media hops often evade network monitoring).
T1052.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting information security (item f, cross-referencing 8.16) and detecting device connections (item j), which surfaces USB-based exfiltration on monitored networks or endpoints; partial because it depends on chosen scope and does not guarantee coverage of air-gapped or unmonitored USB hops.
T1052.001prevents — A.8.20 requires network segmentation, isolation of critical subnetworks, disabling vulnerable protocols, hardening, logging/monitoring, and controls on device connections (including to physical media), which can block USB-based exfiltration paths in air-gapped or segmented environments; however, it is scoped to networks and does not address all USB insertion vectors (e.g., user-mediated on endpoints outside monitored network controls).
T1053detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces scheduled-task abuse on monitored networks/systems; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal instrumentation of task-scheduling utilities across all platforms.
T1053.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces at-based scheduling and execution on monitored networks/systems; this is only a slice because the control's scope is set by what the organization chooses to log/monitor rather than mandating detection of this specific technique across all platforms and privilege boundaries.
T1053.002prevents — A.8.20's network-focused controls (restricting/filtering connections via firewalls, authenticating systems/devices, hardening network devices, disabling vulnerable protocols, segregating admin channels, and isolating subnetworks) can prevent remote lateral-movement use of at over the network, but do not stop local abuse for persistence, privilege escalation, or scheduled execution on a compromised host.
T1053.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces cron-based scheduling activity on Linux/macOS/ESXi hosts when that activity is in scope; the remainder is the slice of implementations where host/process telemetry for scheduled tasks is excluded from monitoring scope.
T1053.005detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces scheduled task abuse when it is in scope of the monitored network/system events, but the control is scoped to network-level protections and does not mandate host-level detection of task creation/execution/hiding.
T1053.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface systemd timer abuse (especially privileged/root-level persistence via network-activated or anomalous service changes), but the control is scoped to network-level monitoring and does not mandate host/process telemetry for all timer installations.
T1053.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous container-orchestration job scheduling in monitored Kubernetes environments; partial because scope is set by organizational requirements and many container clusters fall outside routine network monitoring.
T1053.007prevents — A.8.20 requires network-level hardening, protocol disabling, connection filtering (firewalls), segregation, monitoring, and isolation under attack, which can block lateral movement or C2 needed to reach and abuse the orchestration API/scheduler in many deployments, but leaves the technique fully executable via local cluster access, misconfigured RBAC, or already-compromised nodes.
T1055detects — A.8.20 explicitly requires logging and monitoring (item f, cross-referencing 8.16) of actions affecting information security, which surfaces process injection in flight on monitored hosts and networks; mostly because the clause sets scope by classification/responsibilities rather than mandating universal deep instrumentation, leaving a bounded remainder for unmonitored processes or virtualized segments outside the defined monitoring perimeter.
T1055responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and the broader network monitoring/logging in f directly engage containment once process injection is underway on the network, bounding its spread via lateral movement or C2 while the remainder (in-process injection without observable network artifacts) is addressed by referenced controls such as 8.16.
T1055.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and network/device monitoring can surface anomalous process behavior tied to DLL injection on monitored Windows endpoints; however the clause's scope is set by organizational requirements and centers on network-level traffic, equipment, and virtualized networks rather than deep host-process injection mechanics.
T1055.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and item f (logging/monitoring for actions affecting security) enable detection and containment response once DLL injection is underway on a live Windows process, but the bulk of the technique (in-process memory writes, thread creation, privilege escalation) occurs locally without traversing or triggering network boundaries.
T1055.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface in-process PE injection via host/network telemetry when that falls inside the defined monitoring scope; however the control is scoped to network security and does not mandate host-level process monitoring, leaving most in-process PE injection outside its view.
T1055.002prevents — A.8.20 requires network-level protections (firewalls, protocol hardening, device authentication, segmentation, monitoring, and isolation under attack) that can stop the network-based delivery or lateral movement needed for many PE injection attacks, but the technique itself is an in-memory host process injection that can still succeed locally without touching the network.
T1055.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related logging/monitoring (f) plus network segmentation enable containment response once PE injection is underway on a live Windows process, but this is a narrow slice of the technique's in-memory execution that does not broadly eradicate the actor's foothold or injected code.
T1055.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and network segmentation/hardening can surface anomalous process behavior on monitored segments; however the control is scoped to network-level activity and does not mandate host/process telemetry that would catch in-process thread hijacking.
T1055.003prevents — A.8.20's network-focused controls (firewalls, segmentation, protocol hardening, device authentication, monitoring, and virtualized network isolation) can block lateral movement or initial delivery vectors that enable process injection on remote Windows systems, but do nothing to stop local in-process thread hijacking once code execution is already present.
T1055.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and the overall network monitoring/logging in f enable detection and containment response once thread hijacking is underway on a monitored network segment, but this is a narrow slice of the technique's local process-memory actions with no general response mechanism.
T1055.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface APC injection as anomalous process/thread behavior; however the clause's scope is set by organizational requirements rather than mandating host-level instrumentation that would reliably catch in-process APC queuing or Early Bird/AtomBombing variants.
T1055.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and item f (logging/monitoring for actions affecting security) enable detection and containment response once APC injection is underway on a live Windows process, but the bulk of the technique (in-process APC queue manipulation, Early Bird, AtomBombing) occurs locally without traversing or compromising the network itself.
T1055.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous process behavior or memory writes involved in TLS callback injection; however the control is scoped to network-level monitoring and does not mandate host/process instrumentation that would catch the majority of in-memory PE/TLS manipulations.
T1055.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface ptrace-based injection on Linux (especially via anomalous syscalls or process behavior); however the control is scoped by organizational requirements and does not mandate the specific host-level instrumentation needed to catch all variants of this technique.
T1055.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which can surface proc-memory injection as anomalous process behavior on Linux; this is limited to a chosen monitoring scope rather than a bounded remainder, matching the A.8.16 vs T1055 partial anchor.
T1055.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which can surface EWM injection as anomalous process behavior on monitored Windows systems; however the control's scope is set by organizational requirements and focuses on network-level protections, leaving many in-process EWM injection cases outside its instrumentation.
T1055.012detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and network/device monitoring (items i, j, k, m) can surface anomalous process-creation or memory-manipulation patterns that realize T1055.012; however the control is scoped to network-level visibility and does not mandate host-process telemetry, leaving most in-process hollowing undetected.
T1055.013detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface process doppelgänging as anomalous behavior on Windows networks/systems, but the control's scope is set by organizational requirements and does not mandate the specific host-level instrumentation needed to reliably catch this low-level TxF/memory technique.
T1055.013prevents — A.8.20 requires network-level protections (firewalls, segregation, protocol hardening, device authentication, monitoring, isolation on attack) that can block some lateral-movement or C2 vectors used to deliver/animate doppelganging, but the core technique is an in-process memory abuse on a already-compromised Windows host and is not stopped by network controls.
T1055.013responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and item f (logging/monitoring for actions affecting security) enable detection and containment response once the technique is underway on a monitored network segment, but most of the in-process TxF abuse occurs locally without traversing or triggering network boundaries.
T1055.014detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface VDSO hijacking as anomalous process behavior or memory manipulation on Linux networks/systems, but only where such monitoring is scoped in (see A.8.16 cross-ref) and does not guarantee coverage of this specific in-process technique.
T1055.015detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces in-process anomalous behavior such as ListPlanting's message-passing and callback execution; however, the control is scoped by organizational requirements rather than mandating universal host-level instrumentation, leaving gaps for unmonitored processes or variants that avoid monitored APIs.
T1055.015responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and item f (logging/monitoring for actions affecting security) enable detection and containment response once ListPlanting is underway on a Windows endpoint, but the control is scoped to network-level actions and does not address in-process UI control abuse.
T1056detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces input-capture techniques on monitored networks, devices and endpoints; this is only a slice because the clause's scope is set by organisational requirements rather than mandating universal instrumentation of all input paths (e.g. local API hooking on unmonitored hosts).
T1056.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces keylogging once it runs on monitored endpoints or network devices; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal keystroke-level instrumentation, leaving many methods (e.g. custom drivers, hardware buffer reads on unmonitored hosts) unreached.
T1056.003detects — A.8.20.f explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which would surface anomalous credential-capture code or login-page tampering on an externally facing portal; the remainder (stealthy or non-network-visible implementations) is a genuine slice rather than the bulk.
T1056.003prevents — A.8.20 requires network-level protections (firewalls, segregation, hardening, protocol disabling, monitoring, and isolation under attack) that can block the initial exploitation vector or post-compromise admin access needed to implant the web portal capture code, but leaves open many web-application and legitimate-admin paths that the technique explicitly contemplates.
T1056.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface credential-hooking anomalies (especially on networks or via device connections), but the control's network-centric focus leaves most in-process API hooking on endpoints outside its primary scope.
T1057detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces process-discovery activity on covered networks/systems; this is bounded by the control's network-centric scope and implementation-dependent coverage of endpoints, network devices, and virtualized networks, leaving many local process-enumeration vectors (e.g. direct /proc reads, unmonitored hosts) unreached.
T1059detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces abuse of interpreters once it occurs on monitored network segments or devices; this is only a slice of the technique's broad platform surface and execution vectors (e.g. local non-networked abuse).
T1059prevents — A.8.20's hardening, protocol disabling, network segmentation, connection filtering (firewalls), device authentication, and isolation measures can stop many interpreter-abuse vectors that rely on network delivery, remote services, or vulnerable protocols, but built-in local interpreters remain available on most platforms and the control does not remove or prohibit them.
T1059responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) is an explicit response action once an attack leveraging interpreters is underway, but the rest of the control is about hardening, prevention, logging and segmentation rather than active containment/eradication of an in-progress interpreter abuse.
T1059.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface PowerShell abuse on Windows endpoints or networks when that activity is in scope, but the control is network-centric and does not mandate host-level detection of in-memory or non-powershell.exe PowerShell execution.
T1059.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface AppleScript abuse (e.g. via osascript, anomalous AppleEvents, or network effects from remote interaction) when it falls inside the monitored scope; however the clause sets scope by business needs rather than mandating coverage of all scripting execution vectors, leaving a large slice of local-only AppleScript use unaddressed.
T1059.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface cmd.exe abuse when it is in scope of the monitored network, systems or applications; the remainder is large because the clause sets scope by organisational requirements rather than mandating host-level command-line monitoring, so many T1059.003 executions stay outside that scope.
T1059.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface Unix shell abuse (especially interactive or anomalous use via C2/lateral movement); however, the control is scoped to network-level activity and does not mandate host-level detection of shell script execution or Busybox use on endpoints.
T1059.004prevents — A.8.20's hardening, protocol disabling, network segmentation, connection filtering (firewalls), device authentication, and isolation measures can stop many common vectors for obtaining and abusing a Unix shell (e.g. via exposed services, lateral movement, or vulnerable network entry), but do not reach the dominant family of local or already-authenticated shell execution, script abuse, or non-network vectors on the listed platforms.
T1059.004responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once a shell-abuse event is underway on the network; the remainder of the clause is detection/logging/hardening that does not respond to an in-flight technique.
T1059.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface Python-based execution (especially anomalous or unauthorized use on monitored networks/systems); however the control's scope is network-focused and does not mandate host-level detection of all Python abuse.
T1059.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface network-borne JS execution (e.g. drive-by downloads or anomalous script activity); this is limited to a slice because the control is scoped to network-level actions and does not address in-memory JS abuse on endpoints outside monitored network telemetry.
T1059.008detects — A.8.20 explicitly calls for logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection of device connections (item j) and attack isolation (item m), which surfaces CLI abuse on network devices in a subset of cases but does not mandate comprehensive coverage of all CLI commands or scripting activity.
T1059.008prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which stop adversaries from reaching or successfully abusing the network device CLI; this is a genuine but incomplete slice of the technique (remote access vectors, permission models, and post-access abuse remain unaddressed).
T1059.008responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once the technique is underway on a network device, but the clause's other items are about hardening, prevention, and monitoring rather than active response to an in-flight CLI abuse.
T1059.009detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which can surface abuse of cloud APIs when it occurs within monitored network, system or application scopes, but the control is scoped by organizational requirements and does not mandate coverage of all cloud API calls or tenant-wide administrative actions.
T1059.009prevents — A.8.20's network-level controls (firewalls, segregation, protocol hardening, device authentication, logging/monitoring, and virtualized network isolation) can block some abuse vectors for cloud APIs (e.g. blocking unauthorized network paths or vulnerable protocols to reach cloud shells/CLIs), but do not address the dominant permission-based abuse via valid credentials/tokens that the technique relies on.
T1059.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface Lua script execution on monitored platforms (esp. network devices); this is limited to a chosen scope rather than universal instrumentation, matching the A.8.16 partial anchor.
T1059.012detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface hypervisor CLI abuse on monitored networks or devices (e.g. anomalous esxcli usage), but the clause's scope is set by organizational requirements and does not mandate coverage of hypervisor-specific CLIs or all virtualized/SDN environments.
T1059.012prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack; these directly constrain adversary access to and abuse of the hypervisor CLI on platforms like ESXi, but only address a slice of the technique (network-exposed vectors) while leaving local/admin-privileged execution on the hypervisor itself untouched.
T1059.013detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces abuse of container CLIs/APIs when those actions fall inside the monitored scope (e.g. anomalous container commands or API calls); however the clause sets scope by organizational requirements rather than mandating container-specific instrumentation, leaving a large slice of in-container or unmonitored orchestration activity undetected per the A.8.16 event-lane anchor.
T1059.013prevents — A.8.20 requires network-level protections (firewalls, segregation, hardening, protocol disabling, authentication of systems/devices, isolation under attack) that can block some vectors for reaching and abusing container CLIs/APIs over networks, but leaves local/container-runtime abuse, misconfigured RBAC, and many in-cluster calls untouched.
T1068detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (including network activity, device connections, and attacks), which can surface exploitation attempts or anomalous privilege-escalation behavior on the network; this is a genuine but minority slice of the technique (network-visible only, not the local kernel/driver exploitation itself).
T1068prevents — A.8.20's network hardening, protocol disabling, segmentation, monitoring, authentication of systems/devices, and virtualized network separation can block several network-delivered privilege-escalation exploits (especially those relying on vulnerable services, drivers delivered over the network, or lateral movement from containers), but the technique's core (local exploitation of already-present OS/software/kernel flaws, including BYOVD after initial access) is mostly outside its network-focused scope.
T1069detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces permission-group discovery activity on monitored networks and devices; the remainder is the broad set of local, non-network, and out-of-scope discovery techniques (e.g. many Windows/Linux enumeration commands) that the control's network-centric scope does not instrument.
T1069.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface domain enumeration commands on monitored hosts or networks; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal coverage of all discovery techniques or platforms.
T1069.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface cloud group/permission enumeration post-authentication as anomalous behavior; however, the control is scoped to network-level traffic and device management rather than cloud API calls or identity queries, leaving most of the technique's platform-specific implementations outside its view.
T1070detects — A.8.20 item f) explicitly requires logging and monitoring to enable detection of actions that can affect or are relevant to information security, which surfaces indicator-removal activity on networks and devices; this is only a slice of the broad, platform-specific T1070 class (e.g. command history or file-metadata tampering on endpoints).
T1070.003detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces command-history clearing on monitored network devices, hosts, and ESXi; this is only a slice of the technique's surface because the control's scope is set by organizational requirements rather than mandating universal coverage of all platforms and history mechanisms.
T1070.007detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16/8.15), which surfaces the clearing activity itself on monitored networks and devices; this is only a slice because the control's dominant focus is network protection and access restriction rather than specifically instrumenting post-connection artifact tampering across all platforms and log locations.
T1070.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces the cleanup actions (registry mods, service deletion, account removal) that constitute T1070.009; extent is partial because the control is scoped to network-level monitoring and does not mandate host-level detection of all persistence-cleanup variants across all platforms.
T1071detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (item f, cross-referencing 8.16), plus detection of device connections (item j) and attack isolation (item m), which can surface anomalous application-layer protocol use; this is a genuine but minority slice of the broad technique that blends with any of many common protocols across platforms.
T1071prevents — A.8.20 requires network-level controls (firewalls, protocol disabling, segregation, authentication of systems/devices, monitoring, and isolation under attack) that can block or filter many application-layer protocol abuses, especially on public/wireless/third-party links or with vulnerable protocols; this stops the technique for a genuine but minority slice of cases rather than the dominant family of blended C2 that matches expected traffic.
T1071responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once an in-progress C2 event is detected, which is the core of `responds`; the remainder of the clause (hardening, filtering, logging, segregation, protocol disablement) is preventive or detective and does not address an already-underway T1071 session.
T1071.001detects — A.8.20 explicitly requires logging and monitoring of network actions (item f, cross-referenced to 8.16) plus detection-oriented items such as restricting/filtering connections (i), detecting device connections (j), and isolating subnetworks under attack (m); these surface anomalous or unauthorized web-protocol C2 traffic that blends with legitimate flows, though coverage is not exhaustive for every possible concealment technique inside common HTTP/S or WebSocket fields.
T1071.001prevents — A.8.20 explicitly lists restricting/filtering network connections (e.g. firewalls), segregating admin channels, hardening devices, disabling vulnerable protocols, and isolating subnetworks under attack, which can block or break the specific abuse of web protocols for C2 by filtering non-conformant traffic or blocking the channels; this is a genuine but minority slice of the class (most web-protocol C2 blends with allowed traffic and is not stopped by network-level controls alone).
T1071.001responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus protocol restrictions (n,i) enable containment actions once web-protocol C2 traffic is detected as an active attack, but most of the clause is preventive configuration rather than incident response.
T1071.002detects — A.8.20 explicitly requires logging and monitoring of network activity (item f, cross-referencing 8.16) plus detection-oriented measures such as restricting/filtering connections (i), detecting device connections (j), and isolating subnetworks under attack (m), all of which surface anomalous use of common file-transfer protocols like SMB/FTP that blend with legitimate traffic.
T1071.002prevents — A.8.20 explicitly lists restricting/filtering network connections (firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, segregating admin channels, and safeguarding data over networks/wireless, which directly stops many file-transfer protocol abuses (e.g. blocking TFTP/FTP, filtering anomalous SMB) before they blend in; partial because common legitimate use of SMB/FTP in environments limits blanket prevention without breaking operations, and concealment in legitimate flows can still occur.
T1071.002responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus protocol disabling (n) act on an in-progress file-transfer-protocol C2 event once underway, containing its spread; this is a genuine but minority slice of the control's network-protection scope.
T1071.003detects — A.8.20 explicitly requires logging and monitoring (item f, cross-referencing 8.16) of network actions plus detection of device connections (item j), network traffic filtering (item i), and protocol hardening (item n), which surfaces anomalous or concealed use of common mail protocols like SMTP/POP3/IMAP in T1071.003; the bounded remainder is traffic that perfectly mimics expected patterns without triggering the implemented monitoring scope.
T1071.003prevents — A.8.20 explicitly requires restricting/filtering network connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, segregating admin channels, and protecting confidentiality/integrity over networks, which can block or break covert C2 blending inside common mail protocols; this is genuine but only a slice because the technique can still succeed via legitimate mail traffic that policy permits or via non-network vectors.
T1071.003responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once the technique is underway, but the clause's other items are preventive, detective or hardening measures that do not address an in-flight mail-protocol C2 session.
T1071.004detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (item f, cross-referencing 8.16), which surfaces anomalous or tunneled DNS traffic that blends with legitimate flows; this is genuine detection but only a slice because the clause sets scope by organizational requirements rather than mandating DNS-specific depth or handling of infrequent beacons.
T1071.004prevents — A.8.20 explicitly lists restricting/filtering network connections (firewalls), disabling vulnerable protocols, segregating admin channels, hardening devices, authenticating systems, logging/monitoring, and isolating subnetworks under attack — all of which can stop or block many forms of DNS tunneling and beaconing that rely on unfiltered, unauthenticated, or vulnerable protocol use, but leaves a bounded remainder (legitimate DNS traffic that must be allowed, infrequent/low-volume beacons that blend with normal traffic, and post-authentication abuse inside permitted flows).
T1071.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related logging/monitoring/hardening items act on an in-progress DNS-tunneling event to contain its spread once underway, but most of the technique (blending, beaconing, infrequent exfil) is not addressed by the listed response actions.
T1071.005detects — A.8.20.f explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous use of pub/sub protocols when they fall inside the chosen monitoring scope; this is genuine detection but only a slice, as the clause sets scope by business requirements rather than mandating coverage of every protocol or broker-mediated channel.
T1071.005prevents — A.8.20 explicitly requires restricting/filtering network connections (e.g. firewalls), disabling vulnerable protocols, hardening devices, segregating traffic, and protecting against unauthorized access over networks, which can block many pub/sub protocol abuses that rely on open brokers or unfiltered traffic; it does not guarantee prevention for all implementations or all pub/sub traffic that blends with expected flows.
T1071.005responds — A.8.20 item m explicitly calls for temporarily isolating critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once adversary C2 via pub/sub is underway; the remainder of the clause is about hardening, filtering, logging and prevention rather than active response.
T1072detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces abuse of centralized deployment/management tools once they execute commands or move laterally; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating instrumentation of every management suite or network device (cf. A.8.16 partial on T1055).
T1072prevents — A.8.20's network hardening, segregation, authentication of systems, restriction/filtering of connections (e.g. firewalls), disabling vulnerable protocols, and isolation under attack directly constrain the network-based access and lateral movement that T1072 relies on for abusing deployment tools, but do not stop initial credentialed access to the management suite itself or its abuse once inside.
T1074detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces staging activity on the network or connected systems; this is bounded by the control's network-centric scope (e.g. not all local file copies or in-VM staging without observable network or device effects).
T1074.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; staging collected data (especially via shells, file copies, registry writes, or archive tools) is observable anomalous behavior on monitored hosts, but the clause sets scope by organizational requirements rather than mandating universal coverage of all staging locations or platforms, leaving a large slice unseen.
T1074.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces staging activity on networks or systems (especially in virtualized/SDN environments), but the clause is scoped to network-level actions rather than all host-based or cloud-instance staging.
T1078detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces abuse of valid accounts (especially anomalous use of inactive/over-privileged ones) once underway; this is bounded by the clause's scope-setting language and cross-references, leaving many T1078 vectors (e.g. dormant accounts, initial credential compromise without observable network actions) outside what the control mandates.
T1078prevents — A.8.20 requires network-level protections (authentication of systems, restricting/filtering connections, firewalls, hardening, disabling vulnerable protocols, segregation, monitoring) that stop many abuse paths for valid accounts over the network (VPNs, remote desktop, network devices); however, it does not address credential compromise itself, inactive/local accounts, or non-network pivoting inside already-authenticated sessions.
T1078.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and items i/j/k/n target network behaviors that would surface default-account abuse on network devices; this is genuine but only a slice of the technique (network-device subset of platforms, post-compromise actions rather than initial credential abuse on all listed platforms).
T1078.001prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, restricting/filtering connections (e.g. firewalls), authenticating systems, segregating admin channels, and isolating subnetworks under attack, which directly stops default-account abuse on network devices and many virtualized/SDN environments; this is only a slice of the technique's broad platform scope (OS defaults, cloud roots, containers, apps, post-setup accounts).
T1078.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces domain account abuse (e.g. anomalous logons or privilege use) when it occurs on the network; this is only a slice of the technique because the control is scoped to network-visible events rather than all credential compromise vectors such as local dumping or offline attacks.
T1078.002prevents — A.8.20's network-level controls (firewalls, segregation, authentication of systems/devices, protocol hardening, isolation under attack) can block many paths to credential compromise and domain account abuse, but leave open vectors such as endpoint credential dumping, password reuse, and legitimate domain logons that the network controls do not reach.
T1078.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces local-account abuse (e.g. anomalous logons, credential dumping, or lateral movement) when those actions fall inside the chosen monitoring scope; the remainder is the slice of platforms, accounts, or behaviors the organization elects not to monitor.
T1078.003prevents — A.8.20's network-level controls (firewalls, authentication of systems, restricting/filtering connections, hardening devices, disabling vulnerable protocols, segregating admin channels, and virtualized network isolation) can block many network-based abuse paths for local accounts (lateral movement, remote initial access, credential harvesting over the wire), but do nothing against local abuse on a single already-compromised host, password reuse on non-network vectors, or credential dumping that never traverses the network.
T1078.004detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous use of valid cloud accounts (e.g. brute-force, unusual pivots, or privilege assumptions) once they are in flight; this is a genuine but minority slice because the clause's scope is set by what the organization deems relevant rather than mandating universal cloud-account instrumentation.
T1078.004prevents — A.8.20 requires network-level protections (firewalls, authentication of systems/devices, segregation, protocol hardening, monitoring, and isolation under attack) that can block some cloud-account abuse paths when they traverse or depend on the network (e.g., lateral movement, hybrid sync pivots, or unauthenticated device connections), but leaves the dominant account-compromise vectors (phishing, brute force, credential misuse, misconfigured IAM roles, and token theft inside the cloud provider) untouched.
T1080detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces tainting of shared network content once it occurs; this is bounded by the fact that the clause sets scope by organisational requirements rather than mandating universal coverage of all shared-storage access or file-integrity events, leaving a slice determined by the implementer.
T1080prevents — A.8.20 requires network segmentation, access restrictions/filtering (e.g. firewalls), device authentication, hardening, disabling vulnerable protocols, and safeguards for data over networks, which can block many vectors for tainting shared network content or propagating via shares; however, it does not address internal code repositories, binary infection mechanics, or all lateral movement paths once access is obtained.
T1080responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly contains an in-progress taint-shared-content campaign that is already propagating via shared network locations, but the bulk of the control's text is about static network hardening, logging, segregation and prevention rather than active incident response.
T1082detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces system information discovery attempts (especially via network CLI, APIs, or anomalous queries); this is bounded by the control's network-centric scope, leaving local non-networked discovery (e.g. direct systeminfo.exe or esxcli on isolated hosts) outside its primary mechanism.
T1083detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces file and directory enumeration (especially on network devices or across network shares) when it occurs within the monitored scope; the remainder is local non-networked discovery on endpoints outside that scope.
T1087detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface account enumeration activity (especially on networks, via anomalous queries or access to account stores), but the clause is scoped to network-level monitoring rather than host, file, or cloud API enumeration methods that dominate the technique.
T1087prevents — A.8.20's network-level hardening, segregation, authentication of systems, restriction/filtering of connections, disabling of vulnerable protocols, and monitoring directly block several discovery vectors (e.g. unauthenticated remote enumeration, lateral movement to query accounts, abuse of exposed management interfaces or leaky protocols), but leave local host-based methods (PowerShell, file searches) and many cloud/SaaS/identity-provider interfaces untouched.
T1087.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes discovery/enumeration activity such as domain account listing; however the clause's scope is set by organizational requirements rather than mandating universal coverage of all discovery commands or platforms, leaving a slice uncovered.
T1087.002prevents — A.8.20's network segmentation, authentication of systems, restriction/filtering of connections (e.g. firewalls), hardening, disabling vulnerable protocols, and monitoring can prevent some discovery vectors (especially remote LDAP queries or unauthenticated enumeration), but local commands (net, PowerShell, ldapsearch on a compromised host) and many legitimate domain queries remain unblocked.
T1087.003detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces reconnaissance like T1087.003 when it triggers observable network, authentication or directory events; this is a genuine but minority slice because the control's dominant focus is network protection, device management and segmentation rather than endpoint or application-layer account enumeration.
T1087.004detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which would surface cloud account enumeration commands when they match defined monitoring scope; however the control is scoped to network-level activity and does not mandate detection of authenticated IAM/API calls inside cloud-provider management planes.
T1090detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which can surface proxy-based C2 traffic as anomalous; this is only a slice of the broad technique (e.g., it does not guarantee detection of all chained/CDN proxies or all platforms).
T1090prevents — A.8.20 explicitly lists network separation, restricting/filtering connections (e.g. firewalls), authenticating systems/devices, hardening, disabling vulnerable protocols, and isolating subnetworks under attack, all of which stop many common proxy-based C2/redirection techniques from being established or used; it does not address all cases such as abusing legitimate CDN routing or proxies already inside trusted paths.
T1090responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once proxy-based C2 traffic is underway and detected, which is the core of `responds`; the remainder of the clause is about prevention, hardening, logging and architecture rather than active response to an in-flight technique.
T1090.001detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16), restricting/filtering connections via firewalls (i), detecting device connections (j), and hardening/isolation of vulnerable protocols or attacked subnetworks (k,m,n), all of which surface internal proxy traffic that deviates from baselines or uses unexpected redirection.
T1090.001prevents — A.8.20 requires network segmentation, firewalls, connection filtering/restriction, protocol disabling, device hardening, logging/monitoring, and isolation under attack, which can block many (but not all) internal proxy setups especially on unhardened or unsegmented networks; it does not reach every platform or every p2p blending technique an adversary can still deploy inside an already-compromised environment.
T1090.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once an internal-proxy C2 event is underway; the remainder of the clause (firewalls, logging, hardening, protocol disablement, etc.) is preventive or detective and does not address an in-progress technique.
T1090.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (item f, cross-referencing 8.16), which surfaces anomalous proxy use or unexpected external redirection in network traffic; this is limited to what falls inside the chosen monitoring scope rather than a bounded remainder of the technique itself.
T1090.002prevents — A.8.20 explicitly lists network segregation, restricting/filtering connections (e.g. firewalls), hardening devices, disabling vulnerable protocols, authenticating systems, logging/monitoring, and isolating subnetworks under attack, all of which can block or raise the bar for external proxy C2 redirection on many platforms; it does not guarantee prevention for every possible external proxy implementation or victim-compromised outbound path.
T1090.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related logging/monitoring/hardening items act on an in-progress C2 proxy technique once underway to contain its spread, but most of the clause is preventive configuration rather than active response
T1090.003detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referenced to 8.16) plus detection-oriented items such as restricting/filtering connections, authenticating systems/devices, and isolating subnetworks under attack, which can surface multi-hop proxy traffic or anomalous routing; this is a genuine but minority slice because the control's dominant focus is preventive network design/hardening/segregation rather than broad detection of already-obfuscated chains (especially Tor/ORB/P2P that are designed to resist tracing).
T1090.003prevents — A.8.20 requires network segmentation, proxy-aware monitoring/logging, protocol hardening, device authentication, connection filtering/firewalls, and isolation of attacked subnetworks, which can block many multi-hop proxy chains (especially those relying on vulnerable protocols, unauthorized device connections, or boundary bridging); however, it does not stop adversary-controlled external proxies (Tor/ORB/P2P) or chains built entirely outside the defended network.
T1090.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once the multi-hop proxy technique is detected and underway, but the clause's other items are preventive, detective or hardening measures that do not act on an in-flight chain.
T1090.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and network devices can surface domain fronting via anomalous TLS/HTTP header mismatches or unexpected routing; this is only a slice because the control's scope is set by organizational requirements and does not mandate instrumentation that reliably catches the obfuscation itself.
T1091detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface removable-media-based replication (e.g. via device connection, autorun, or anomalous file activity) when it falls inside the scoped monitoring; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating coverage of all removable-media vectors or air-gapped systems.
T1091prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems/devices, and isolating subnetworks under attack; these directly block many network-based vectors for delivering/activating malware via removable media (including USB-mounted mobile devices), but the technique's core (physical media transfer + autorun on air-gapped systems) has a large remainder untouched by network controls.
T1092detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface removable-media C2 activity (e.g. anomalous file writes/transfers) when that activity falls inside the chosen monitoring scope; the remainder is out-of-scope networks, unmonitored endpoints, or air-gapped systems where no such detection occurs.
T1095detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as restricting/filtering connections, authenticating systems/devices, and isolating subnetworks under attack; this surfaces many non-app-layer protocol uses (e.g. anomalous ICMP, VMCI, or protocol tunneling) but leaves real gaps for traffic that is required (ICMP), localized to a hypervisor (VMCI), or hidden inside allowed flows, so only a slice is detected.
T1095prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and protecting data over networks (including virtualized/SDN), which stops many non-app-layer protocol abuses (ICMP tunneling, UDP, SOCKS) from succeeding; it reaches only a slice because VMCI-localized ESXi backdoors explicitly evade network segmentation/firewalls and external monitoring tools, and the control does not mandate protocol removal where required for functionality.
T1095responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once non-application-layer C2 is detected in flight, which is the core of `responds`; the remainder (most other listed items are preventive or detective, and VMCI-localized traffic evades network-level isolation) keeps it from mostly.
T1098detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces account manipulation on covered network devices and infrastructure; this is only a slice of the broad technique that also spans non-network platforms, local accounts, identity providers, and containers.
T1098.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces credential-addition activity on cloud networks and management channels; this is a genuine but minority slice because the clause is scoped to network-level actions rather than identity/credential events inside cloud IAM surfaces.
T1098.003detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces the API calls or configuration changes that add cloud roles/permissions; this is a genuine but minority slice because the control is scoped to network-level actions, equipment, and traffic rather than the dominant IAM/policy modification surface inside cloud tenants.
T1098.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces SSH authorized_keys modifications on monitored hosts and network devices; however the clause's scope is set by organizational requirements rather than mandating universal coverage of all platforms or modification vectors (e.g. cloud API calls), making the coverage a chosen slice rather than a bounded remainder.
T1098.004prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and protecting against unauthorized network access; these block many vectors for reaching and modifying authorized_keys (especially on network devices or via exposed SSH), but leave direct post-compromise file edits, cloud API abuse, and local shell modification on already-authenticated Linux/macOS hosts untouched.
T1098.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces anomalous device registrations (especially at scale or from compromised accounts); this is a genuine but minority slice of the technique's full surface because the clause sets scope by organizational requirements rather than mandating universal device-registration telemetry.
T1098.005prevents — A.8.20 explicitly requires restricting/filtering systems connections (firewalls), detecting/restricting/authenticating device connections, hardening devices, segregating admin channels, disabling vulnerable protocols, and securing virtualized networks; these directly block unauthorized device registration to bypass MFA/conditional access on many but not all enrollment paths (e.g. credential-compromised self-enrollment or insider-registered VMs remain reachable).
T1098.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces the permission/role modification in a container orchestration system; however, the control is scoped to network-level actions, equipment, and traffic rather than Kubernetes-specific RBAC/ABAC changes inside the orchestration layer.
T1098.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface the group-addition commands or anomalous privilege changes on the network; this is a genuine but minority slice because the control's dominant focus is network boundary protection, device hardening, segregation and isolation rather than host-level account or group modification detection.
T1102detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as restricting/filtering connections, detecting device attachments, and isolating subnetworks under attack, which can surface anomalous use of external web services for C2 within expected traffic; this is only a slice because the control is scoped to network-level observables and does not guarantee detection of all web-service C2 variants (e.g. those blending fully into legitimate API noise or using provider encryption).
T1102prevents — A.8.20 requires network-level safeguards (firewalls, filtering, protocol disabling, segregation, monitoring, and virtualized separation) that can block many common Web-service C2 channels when they rely on unauthorized outbound connections, vulnerable protocols, or unapproved network paths, but leaves a substantial remainder where the service is already permitted, uses standard HTTPS, or blends into expected traffic.
T1102.001detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which can surface anomalous resolver traffic or redirects in monitored networks, but this is scoped to network-layer observables and does not guarantee detection of the obfuscated/encoded dead-drop content or the legitimate-web-service cover itself.
T1102.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous bidirectional C2 traffic over legitimate web services; this is bounded by the fact that the control sets monitoring scope by organisational requirements rather than mandating universal depth or analytics that would catch all covert uses of expected web noise.
T1102.002prevents — A.8.20 requires network-level safeguards (firewalls, connection filtering/restriction, protocol disabling, segregation, logging/monitoring, and virtualized network separation) that can block many outbound C2 channels to unapproved web services, but leaves open the common, high-traffic services (Google, Twitter, etc.) that the technique deliberately exploits for cover and that are typically permitted.
T1102.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once bidirectional C2 is detected and underway, which is the core of `responds`; the remainder (most other listed items are preventive or detective) makes the coverage a genuine but minority slice.
T1102.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of legitimate web services for one-way C2 (especially via network monitoring of outbound connections), but the control's scope is set by organizational requirements and does not mandate detection of this specific technique across all platforms or traffic.
T1102.003prevents — A.8.20 requires network-level safeguards (firewalls, filtering, protocol disabling, segregation, monitoring, and virtualized isolation) that can block many common one-way web-service C2 channels, but leaves a bounded remainder where the outbound HTTPS traffic to popular legitimate sites is permitted by design and blends with expected noise.
T1104detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces multi-stage C2 callbacks, redirects, and anomalous network behaviors on monitored segments; this is limited to a chosen scope rather than universal coverage of all staged channels or fallback paths.
T1104responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once the multi-stage C2 channel is active and detected, but the clause's other items are preventive, detective or hardening measures that do not act on an already-underway technique.
T1105detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces ingress tool transfers over networks; this is a genuine but minority slice because the clause is network-centric and does not address non-network vectors (e.g. cloud sync, search-ms, or local abuse of installers) named in the T1105 description.
T1105prevents — A.8.20 requires network-level safeguards (firewalls, protocol disabling, connection filtering/authentication, segmentation, monitoring, and hardening) that can block many common ingress vectors (e.g. unauthorized protocols, unfiltered inbound transfers, lateral spread), but leaves open slices such as C2 channels, abused legitimate services (Dropbox/OneDrive sync, web services), and post-compromise execution of allowed tools (curl, certutil, PowerShell, etc.) on already-authenticated systems.
T1105responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly acts on an ongoing ingress-tool-transfer event by containing its spread once underway; the remainder of the clause (firewalls, logging, hardening, protocol disabling, etc.) is preventive or detective rather than responsive.
T1106detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces native API abuse when it is inside the chosen monitoring scope (e.g. anomalous syscalls or process-creation patterns); the remainder is the large slice of direct/assembly syscall use that evades user-mode hooks and is outside the network-centric or scoped monitoring the control actually mandates.
T1110detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces brute-force attempts (especially network-visible ones); this is limited to a slice because the clause sets scope by organizational requirements rather than mandating universal coverage of all brute-force vectors (e.g. offline, non-network, or post-compromise local guessing).
T1110prevents — A.8.20 requires network-level protections (firewalls, authentication of systems, restricting/filtering connections, hardening devices, disabling vulnerable protocols, logging/monitoring, and isolating subnetworks under attack) that stop many brute-force attempts reaching authentication services or succeeding over the network, but leaves offline attacks, post-compromise internal guessing, and policy-bypass variants untouched.
T1110responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once brute-force activity is detected as an ongoing network attack, which is the core of `responds`; the remainder of the clause is about prevention, hardening, logging and architecture rather than active response to an in-flight brute-force event.
T1110.001detects — A.8.20 explicitly requires logging and monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating on detected attack; n: disabling vulnerable protocols), which surface password-guessing attempts over the listed management ports and wireless interfaces on networks and devices.
T1110.001prevents — A.8.20 explicitly requires restricting/filtering network connections (firewalls), hardening devices, disabling vulnerable protocols, segregating admin channels, authenticating systems, logging/monitoring, and protecting confidentiality/integrity over networks — all of which stop unauthenticated password-guessing attempts from reaching the listed management services and wireless interfaces before they can succeed.
T1110.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once password-guessing activity is underway, which is the core of `responds`; the remainder of the clause is preventive or detective and does not act on an in-progress guessing campaign.
T1110.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces password-cracking attempts (especially those involving network devices or authentication traffic); this is only a slice of the technique because cracking is routinely performed offline on adversary-controlled systems outside the monitored network perimeter.
T1110.002prevents — A.8.20's network protections (firewalls, authentication of systems/devices, protocol disabling, segmentation, logging/monitoring, and hardening) can stop an adversary from obtaining the hashes in the first place or from using the cracked credential on the network, but the core offline cracking act occurs on adversary-controlled systems outside the target network and is not reached by these measures.
T1110.003detects — A.8.20 explicitly requires logging and monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which surface password-spraying attempts against the listed management ports/services on the network; the remainder is throttling or non-network vectors (e.g. cloud SSO) that fall outside network-scope monitoring.
T1110.003prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, segregating admin channels, authenticating systems, and protecting confidentiality/integrity over networks; these directly stop password spraying against the listed management services/ports on network devices, Linux, Windows, etc., leaving only a bounded remainder (e.g. already-authenticated SSO/federated/cloud paths or non-network vectors).
T1110.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once password spraying is detected and underway; the remainder of the clause is preventive or detective rather than responsive.
T1110.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and items i/j/m/n can surface credential-stuffing attempts against network services; however the clause sets scope by organizational requirements rather than mandating universal coverage of all stuffing vectors (SSO, federated, email, non-network auth).
T1110.004prevents — A.8.20 requires network-level protections (firewalls, protocol disabling, device authentication, segmentation, monitoring, and hardening) that can block credential-stuffing traffic to many of the listed management ports and services, but leaves open the remainder of application-layer, SSO, federated, and cloud-authentication vectors that do not rely on those network exposures.
T1110.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once credential stuffing is detected as an in-progress network attack, which is the core of `responds`; the remainder of the clause is preventive or detective and does not act on an underway event.
T1111detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces MFA interception techniques (e.g. keyloggers, anomalous network auth, compromised SMS flows) when they occur on or via monitored networks; this is only a slice of the technique's full surface (endpoint token capture, out-of-band interception, prediction) rather than a bounded remainder.
T1113detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface screen-capture activity when it is observable in network traffic, process execution, or endpoint telemetry that falls inside the chosen monitoring scope; the remainder is local-only captures that produce no network or detectable artifact under the clause's discretionary scope.
T1114detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces email collection activity on monitored networks or systems, but the clause's scope is set by organizational requirements and does not mandate coverage of all email collection vectors (e.g. client-side or offline).
T1114.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface local email collection activity on monitored endpoints or networks; this is only a slice because the control is scoped to network-focused monitoring and does not mandate host-level detection of file access.
T1114.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous credential use or bulk email collection against Exchange/Office 365; this is only a slice of the technique because the clause sets scope by organisational requirements rather than mandating universal coverage of all remote email collection vectors.
T1114.002prevents — A.8.20's network protections (segmentation, firewalls, protocol hardening, authentication of systems/devices, logging/monitoring, isolating subnetworks under attack) can stop or limit an adversary's ability to reach and query an Exchange server or externally facing service from within or across the network, but do not block credentialed access once inside or address the email-collection action itself.
T1114.003detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces the creation or presence of forwarding rules as anomalous activity on email systems; this is limited to a slice because the control is scoped by what the organization designates as relevant rather than mandating detection of every possible forwarding-rule artifact or hiding technique.
T1119detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces automated collection activity once it runs on the network; this is only a slice of the technique (network-visible actions, not all local/cloud API/ETL use inside a compromised host).
T1119prevents — A.8.20's network segmentation, access restrictions, protocol hardening, logging/monitoring, and isolation of subnetworks under attack can stop some automated collection paths (especially those relying on lateral movement or untrusted network segments), but most of the technique (local command/script interpreter use, cloud API calls, or built-in RAT functionality after initial access) is unaffected.
T1120detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and item j) requires detecting device connections; this surfaces T1120 reconnaissance on attached peripherals in monitored environments but only where that activity falls inside the chosen monitoring scope.
T1123detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface audio-capture activity on monitored endpoints or networks; this is scoped by organizational requirements rather than mandating universal coverage of all T1123 vectors (e.g., offline or non-networked peripherals).
T1125detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface video capture malware or anomalous device API use once it runs; this is bounded by the fact that the clause sets scope by organisational requirements rather than mandating universal device-level instrumentation, leaving some executions (e.g. in unmonitored environments or without host telemetry) unseen.
T1127detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface use of trusted developer utilities as anomalous behavior on Windows networks; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating detection of this specific technique or its proxy-execution artifacts.
T1127.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of a signed binary like MSBuild for proxy execution; this is limited to a slice (implementation-dependent scope per 8.16 cross-ref and network-centric focus) rather than reliably catching all such technique instances.
T1127.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface ClickOnce abuse (e.g. anomalous child processes of DFSVC.EXE, unusual .appref-ms/.application execution, or Rundll32 dfshim.dll activity) when network or host telemetry is in scope; partial because the clause sets monitoring scope by requirements rather than mandating universal coverage of this Windows-specific technique.
T1127.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of a build utility like JamPlus on Windows; this is a genuine but minority slice of the control's network-centric focus (most items target network segmentation, device hardening, protocol restrictions, and virtualization rather than endpoint process/script execution).
T1129detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface shared-module loading anomalies (especially from network/UNC paths or unexpected devices), but the clause is scoped to network-level activity and does not mandate host-process instrumentation that would catch arbitrary local dlopen/LoadLibrary calls.
T1132detects — A.8.20.f explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces encoded C2 traffic as anomalous network behavior; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating detection of encoding itself, leaving most protocol-obfuscated C2 outside guaranteed coverage.
T1132.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces encoded C2 traffic as anomalous network behavior; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating detection of encoding itself, leaving most standard-encoding cases (e.g. protocol-compliant Base64 over allowed channels) unreached.
T1132.002detects — A.8.20 item f explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces anomalous C2 traffic using non-standard encoding; the remainder (custom non-standard schemes that mimic legitimate traffic) is not reliably caught by generic network monitoring.
T1133detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which surface T1133 activity on monitored external-remote-service vectors; this is only a slice because the clause's scope is set by organizational requirements rather than mandating universal coverage of all external remote services or containerized exposures.
T1133prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack — all of which stop many external remote service vectors (exposed unauthenticated APIs, weak VPN/RDP gateways, vulnerable protocols) from being reachable or exploitable, but leaves a bounded remainder (credentialed access via valid accounts, properly secured services, and Tor hidden services).
T1133responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once the external-remote-service technique is already running and impacting the network; the remainder of the clause is about hardening, prevention, detection and configuration rather than active response to an in-flight event.
T1134detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface token manipulation when it produces observable network, system or anomalous behavior; the remainder (purely local, in-memory token theft with no network or detectable side-effect) lies outside the network-focused scope of the control.
T1134.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface token impersonation artifacts (e.g. anomalous thread tokens or privilege-use events) when those fall inside the chosen monitoring scope; the remainder is the many implementations where host/process telemetry is scoped out.
T1134.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface token creation/impersonation anomalies on Windows networks; this is scoped by organizational requirements rather than mandating comprehensive coverage of the technique, leaving a large slice (e.g., non-network, host-only, or unmonitored endpoints) unreached.
T1134.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface anomalous process-spawning and PPID relationships on monitored Windows endpoints; this is only a slice because the clause sets scope by organisational requirements rather than mandating universal process-monitoring depth or PPID-specific detection.
T1134.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface SID-History injection (a privileged Windows AD manipulation observable via audit logs or anomalous privilege use); however the control is scoped to network-level actions, equipment, and traffic rather than host/AD object changes, leaving most of the technique outside its primary instrumentation.
T1135detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface network share discovery activity (e.g. SMB/Net queries) when it falls inside the chosen monitoring scope; the remainder is unconstrained by the control's implementation-dependent scope.
T1135prevents — A.8.20 requires network segmentation, hardening, protocol disabling, connection filtering (e.g. firewalls), authentication of systems/devices, and logging/monitoring that can block or constrain SMB-based share enumeration on many but not all paths, leaving residual exposure on permitted shares and internal networks.
T1136detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces account creation (especially on network devices or in IaaS/cloud where the control applies); this is only a slice of the broad technique across all listed platforms, not the bulk.
T1136.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces local account creation (especially on network devices/firewalls) as anomalous; this is a genuine but minority slice of the technique's surface (most creation occurs on endpoints outside network-focused monitoring).
T1136.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes creation of domain accounts as a persistence action; however the control is scoped to network-level monitoring rather than comprehensive host/AD auditing of account management events.
T1136.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces creation of cloud accounts (especially privileged or anomalous ones) in IaaS/SaaS/identity-provider environments; this is only a slice of the technique because the control is scoped to network-focused monitoring rather than comprehensive IAM/identity-provider auditing.
T1137detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface Office-application startup anomalies (e.g. unexpected add-in loads or macro executions) within the monitored network scope, but the control is scoped to network-level activity and does not mandate host/endpoint visibility into Office persistence mechanisms.
T1137.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous macro-enabled template loading or registry changes at runtime; this is a genuine but minority slice of the technique's full attack surface (pre-compromise template modification, search-order hijacking, and trusted-location abuse are not directly instrumented by network-focused monitoring).
T1137.001prevents — A.8.20's network-level protections (firewalls, protocol hardening, device authentication, logging, segregation, and virtualized network isolation) can block remote template pulls or macro-enabled Office traffic over networks, but the technique's dominant local file/registry hijacks on a compromised endpoint remain untouched.
T1137.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; this can surface the anomalous Office Test registry modification or DLL load at startup on monitored endpoints, but the clause's scope is set by organizational requirements and does not mandate coverage of this specific persistence vector.
T1137.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface the anomalous email, form loading, or code execution tied to this persistence technique on monitored networks/endpoints; partial because scope is set by organizational requirements and does not mandate coverage of this specific Outlook mechanism.
T1137.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous Outlook behavior or malicious URL loads on the network; this is a genuine but minority slice of the technique (network-visible only, not the mailbox/registry persistence itself).
T1137.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces the anomalous rule creation or the triggered execution on receipt of crafted mail; the remainder is that the clause sets scope by organisational requirements rather than mandating detection of this specific persistence technique.
T1137.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface add-in loading at Office startup as anomalous behavior on monitored endpoints; however the clause's scope is set by organizational requirements and is network-centric, leaving many client-side Office add-in executions outside its instrumentation.
T1176detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface malicious extension installation or anomalous behavior on endpoints; this is a genuine but minority slice because the control's dominant focus is network-level traffic, segmentation, device hardening and isolation rather than host-application extension inspection.
T1176.001detects — A.8.20.f explicitly requires logging and monitoring of network actions that can affect or are relevant to information security (cross-referenced to 8.16), which can surface anomalous network traffic or connections from malicious browser extensions (e.g. C2, background web activity, or RAT installation), but this is limited to observable network effects on a subset of the technique's full scope including silent local file modifications and non-network persistence.
T1176.001prevents — A.8.20's network-level controls (firewalls, authentication of systems/devices, protocol hardening, segregation, monitoring, and virtualized network isolation) can block some installation vectors that rely on network access or C2, but do not address local file modification, social engineering, browser store abuse, or file-based persistence on the endpoint.
T1176.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous IDE-extension behavior (e.g. unexpected network tunnels, code execution, or persistence) once the technique is running on a monitored endpoint; this is only a slice because the control's scope is set by organizational requirements and does not mandate IDE-specific or extension-installation monitoring.
T1185detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces anomalous browser behaviors such as session hijacking or unauthorized intranet pivoting on monitored networks; partial because the control's scope is set by organizational requirements and does not mandate instrumentation of all browser-process or client-side injection vectors.
T1185prevents — A.8.20's network-level controls (firewalls, segregation, protocol hardening, device authentication, logging/monitoring, and isolating subnetworks under attack) can block intranet pivoting and some injection vectors that rely on network traversal or vulnerable protocols, but do not stop browser-process injection, local proxy setup, or session hijacking that stays inside an already-authenticated browser session.
T1187detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces forced-authentication attempts observable on the network; this is a genuine but minority slice because the control is scoped to network-level actions and does not address client-side triggers (e.g. .LNK/.SCF rendering or document template loading) that never generate detectable network traffic.
T1187prevents — A.8.20 requires network-level safeguards (firewalls, protocol hardening, authentication of systems/devices, segregation, disabling vulnerable protocols, and isolating subnetworks under attack) that can block many external or unauthorized SMB/WebDAV/EFSRPC flows used in T1187, but leaves open vectors such as internal lateral movement, spearphishing-triggered client-initiated connections, and legitimate but abused internal shares.
T1187responds — A.8.20 m explicitly lists temporarily isolating critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once the forced-authentication technique is already underway; the remainder of the control (firewalls, logging, hardening, protocol disablement) is preventive or detective rather than responsive.
T1189detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and item m) requires detection of network attacks that could include drive-by delivery; this surfaces some instances (e.g. anomalous network traffic or device connections) but leaves the dominant client-side browser exploitation and watering-hole vectors outside network-level detection.
T1189prevents — A.8.20 requires network-level protections (firewalls, segmentation, protocol hardening, device authentication, monitoring, isolating subnetworks under attack) that can stop the post-exploitation lateral movement or C2 that commonly follows a successful browser exploit, but the core drive-by delivery and client-side exploitation occur before any network boundary is crossed and are untouched by these controls.
T1189responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once a drive-by has delivered code and is executing on the internal network; this is a genuine but minority slice of the full incident-response workflow named by `responds`.
T1190detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to network information security (item f, cross-referencing 8.16), which surfaces exploitation attempts against exposed network-facing services, applications, and devices; this is only a slice of T1190 because many application-layer flaws (e.g., web app bugs per OWASP/CWE) are not inherently network events and fall outside the control's network-centric scope.
T1190prevents — A.8.20 requires network-level protections (firewalls, filtering, protocol disabling, device hardening, authentication, segregation, and isolation under attack) that stop many classes of public-facing exploits from reaching the target, but leaves residual paths via unhardened apps, misconfigurations, or vulnerabilities in allowed services/protocols.
T1190responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once exploitation is underway, which is the core of `responds`; the remainder of the clause is preventive or detective and does not act on an in-progress T1190 event.
T1197detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface BITS job abuse (e.g. anomalous background transfers, persistence, or exfil), but the control is scoped to network-level monitoring rather than host process or COM interface behavior, leaving a large remainder of the technique undetected.
T1197prevents — A.8.20's network hardening, protocol disabling, connection filtering/firewalls, segregation, logging/monitoring, and virtualized network separation can block many BITS abuse vectors that rely on network activity, but the technique's local COM/PowerShell/BITSAdmin interfaces, job database persistence, and non-networked execution aspects remain unaddressed.
T1199detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces third-party network abuse or anomalous trusted connections once present; this is bounded by the clause's scope-setting language and cross-references (e.g. 8.16), leaving many T1199 vectors (e.g. dormant delegated admin relationships or unmonitored physical-contractor access) outside what is instrumented.
T1199prevents — A.8.20 requires network segmentation, access restrictions/filtering (firewalls), authentication of systems/devices, hardening, disabling vulnerable protocols, and safeguards for third-party/wireless/public networks, which directly constrains the less-scrutinized trusted third-party connection vector on the same enterprise network; partial because the control is scoped to network-level protections and does not reach the upstream compromise of the trusted partner's own account or the business decision to grant the elevated relationship.
T1199responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly contains an in-progress supply-chain compromise once underway, but the rest of the clause is about hardening and prevention rather than active response to a realized T1199 event.
T1200detects — A.8.20 explicitly requires logging/monitoring (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which can surface hardware additions after they are plugged in or begin affecting traffic, but this is only a slice of the physical/introduction vector itself (many additions can be passive or pre-compromise).
T1200prevents — A.8.20 explicitly requires restricting/filtering connections to the network (firewalls), detecting/restricting/authenticating equipment and devices connecting to the network, hardening devices, segregating admin channels, and isolating subnetworks under attack, which directly stops many hardware additions (e.g. rogue APs, taps, or DMA devices) from being introduced or functioning as access vectors; partial because physical insertion before network attachment, wireless bypasses, and insider-placed devices remain outside its network-focused scope.
T1202detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface indirect command execution as anomalous network, process or system behaviour; this is only a slice because the clause sets scope by organisational requirements rather than mandating universal depth of instrumentation that would catch every stealthy abuse of utilities such as forfiles, pcalua or ssh -o ProxyCommand.
T1203detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces in-network exploitation attempts or anomalous client-application behavior on monitored segments; partial because the clause sets scope by organizational requirements rather than mandating universal client-application or endpoint instrumentation depth, leaving many browser/office/third-party exploit paths outside monitored boundaries.
T1203prevents — A.8.20's network-level measures (firewalls, protocol disabling, segmentation, monitoring, device authentication, and isolation under attack) can block some delivery vectors and limit lateral movement after client exploitation, but do not stop the root cause of client-application vulnerabilities being present or exploited via user-initiated files or browser activity.
T1204detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces user execution of malicious payloads delivered via network (e.g. phishing, malicious links/files); this is a genuine but minority slice of the broad technique that also includes non-network vectors such as local files, vishing, or manual coercion.
T1204.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface user clicks on malicious links as anomalous behavior or follow-on execution; this is limited to a slice because the clause sets scope by organizational requirements rather than mandating universal detection of all link-based execution paths.
T1204.002detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces user execution of malicious files as observable follow-on behavior; this is a genuine but minority slice of the technique because the clause's scope is set by organizational requirements rather than mandating universal coverage of all file-execution vectors across all platforms and phases.
T1204.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces malicious image deployment or anomalous container/image behavior on IaaS/container platforms; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal image or runtime scanning.
T1204.004detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which can surface anomalous user commands or paste events on monitored endpoints or networks, but the control's network-centric focus leaves most client-side social engineering and local paste-to-interpreter actions outside its primary scope.
T1204.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces malicious library installation or network-borne delivery; this is a genuine but minority slice of the technique (network-visible only, not the dominant supply-chain or local-install vectors).
T1205detects — A.8.20 explicitly requires logging and monitoring (item f, cross-referencing 8.16) of actions that can affect or are relevant to information security, which surfaces traffic signaling attempts (unusual packet sequences, crafted packets, magic values) when they fall inside the chosen monitoring scope; it does not mandate universal packet-level instrumentation, leaving a large slice of implementations that would miss it.
T1205prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, segregating admin channels, logging/monitoring, and isolating subnetworks under attack, all of which can block the packet sequences, magic values, or crafted traffic that enable T1205 on networks and devices; however, it does not address host-based implementations, custom software listeners, raw sockets, Wake-on-LAN, or pre-patched embedded devices, leaving a substantial remainder.
T1205responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once signaling is detected and underway; this matches `responds` but covers only a named slice of the technique (network-level isolation, not host-level port opening, custom software triggers, or WoL).
T1205.001detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; i: filtering with firewalls; m: isolating subnetworks under attack; n: disabling vulnerable protocols), all of which surface the anomalous port-knocking sequence on the monitored estate; the bounded remainder is custom raw-socket or libpcap implementations that produce no observable network artifact distinguishable from legitimate closed-port traffic.
T1205.001prevents — A.8.20 explicitly lists restricting/filtering network connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, and segregating admin channels — all of which can block the port-knocking sequence or its firewall-trigger effect on many platforms; it does not reach custom software implementations, raw-socket variants, or non-network-layer triggers, leaving a genuine minority slice unaddressed.
T1205.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related logging/monitoring/hardening/filtering directly enable containment actions once port-knocking C2 or persistence is detected in flight, but this is only one named slice of the full incident response workflow (no eradication, no actor removal, no coordination with IR-4-style handling).
T1205.002detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented practices such as restricting/filtering connections, authenticating systems/devices, hardening, and isolating under attack, which can surface socket-filter installation or triggered activity on monitored interfaces; however, the technique's passive/low-activity/raw-socket nature (as stressed in the source prose) leaves substantial residual undetected on many conformant implementations.
T1205.002prevents — A.8.20 requires network-level controls (firewalls, filtering of connections, protocol disabling, segregation, monitoring, and hardening) that can block the inbound crafted packet or the raw-socket/filter installation step on many but not all platforms/configurations; residual exposure remains for local elevated processes that install filters before network controls engage or on unmonitored interfaces.
T1205.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and the overall purpose of protecting networks from compromise directly match the `responds` verb of acting once the technique is underway to contain it; other items like logging/monitoring (f), restricting/filtering (i,j), and disabling protocols (n) are preventive or detective rather than responsive, leaving only a slice of the control's listed mechanisms that address an in-flight socket-filter backdoor.
T1207detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces rogue DC registration and replication anomalies in AD networks; this is bounded by the technique's explicit design to bypass SIEM and logging, plus the clause's scope being set by organizational requirements rather than mandating universal AD-specific detection.
T1207prevents — A.8.20 requires network segmentation, authentication of systems on the network, restricting/filtering connections (e.g. firewalls), hardening of devices, disabling vulnerable protocols, and isolating subnetworks under attack, all of which can block rogue DC registration or replication in many AD network configurations, but leaves open slices such as insider admin abuse, misconfigured trusts, or attacks that do not rely on network transit.
T1207responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once a rogue-DC registration and replication attack is detected and underway, which is the core of `responds`; the remainder of the clause (firewalls, logging, hardening, protocol disablement) is preventive or detective and does not act on an in-progress event.
T1210prevents — Network segmentation, device hardening, and protocol restrictions limit opportunities to exploit remote services for lateral movement.
T1210detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16), hardening (k), restricting/filtering connections (i), and detecting device connections (j), all of which surface exploitation attempts or anomalous remote-service activity on the network; the remainder is post-exploitation behavior that succeeds without observable network artifacts.
T1210responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once exploitation/lateral movement is underway, but the bulk of the clause is about static network hardening, segmentation, logging, and authentication that act before the technique runs.
T1211detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces stealthy exploitation that circumvents monitoring or hides in unmonitored components; this is only a slice because the clause's scope is set by organizational requirements rather than mandating universal depth or coverage of all stealth vectors (e.g. SaaS/cloud flaws).
T1211prevents — A.8.20 mandates network-level protections (firewalls, segregation, protocol disabling, device hardening, monitoring, isolation under attack) that stop many exploitation vectors used for stealth (e.g. vulnerable protocols, unhardened devices, unmonitored segments, public/wireless exposure), but leaves residual paths inside already-trusted components, applications, or SaaS/IaaS layers where the technique can still succeed.
T1212detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces exploitation attempts (including those targeting credentialing mechanisms) when they generate observable network or system anomalies; this is limited to a slice because the clause sets scope by organizational requirements rather than mandating universal instrumentation depth for all credential-exploitation vectors (e.g., local kernel exploits).
T1212prevents — A.8.20 requires hardening network devices, disabling vulnerable protocols, authenticating systems, restricting/filtering connections (firewalls), segregating admin channels, and isolating subnetworks under attack; these directly stop many network-based exploitation vectors (e.g. replay attacks, vulnerable protocol flaws, or remote credential-exploitation paths) before adversary-controlled code can run, but leave a large remainder of non-network credential exploits, local kernel bugs, and application-layer vulns untouched.
T1213detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces adversary mining of (or overly-broad access to) repositories when those actions produce observable network, system or application anomalies; this is a genuine but minority slice of the technique because the control's scope is set by organizational requirements rather than mandating universal repository-specific detection.
T1213prevents — A.8.20's network-level protections (firewalls, segregation, authentication of systems/devices, hardening, disabling vulnerable protocols, monitoring, and isolating subnetworks) can block adversary access to many network-exposed repositories and limit exfiltration paths, but do not address misconfigured repository ACLs, overly-broad user permissions, or direct abuse of legitimate sharing features inside the repository itself.
T1213.001detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which would surface adversary access and exfiltration activity against a Confluence repository once underway.
T1213.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces SharePoint mining activity when it occurs on monitored networks or systems.
T1213.003detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including network access to repositories), which surfaces the technique once the adversary is inside the victim network or private repo; it is only a slice because the control is scoped to network-level actions and does not mandate repository-specific detection such as audit events on code access itself.
T1213.003prevents — A.8.20's network-level protections (segmentation, authentication of systems/devices, firewalls, protocol hardening, monitoring, and isolation under attack) can block initial network access to internal/private code repositories, but do not address the SaaS platform's own access controls, web/app-level auth, or post-compromise collection once inside the repo.
T1213.005detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces adversary use of messaging apps to mine data when that activity is inside the monitored scope; the remainder is the slice of chat activity (especially SaaS/Office Suite) that organizations do not route through or instrument inside their network/device monitoring.
T1213.006detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces database access and mining activity when it occurs within the monitored network scope; this is only partial because the control's scope is set by organizational requirements and does not mandate database-specific instrumentation or query-level detection.
T1213.006prevents — A.8.20's network-level protections (firewalls, segregation, authentication of systems/devices, protocol hardening, monitoring, isolating subnetworks) can block many remote database access paths used for mining, but do not address local/privileged access, misconfigured DB permissions, or SaaS/PaaS credential abuse where the network boundary is already inside the trust zone.
T1216detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface proxy execution of malicious files via trusted scripts as anomalous behavior on Windows networks; however the clause's scope is set by organizational requirements rather than mandating detection of this specific technique, leaving many implementations that do not instrument script proxying.
T1216.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces anomalous use of signed binaries like PubPrn.vbs for remote proxy execution; this is a genuine but minority slice because the control is scoped by organizational requirements rather than mandating universal coverage of all such abuse on every endpoint.
T1216.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface the anomalous use of a signed LOLBin such as SyncAppvPublishingServer.vbs proxying PowerShell; the remainder (implementation-dependent scope, lack of specific signatures for this exact abuse, and virtualized-network focus) keeps it from mostly.
T1218detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface proxy execution of malicious content via trusted binaries as anomalous behavior; however, the control is scoped to network-level actions and does not mandate host/process-level detection of this technique.
T1218.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of hh.exe or .chm execution on Windows networks; this is only a slice of the technique's full surface (delivery, user execution, and bypass aspects are not network-visible).
T1218.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of control.exe or .cpl loading on monitored networks/systems; partial because scope is set by organizational requirements and does not guarantee coverage of this specific proxy-execution technique.
T1218.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface CMSTP abuse (a signed binary proxying malicious execution) when it triggers observable network, process, or anomalous behavior within the monitored scope; however, the control sets scope by requirements rather than mandating universal depth, leaving many local-only or non-network CMSTP executions unseen (cf. A.8.16 event-lane anchor).
T1218.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface InstallUtil proxy execution as anomalous behavior on Windows networks; however, the control is scoped by organizational requirements and does not mandate detection of this specific technique or all execution paths.
T1218.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface mshta.exe abuse (a network-initiated or anomalous process execution) when it aligns with the organization's defined monitoring scope; however, the control is scoped to network and device management rather than endpoint process telemetry or LOLBin-specific detection, leaving most Windows execution paths outside its guaranteed view.
T1218.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface msiexec.exe abuse (especially anomalous or elevated execution) when network or host telemetry is in scope; however the clause is network-centric and does not mandate host-process monitoring, leaving most local/proxy executions outside its guaranteed coverage.
T1218.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface the anomalous use of a signed binary like odbcconf.exe for DLL execution; this is a genuine but minority slice of the technique (network-focused monitoring and device connection detection in j) do not broadly cover host process abuse).
T1218.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of signed binaries like Regsvcs/Regasm for proxy execution; this is a minority slice of the technique's full scope (network-focused monitoring does not guarantee host-process or LOLBin-specific detection).
T1218.010detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous or malicious use of regsvr32.exe (especially network-aware Squiblydoo loads from external URLs); this is a genuine but minority slice of the technique's full attack surface (local proxy execution, COM hijacking, signed-binary evasion) rather than a bounded remainder.
T1218.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and network-level monitoring (items e, i, j) can surface anomalous rundll32.exe proxy execution or suspicious network activity from it, but the control is scoped to networks and does not address host/process-level detection of the core Windows technique.
T1218.012detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of verclsid.exe as a living-off-the-land binary on Windows endpoints or networks; this is a genuine but minority slice of the control's broad network-oriented scope rather than its dominant purpose.
T1218.013detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface mavinject.exe abuse (a signed binary performing process injection) when it falls inside the monitored scope; however the clause sets scope by organizational requirements rather than mandating universal coverage of all process-injection variants, leaving a slice determined by the implementer (cf. A.8.16 vs T1055 anchor).
T1218.013responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and item f (logging/monitoring for actions affecting security) enable containment-style response once a network-borne injection technique is underway, but the control is scoped to network-level actions and does not address the host-process injection itself.
T1218.014detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface MMC abuse (signed binary proxying malicious .msc/CLSID payloads) when it falls inside the monitored scope; partial because the clause sets scope by requirements rather than mandating universal coverage of this Windows-specific technique (cf. A.8.16 vs T1055 anchor).
T1218.015detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous Electron abuse (e.g. suspicious child processes or JS execution) when it falls inside the chosen monitoring scope; the remainder is the slice of implementations whose scope excludes host/process telemetry for this technique.
T1219detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16), hardening (k), restricting/filtering connections via firewalls (i), detecting device connections (j), and isolating subnetworks under attack (m); these surface post-compromise use of remote access tools on the network (e.g. anomalous sessions, new device connections, or C2 traffic patterns) across the great majority of the technique's network-visible behaviors, with only a bounded remainder (purely local non-networked use after installation) outside its scope.
T1219prevents — A.8.20 explicitly lists network segmentation, restricting/filtering connections (e.g. firewalls), authenticating systems/devices, hardening, disabling vulnerable protocols, and isolating subnetworks under attack, all of which stop many legitimate remote access tools from establishing unauthorized C2 sessions; it does not block every possible RAT (especially those using allowed remote-management channels or already-present software).
T1219responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once the RAT C2 session is underway, but the clause's other items are preventive or detective and the isolation response is scoped only to critical subnetworks rather than arbitrary hosts.
T1219.001detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, and its network-focused items (i, j, k, m, n) plus virtualized-network guidance can surface anomalous tunneling as unexpected connections, protocols, or traffic; however, IDE tunneling blends with legitimate developer workflows and uses proprietary/encapsulated sessions that are not guaranteed to be distinguished by generic network monitoring.
T1219.001prevents — A.8.20 requires network-level safeguards including restricting/filtering connections (firewalls), authenticating systems/devices, hardening, segregating admin channels, disabling vulnerable protocols, and monitoring — all of which can stop many forms of unauthorized IDE tunneling that rely on network traversal, exposed ports, or unhardened devices, but leaves a genuine remainder (legitimate developer workflows, already-authenticated sessions, or IDE extensions running inside permitted developer endpoints).
T1219.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface use of remote desktop tools as anomalous network activity or unauthorized remote access; however, the clause sets scope by organizational requirements rather than mandating universal detection of all legitimate-but-abused RMM tools or their C2 behaviors, leaving a large slice of implementations that do not instrument or alert on them.
T1219.002prevents — A.8.20 explicitly lists network segmentation, restricting/filtering connections (e.g. firewalls), authenticating systems/devices, hardening, disabling vulnerable protocols, and isolating subnetworks under attack, all of which can stop many legitimate-but-abusable desktop support tools from establishing unauthorized C2 channels; it does not reach every possible RMM tool or built-in module on every platform, leaving a genuine minority slice unaddressed.
T1219.002responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus device hardening/restriction (i,j,k,n) enable containment actions once remote-desktop C2 is detected in flight, but the clause is network-centric and does not address eradication of the already-running legitimate desktop-support process or its artifacts on the endpoint.
T1219.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, and item j) requires detecting connections of equipment/devices to the network; hardware KVM/remote-access implants are observable network or peripheral activity that falls inside those mandates, but the clause's scope is set by organizational requirements rather than mandating universal coverage of all possible hardware implants or post-compromise C2 channels, leaving a genuine slice unreached.
T1219.003prevents — A.8.20 requires network-level protections (firewalls, device authentication, protocol hardening, segregation, monitoring, and isolation under attack) that can block or detect many hardware C2 channels once connected, but leaves a genuine slice unaddressed: physical installation of approved KVM devices that are permitted by peripheral policy and use only standard network protocols.
T1219.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related monitoring/logging items enable containment response once hardware-based C2 is active on the network; this is a genuine but minority slice of the full technique (which can be fully local post-install without ongoing network traversal).
T1220detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces anomalous use of msxsl.exe, wmic /FORMAT, or network fetches of remote XSL payloads; the remainder (purely local file-based abuse without observable network or process anomalies) sits outside the network-centric scope of the control.
T1221detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces template-injection activity when it triggers observable network fetches, anomalous authentication, or related events on monitored networks; this is only a slice because the technique's core (modifying document templates offline) has no network footprint until payload retrieval and is outside the clause's network-centric scope.
T1222detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes permission modifications on files/directories that enable further compromise; this is a genuine but minority slice of the broad network-focused control (most of A.8.20 addresses network segmentation, device hardening, protocol restrictions, and virtualization rather than host-file events).
T1222.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface permission modification commands (chmod/chown) when they occur on monitored Linux/macOS systems or network-visible effects; this is only a slice because the clause scopes monitoring by organizational requirements rather than mandating universal coverage of all such local file-system actions.
T1482detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface domain trust enumeration (e.g. via Nltest, LDAP queries) when it falls inside the monitored scope; the remainder is the slice of implementations whose monitoring scope excludes it.
T1484detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces modifications to domain/tenant policy settings in centrally managed identity environments; this is a genuine but minority slice because the clause is scoped to network-layer actions, equipment, and traffic rather than the full breadth of identity-tenant or GPO configuration abuse.
T1484prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, authenticating systems, disabling vulnerable protocols, and isolating subnetworks under attack; these constrain the network-exposed attack surface that adversaries must cross with sufficient permissions to reach and modify domain/tenant policy settings such as GPOs or trusts, but do not block the technique once those permissions are obtained or exercised from an already-authorized host.
T1484.001detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces GPO modification in an AD domain as anomalous privileged activity on SYSVOL paths; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal GPO-specific detection, leaving implementations that omit AD monitoring fully conformant yet blind to the technique.
T1484.001prevents — A.8.20 requires network-level protections (firewalls, authentication of systems/devices, segregation, hardening, protocol disabling, monitoring) that can block some remote or network-borne vectors for reaching and modifying SYSVOL-hosted GPOs, but leaves local/administrative and delegated-write paths inside the AD domain untouched.
T1484.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces trust modifications performed over the network; this is only a slice of the technique (network-visible actions on domain/tenant trusts) rather than the bulk, as many trust manipulations can be performed locally or via already-authenticated sessions without distinct network artifacts.
T1484.002prevents — A.8.20's network-level controls (firewalls, connection filtering/restriction, device authentication, protocol hardening, segregation, and isolation under attack) can block many remote trust-modification vectors that rely on network access or lateral movement, but do not address local/administrative or already-authenticated changes to domain/tenant trust objects.
T1485detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including network-wide availability interruption and device connections), which surfaces data-destruction activity once it begins, but only for the network-visible slice rather than host-level file overwrites or all cloud/VM deletions.
T1485recovers — A.8.20's guidance on network availability, monitoring, isolating critical subnetworks under attack, and virtualized/SDN logical separation enables partial post-destruction recovery of availability to surviving network resources and unaffected segments, but does not restore overwritten/irrecoverable data itself.
T1485responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (drawbridges) when the network is under attack, which is a containment action once destruction is underway; the remainder of the control (hardening, logging, segregation, protocol disablement) is preventive or detective rather than responsive to an in-progress T1485 event.
T1485.001detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which would surface lifecycle policy modifications on cloud storage buckets as anomalous privileged activity; however the clause's scope is set by organizational requirements and does not mandate coverage of every IaaS API call or cloud-native management plane event.
T1486detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces ransomware encryption activity in flight on networks/systems; this is bounded by the clause's scope (network-focused, not exhaustive host/process monitoring of every encryption behavior).
T1486recovers — A.8.20 explicitly calls for controls to maintain availability of network services and connected computers (including temporary isolation of critical subnetworks under attack and hardening), which directly supports post-encryption recovery of access to network resources and data; the named remainder is that it does not itself restore already-encrypted files or provide backups.
T1486responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) plus logging/monitoring (f) and coordination (g) directly enable containment of an in-progress ransomware encryption campaign once underway, bounding spread across the network while other items like hardening or protocol disabling sit outside the verb
T1489detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces service-stop activity once it occurs; the remainder (e.g., silent cloud API calls or unmonitored endpoints) is a slice set by the clause's own scoping language.
T1490detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces T1490 activity (e.g. deletion of shadow copies, disabling recovery, network device changes) when it occurs on monitored networks, devices or connected systems; partial because scope is set by the implementer and many T1490 vectors (local ESXi, offline/cloud backups, non-networked endpoints) sit outside network-centric monitoring.
T1490recovers — A.8.20 explicitly requires maintaining availability of network services/computers, logging/monitoring for security events, hardening devices, segregating admin channels, isolating critical subnetworks under attack, disabling vulnerable protocols, and securing virtualized/SDN networks, which directly enable recovery from T1490's network-targeted deletion of backups, snapshots, firmware, and recovery features.
T1490responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related monitoring/logging items directly enable containment response once T1490 is underway on networked assets, but this is only one narrow slice of the technique's broad platform coverage and deletion methods.
T1491detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces defacement (integrity-affecting modification of visual content) once it has occurred, but the clause's network-centric focus leaves non-network vectors (e.g. direct host or IaaS console edits) as an open remainder.
T1491.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which would surface internal defacement once performed; the remainder (prevention-oriented items a-e, g-n plus virtualized-network guidance) do not address detection of the post-intrusion technique.
T1491.001prevents — A.8.20's network protections (firewalls, segregation, hardening, protocol disabling, monitoring, isolating under attack) can block many remote vectors that enable the post-intrusion internal modifications named in T1491.001, but do not stop all local or already-present footholds that achieve defacement.
T1491.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces external defacement of websites once it has occurred; the remainder (pre-attack reconnaissance, non-network indicators, or defacement of non-monitored external assets) is not covered by the clause.
T1491.002prevents — A.8.20's network protections (firewalls, segregation, hardening, protocol disabling, monitoring, and isolating subnetworks under attack) can block many common vectors for external defacement such as unauthorized network access or exploitation of exposed services, but do not address all paths (e.g. application-layer web vulnerabilities once a legitimate connection is established).
T1495detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces firmware corruption attempts on network devices and attached hardware; the remainder (non-networked endpoints, BIOS-level actions outside monitored scope) is a named slice left by the control's network-centric focus.
T1496detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces resource hijacking (e.g. anomalous compute/bandwidth use or protocol abuse) in monitored networks; partial because scope is set by organizational requirements and omits unmonitored subnetworks, virtualized slices, or non-network indicators like SMS spam.
T1496prevents — A.8.20's network protections (firewalls, segmentation, protocol hardening, device authentication, monitoring, isolating subnetworks under attack) can stop many hijacking vectors that rely on unauthorized network access, bandwidth proxying or external command channels, but leave a genuine remainder such as local compute abuse (cryptomining) once inside or hijacking of already-authorized cloud/SaaS resources.
T1496responds — A.8.20 item m explicitly calls out temporarily isolating critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once resource hijacking (e.g. cryptomining or proxying traffic) is underway; the remainder of the clause is preventive or detective rather than responsive.
T1496.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous compute consumption from hijacking (especially on servers/cloud/containers); this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating universal resource-monitoring depth, leaving many hijacking vectors (e.g., stealthy or non-network-visible) unreached per the A.8.16 event-lane anchor precedent.
T1496.001prevents — A.8.20's network protections (firewalls, connection filtering/restriction, protocol disabling, device authentication, segmentation, monitoring, and virtualized network isolation) can block many common infection vectors for compute-hijacking malware (exposed APIs, unauthorized device/container connections, vulnerable protocols), but do not stop all delivery methods such as phishing, exploited applications, or already-compromised endpoints.
T1496.001responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks when the network is under attack, which is a containment action once compute hijacking (resource exhaustion) is underway; the remainder of the clause is preventive or detective and does not address eradication of the already-deployed mining processes.
T1496.002detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which surface bandwidth anomalies, proxyjacking traffic, scanning, or botnet C2 on the monitored estate; the bounded remainder is pre-compromise external scanning or hijacking of unmonitored/off-premises bandwidth.
T1496.002prevents — A.8.20's network protections (firewalls, connection filtering/restriction, protocol disabling, segmentation, monitoring, and virtualized network separation) can stop many bandwidth-hijacking vectors such as unauthorized outbound botnet traffic, proxyjacking, and scanning, but cannot prevent all cases once a system is already co-opted (e.g., in-process malware on an authenticated endpoint).
T1496.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once bandwidth hijacking is underway, but the clause's other items are preventive, detective or hardening measures that do not act on an in-progress event.
T1496.003detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous SMS traffic, cost spikes, or overwhelmed channels on SaaS messaging infrastructure; partial because the clause sets scope by organizational requirements rather than mandating instrumentation that guarantees detection of this specific fraud vector.
T1496.004detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection of device connections (item j) and attack isolation (item m), which can surface anomalous SaaS resource consumption or enabling of services over the network, but this is limited to observable network-layer signals rather than the SaaS abuse itself.
T1496.004prevents — A.8.20's network-level protections (firewalls, segregation, protocol hardening, device authentication, monitoring, and virtualized network isolation) can block some unauthorized SaaS enablement or abuse vectors when they traverse or depend on the network, but leave the dominant post-compromise SaaS usage (already-authenticated accounts, direct API abuse, or insider-enabled services) untouched.
T1498detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16), hardening (k), restricting/filtering connections (i), detecting device connections (j), and isolating subnetworks under attack (m), all of which surface Network DoS traffic or its effects across the technique's scope on supported platforms.
T1498prevents — A.8.20 explicitly lists network hardening, protocol disabling, connection restriction/filtering (firewalls), segregation, logging/monitoring, and temporary isolation of subnetworks under attack, all of which stop many common Network DoS vectors (e.g. vulnerable protocols, unauthorized flooding sources) from succeeding; it does not address volumetric DDoS saturation of upstream bandwidth, spoofing that evades filtering, or botnets, leaving a large residual slice of the class.
T1498responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once a Network DoS is underway; this is only one of many listed items and does not address eradication or full incident response workflow.
T1498.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (including network flooding/DoS via item f and cross-references to 8.16/8.15), plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which surface the technique in flight across most network traffic and protocols.
T1498.001prevents — A.8.20 explicitly lists network hardening, protocol disabling, connection restriction/filtering (firewalls), segregation, logging/monitoring, and temporary isolation of critical subnetworks under attack, which directly stops many direct flood vectors (especially volumetric ones using vulnerable protocols or unauthorized sources); however, it does not address botnet-scale distributed sources or all possible protocols/traffic patterns, leaving a genuine residual slice.
T1498.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once a flood is underway, which is the core of `responds`; the remainder (most other listed items are preventive or detective) makes the coverage a genuine but minority slice of the control.
T1498.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16), which surfaces reflection/amplification traffic patterns at the network layer; mostly because the clause's scope is set by organizational requirements and may miss unmonitored subnetworks or non-network observables.
T1498.002prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, restricting/filtering connections (e.g. firewalls), segregating admin channels, and protecting against unauthorized access over public/wireless networks, all of which can block common reflectors/amplifiers (e.g. by dropping spoofed-source packets or unused UDP services like NTP/memcached); this is only a slice because the control is scoped to the organization's own networks/facilities and cannot prevent third-party reflectors or protocols it chooses to keep enabled.
T1498.002responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once a reflection-amplification flood is underway; this is only one of many listed measures and does not address eradication of the attacker's foothold or all amplification vectors.
T1499detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (including network attacks that can degrade availability), which surfaces endpoint DoS in flight on monitored networks/systems, but the control's scope is set by organizational requirements rather than mandating universal instrumentation of all endpoint resource-exhaustion vectors.
T1499prevents — A.8.20's network protections (firewalls, filtering, protocol disabling, segregation, monitoring, hardening, and virtualized isolation) stop many endpoint DoS vectors that rely on network delivery or amplification, but leave direct local resource exhaustion or application-layer crashes on the endpoint itself untouched.
T1499responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once an endpoint DoS is underway; this is only a slice of the full technique (resource exhaustion or crash at OS/app layers, spoofing, botnets) so the verb holds but not mostly.
T1499.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (including via 8.16 cross-reference) and detecting device connections or network attacks, which surfaces many network-visible OS-exhaustion floods (e.g. SYN/ACK floods) but does not guarantee detection of all variants or non-network OS exhaustion on every platform.
T1499.001prevents — A.8.20 explicitly lists network-level protections (firewalls for restricting/filtering connections, disabling vulnerable protocols, logging/monitoring for detection, hardening devices, segregating channels, and temporary isolation under attack) that stop many TCP state-exhaustion floods from reaching the endpoint OS, but leaves a remainder of local or non-network vectors plus incomplete coverage of all protocol abuse.
T1499.001responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (e.g. with drawbridges) when the network is under attack, which is a containment action once the OS-exhaustion flood is underway; the remainder of the clause is about hardening, prevention, and detection rather than active response to an in-progress technique.
T1499.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16), hardening (k), protocol disabling (n), and isolating subnetworks under attack (m), all of which surface service-exhaustion floods in flight on the organization's networks and devices; the bounded remainder is attacks against external third-party services outside the monitored estate.
T1499.002prevents — A.8.20 requires network protections including hardening devices, disabling vulnerable protocols, restricting/filtering connections (e.g. firewalls), segregating admin channels, isolating subnetworks under attack, and safeguards for data over public/wireless networks, which can block many volumetric floods and protocol-abuse vectors like SSL renegotiation before they reach services; however, it does not address application-layer resource exhaustion from legitimate-looking HTTP floods that pass filters.
T1499.002responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once a service-exhaustion flood is underway; this is only a slice of the full technique surface (e.g. does not address protocol-level or application-level exhaustion vectors directly).
T1499.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces application-layer resource exhaustion floods once underway; the remainder (non-network, non-monitored application behaviors) is a slice set by the control's scope rather than a bounded remainder of the mechanism itself
T1499.003prevents — A.8.20's network-level protections (firewalls, connection filtering/restriction, protocol disabling, segmentation, monitoring, and virtualized isolation) can block the inbound requests that trigger application exhaustion, but this is only a slice: the technique can still be executed from inside the network, against unfiltered internal apps, or via allowed protocols/features that remain resource-intensive.
T1499.003responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks when the network is under attack, which is a containment action once a DoS flood is underway; the remainder (application-layer resource exhaustion inside already-reached hosts) sits outside network-boundary response.
T1499.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces exploitation attempts or anomalous crashes on networks/systems; this is only a slice because the clause is scoped to network-level actions rather than exhaustive application/system crash detection across all platforms.
T1499.004prevents — A.8.20's hardening, protocol disabling, authentication, segregation, filtering/firewalls, and virtualized network isolation directly block many network-exploitable vulnerabilities that lead to crashes/DoS, but leave a large remainder of non-network application or system exploits (local, zero-day in unhardened apps, or post-compromise) untouched.
T1499.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once exploitation/DoS is underway, which is the core of `responds`; the remainder of the clause (hardening, logging, filtering, disabling protocols) is preventive or detective and does not address an in-flight attack.
T1505detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces adversary installation/abuse of malicious server components (especially on network devices), but the clause is scoped by organizational requirements and does not mandate detection of all such activity across every platform or vector.
T1505prevents — A.8.20 requires network-level protections (firewalls, segmentation, protocol hardening, device authentication, monitoring, isolation under attack) that can block initial delivery or lateral movement of malicious server components on many platforms, but the weakness lives in server-application extensibility features that are often inside the trusted boundary and not reached by network controls.
T1505.001detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces malicious stored-procedure creation or invocation after the fact; the remainder (e.g. stealthy CLR assemblies or non-network-visible database activity) is outside the network-centric scope of the rest of the clause.
T1505.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces registration and invocation of a malicious transport agent on an Exchange server; the remainder (non-network-visible agent behavior, unmonitored internal email pipeline actions) is outside the clause's network-centric scope.
T1505.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces web shell activity on network-accessible servers; this is bounded by the clause's scope-setting language and cross-references (e.g. 8.16), leaving slices like non-network or non-monitored web shells outside its view.
T1505.003prevents — A.8.20 requires network-level protections (firewalls, connection filtering/restriction, device authentication, protocol disabling, segmentation, logging/monitoring, and isolation under attack) that stop many common web-shell installation vectors and limit lateral movement once present, but leaves open the dominant initial-access vector of web-application vulnerabilities on the openly accessible server itself.
T1505.003responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring directly act on an already-underway web shell event to contain its network blast radius, but most of the clause's other items are preventive or setup rather than response-once-underway.
T1505.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces malicious IIS component installation or anomalous traffic modification on the network; this is a genuine but minority slice of the technique (network-visible only, not the local installation act itself).
T1505.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous Terminal Services/RDP behavior or DLL modifications on monitored networks and hosts; partial because scope is set by organizational requirements and does not guarantee coverage of this specific persistence technique.
T1505.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces malicious VIB installation or boot-time changes on ESXi networks; this is only a slice because the control is scoped to network-level actions rather than all hypervisor/VIB-specific behaviors.
T1518detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface software discovery activity on monitored networks/systems, but the control's scope is network-focused and does not mandate host-level detection of the technique across all platforms or discovery methods.
T1518.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes discovery behaviors such as enumeration of security software; this surfaces the technique in flight on monitored networks/systems but is scoped by organizational requirements rather than mandating universal coverage of all discovery vectors (e.g. local commands on unmonitored endpoints).
T1518.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface backup-software discovery commands or anomalous queries; this is limited to what the organization scopes into its monitoring rather than a universal guarantee of catching every instance of the technique.
T1525detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous network activity or unauthorized registry/image modifications in IaaS/container environments; this is only a slice because the control is scoped to network-level actions and does not mandate image-integrity or registry-specific scanning.
T1526detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces cloud service enumeration in monitored environments; however the clause's scope is set by organizational requirements rather than mandating universal coverage of all discovery APIs/tools across IaaS/SaaS/identity platforms.
T1526prevents — A.8.20's network segmentation, authentication of systems/devices, restriction/filtering of connections (e.g. firewalls), disabling vulnerable protocols, and virtualized network logical separation can block many discovery vectors that rely on network reachability or unauthenticated enumeration, but the technique is post-access API/tool-based (e.g. Azure Resource Manager, Stormspotter, Pacu) and can succeed without traversing prevented network paths.
T1528detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces token theft in network traffic or anomalous API calls on monitored segments, but the control's network-centric scope leaves many token-theft vectors (container compromise, IMDS requests inside a VM, social-engineering OAuth grant, CI/CD pipeline compromise) outside its instrumentation.
T1528prevents — A.8.20's network-level protections (segmentation, firewalls, device authentication/hardening, protocol disabling, monitoring, and virtualized network isolation) can block some token-theft vectors that rely on network compromise or lateral movement, but leave the dominant social-engineering/OAuth-phishing, container breakout, CI/CD compromise, and IMDS token-request paths untouched.
T1529detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including via 8.16), which surfaces shutdown/reboot commands or anomalous network-device activity on covered networks, but the control is scoped to network traffic/equipment rather than host-level API calls, privilege use, or non-network platforms.
T1529prevents — A.8.20's network hardening, protocol disabling, authentication, connection filtering/firewalls, logging/monitoring, and isolation mechanisms can block many remote or network-borne shutdown/reboot vectors (e.g. via CLI on network devices or across public/wireless links), but leave local API, privilege, and non-network execution paths untouched.
T1529responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once the shutdown/reboot technique is underway; the remainder is that most of the technique's other mechanics (local API calls, privilege escalation, hypervisor actions) sit outside network-level response.
T1530detects — A.8.20 explicitly requires logging and monitoring of network actions (item f, cross-referencing 8.16) that can surface anomalous access to cloud storage APIs or objects traversing monitored network paths, but this is limited to network-visible events and does not address credential abuse, misconfigured IAM, or direct backend access outside network scope.
T1530prevents — A.8.20 requires network-level protections (firewalls, segregation, authentication of systems/devices, protocol hardening, monitoring, and isolation under attack) that can block many direct API or credential-abuse paths to cloud storage when those paths traverse monitored or filtered networks, but leaves the dominant misconfiguration and IAM-permission slices of T1530 untouched.
T1531detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces account-access-removal activity once it occurs; the remainder (e.g., purely local offline changes, unmonitored SaaS/ESXi paths, or pre-compromise actions) is outside the network-focused scope.
T1534detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces internal spearphishing campaigns (e.g. anomalous internal messages, attachments, or login redirects) once underway; partial because the control sets scope by organizational requirements rather than mandating universal depth or coverage of all vectors like chat apps or impersonation.
T1534prevents — A.8.20's network-level controls (segmentation, firewalls, protocol hardening, device authentication, logging/monitoring, isolating subnetworks under attack) can block delivery vectors for internal spearphishing that rely on network traversal, email gateways, or lateral chat-app propagation, but do not stop credential abuse, device compromise, or social engineering once inside the trusted environment.
T1535detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces adversary creation of resources in unmonitored cloud regions as an anomalous action; this is a genuine but minority slice because the control is scoped to network-level actions and the technique's core (account compromise + region selection) sits outside network monitoring.
T1537detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous internal cloud data transfers to adversary accounts that blend with normal traffic; however, the control is scoped to network-level monitoring of equipment, devices, and traffic (including virtualized/SDN), leaving a large remainder of purely API-driven, non-network cloud-native sharing/backups (e.g. SAS URIs) that the clause does not instrument.
T1537prevents — A.8.20 requires network-level protections (segmentation, firewalls, protocol hardening, monitoring, authentication of systems/devices, and isolation under attack) that can block many internal-to-cloud or API-driven transfers when they cross logical network boundaries or use vulnerable paths, but leaves the dominant cloud-native mechanisms (IAM-driven sharing links, SAS URIs, same-provider API calls that stay inside the provider's address space) untouched.
T1538detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces adversary use of a stolen-credential dashboard session; the remainder is that the clause sets scope by organizational requirements rather than mandating universal instrumentation of every cloud console interaction.
T1539detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces cookie theft in network traffic or anomalous device connections; this is a genuine but minority slice of the technique (local malware/JS injection/memory theft on the endpoint are outside network-focused detection).
T1539prevents — A.8.20 requires network-level protections (firewalls, protocol hardening, traffic encryption, monitoring, device authentication, segregation) that stop several T1539 vectors (network sniffing of cookies in transit, malicious proxies/AiTM, vulnerable protocols, unauthorized device connections) but leave the dominant local vectors (browser memory scraping, disk theft, JS injection, malware on the endpoint) untouched.
T1539responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring directly act on an in-progress network-based session-cookie theft once underway, containing its spread; this is only a slice of the technique's local/browser/proxy vectors, so partial.
T1542detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, and items i/j/k/n plus virtualized-network separation can surface anomalous pre-OS or firmware behavior on network devices; however the technique's core firmware/BIOS overwrite on hosts is explicitly called out as undetectable by host software defenses and lies outside network-bound monitoring scope.
T1542.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, and items i/j/k/n plus virtualized-network guidance can surface anomalous firmware-driven network behaviour or device connections; this is genuine but only a minority slice of the technique, which is primarily a stealthy persistence action outside the OS that leaves no network footprint in the dominant case.
T1542.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, and items i/j/k/n add network and device-level detection of unauthorized connections, vulnerable protocols, or anomalous activity that can surface bootkit indicators (e.g. unexpected boot-sector or ESP changes) once the system is running; this is genuine but only a slice, as the technique executes pre-OS and many indicators are invisible to standard network/host monitoring.
T1542.004detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks under attack), which can surface anomalous firmware loads or ROMMON changes on network devices; this is only a slice of the technique's stealthy, low-level persistence on Cisco platforms rather than a bounded remainder.
T1542.004prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, authenticating systems on the network, restricting/filtering connections (e.g. firewalls), and isolating subnetworks under attack, all of which can stop unauthorized ROMMON firmware loads on network devices; it does not reach every vector (e.g. local physical access or supply-chain insertion) so the coverage is a genuine but incomplete slice.
T1542.004responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once the ROMMONkit technique is already running on a network device; the remainder of the control (hardening, logging, authentication, protocol disablement, etc.) is pre-attack or detection rather than active response to an in-flight technique.
T1542.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous netboot/TFTP activity on network devices; this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating universal instrumentation of boot sequences or TFTP flows.
T1542.005prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, segregating admin channels, and authenticating systems on the network; these directly constrain the configuration manipulation and unauthorized TFTP/netboot steps on network devices, but leave residual paths such as physical access, insider changes, or unaddressed legacy boot sequences.
T1543detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous service/daemon creation or modification on the network; this is a genuine but minority slice of the technique (network-visible only, not local process creation on endpoints outside monitored scope).
T1543.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface launch-agent creation/modification on macOS networks; however, the control is scoped to network-level activity and does not mandate host telemetry for local plist changes.
T1543.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface systemd service creation/modification on Linux networks; this is only a slice because the control is scoped to network-level actions, not host-level systemd unit file changes or generators.
T1543.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous service creation/modification on Windows networks; this is only a slice of the full technique (e.g., it does not address hidden/masqueraded services, driver loading via direct Registry/API, or non-networked endpoints).
T1543.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface Launch Daemon creation/modification or anomalous startup behavior on macOS endpoints; this is only a slice because the control is scoped to network-level monitoring and does not mandate host-level process, file, or plist auditing needed to reliably catch the technique.
T1543.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous container service creation/modification on hosts or networks; this is limited to a slice (observable network/host anomalies within monitoring scope) rather than the full technique (e.g., offline or non-networked container changes).
T1543.005prevents — A.8.20's network-level controls (firewalls, connection filtering/restriction, device authentication, protocol disabling, network segregation, and virtualized network logical separation) can block many remote or network-borne paths to creating/modifying container services on hosts, but do not stop local/administrator actions (e.g. docker run, DaemonSet deployment, or kubelet modification) once an adversary has host access.
T1546detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous event-trigger activity once it occurs, but the clause's network-centric focus leaves most host/endpoint event mechanisms (WMI, cron, etc.) outside its primary scope.
T1546.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces Registry changes and anomalous file-association behavior on monitored Windows endpoints; the remainder is unmonitored systems or stealthy modifications outside the chosen scope.
T1546.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface screensaver-based persistence (e.g. anomalous registry changes or process execution after inactivity) within the monitored scope; however the control is scoped to network activity and does not mandate host-level detection of this local persistence technique.
T1546.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface WMI event subscription activity (especially anomalous or privileged execution), but the control is scoped by organizational requirements and does not mandate instrumentation depth for this specific technique.
T1546.004detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous shell-configuration changes or their effects on Unix/Linux/macOS systems; this is only a slice of the technique because the control is scoped by organizational requirements rather than mandating universal coverage of all shell config files or privilege levels.
T1546.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface trap-based persistence when it triggers observable shell or process anomalies within the monitored network scope; partial because the control's network-centric focus (and cross-references to 8.16) leaves most host-level trap registration and interrupt handling outside its instrumentation.
T1546.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, and items i/j/m/n plus virtualized-network separation can surface anomalous dylib loads or network activity tied to tainted binaries, but the control is scoped to network-level protections and does not mandate host/process-level detection of Mach-O header modifications.
T1546.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous netsh.exe execution or registry changes tied to helper DLL registration on Windows networks; this is only a slice because the clause sets scope by organizational requirements rather than mandating specific detection of this persistence mechanism.
T1546.007prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, and authenticating systems on the network; these can block the network-configuration changes and registry writes needed to register a malicious Netsh helper DLL, but the control is scoped to networks and does not reach arbitrary local persistence mechanisms or non-network-triggered execution of netsh.exe.
T1546.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface anomalous modifications to accessibility binaries, registry pointers, or unexpected SYSTEM-level executions at the login screen; this is a genuine but minority slice of the technique's full attack surface (binary replacement, IFEO injection, RDP-triggered abuse) rather than a bounded remainder.
T1546.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous DLL loads or registry changes tied to AppCert DLL abuse on Windows networks; this is only a slice because the control is scoped to network-level actions, responsibilities, and virtualized/SDN separation rather than host-process or registry monitoring.
T1546.010detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous DLL loading or registry changes involved in this technique on monitored networks/systems, but the control's network-centric focus leaves most host-process behaviors outside its primary scope.
T1546.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces shim abuse (registry changes, shim database installs, process hooking) when those actions fall inside the monitored scope; the remainder is the slice of implementations whose monitoring scope excludes host/process telemetry for this technique.
T1546.012detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface IFEO registry changes or anomalous debugger-based process launches on Windows networks; this is only a slice because the control is scoped to network-level and device-management monitoring rather than host/registry-specific detection of the full technique.
T1546.014detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface emond rule additions or anomalous emond activity on a monitored macOS network endpoint; the remainder is that the control's scope is set by organizational requirements and does not mandate host-level detection of this specific persistence technique.
T1546.015detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous Registry changes or COM execution patterns on Windows endpoints; this is only a slice of the technique because the control is scoped to network-level monitoring and does not mandate host-level detection of COM hijacking itself.
T1546.016detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous installer activity (especially on monitored networks or hardened devices), but the control is scoped to network-level visibility and does not mandate host-based detection of installer script abuse.
T1546.017detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface udev rule modifications or anomalous device-triggered executions on Linux networks/systems, but only where those actions fall inside the scoped monitoring rather than all possible udev abuse.
T1546.018detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface Python startup-hook abuse when it triggers observable network, process, or file events; this is only a slice because the control is scoped to network-level monitoring and does not mandate host-level detection of .pth or sitecustomize.py changes.
T1547detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces anomalous autostart configuration changes or boot-time execution on covered network devices and endpoints; the remainder (non-networked hosts, kernel modifications outside monitored scope, or pre-compromise setup) is outside the control's network-centric focus.
T1547.001detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous registry or startup-folder writes that realize T1547.001; the remainder is that the control does not mandate host-level monitoring of the specific persistence locations or guarantee detection of every stealthy variant.
T1547.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface anomalous LSA authentication package loads or registry changes at boot as part of network/host monitoring scope.
T1547.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface anomalous time-provider registration or boot-time DLL loads on the network; this is only a slice of the technique's full surface (local registry abuse, admin-privileged setup, non-networked execution).
T1547.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous Winlogon helper DLL loads or registry modifications at logon on monitored Windows endpoints; partial because the control's scope is set by organizational requirements and does not mandate instrumentation of this specific persistence vector.
T1547.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface SSP Registry modifications or anomalous LSA DLL loads on Windows endpoints when those events fall inside the chosen monitoring scope.
T1547.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, and items i/j/k/n add network-oriented detection of unauthorized device connections, protocol use and anomalous traffic; this surfaces some LKM/kext loading events on Linux/macOS when they involve observable network activity or device registration, but the core kernel modification for persistence runs below user-space monitoring and is outside the clause's network-centric scope.
T1547.006prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack; these can block many network-based delivery or C2 vectors that malicious LKMs/kexts rely on for initial access or exfiltration, but do not stop local kernel module loading, signed kext installation, or boot-time persistence itself.
T1547.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface LSASS driver modifications or anomalous network/driver behavior on Windows systems, but the control is scoped to network-focused monitoring rather than host/process/driver inspection.
T1547.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; shortcut modification for persistence is such an action on Windows endpoints, but the control is scoped to network-level monitoring and does not mandate host-level detection of file or shortcut changes.
T1547.010detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous port monitor changes or boot-time DLL loads by spoolsv.exe; however the clause's scope is set by organizational requirements and does not mandate instrumentation of this specific persistence vector.
T1547.012detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface anomalous print-spooler or print-processor activity on the network; this is a genuine but minority slice of the technique's local boot-time execution path.
T1547.012prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, and authenticating systems on the network; these can block lateral movement or remote installation vectors for a malicious print processor but do not stop local abuse of the spooler service, registry edits, or SeLoadDriverPrivilege on an already-compromised Windows host.
T1547.013detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous autostart modifications or executions on Linux endpoints when those fall inside the chosen monitoring scope; the remainder is the slice of implementations whose scope (or telemetry) excludes desktop-environment autostart activity.
T1547.015detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous login-item additions or persistence behaviors on macOS networks; this is a genuine but minority slice of the technique's full attack surface (scripted API calls, launchd, backgrounditems.btm) rather than a bounded remainder.
T1548detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces some privilege-escalation activity on networks and devices (especially via network-borne indicators or anomalous connections), but the control's dominant focus is network protection and the T1548 class is mostly local privilege-abuse techniques that monitoring may miss.
T1548prevents — A.8.20's network-level hardening, segregation, authentication, filtering (firewalls), disabling vulnerable protocols, and isolation under attack constrain several T1548 vectors that rely on network-borne privilege-escalation techniques (e.g., abusing exposed services or lateral movement to reach elevation controls), but leave the dominant local abuse of native mechanisms (UAC, sudo, token manipulation) untouched.
T1548.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces UAC bypass attempts (especially those involving process injection, lateral movement, or anomalous privilege elevation); this is a genuine but minority slice because the control is scoped to network-level actions and does not mandate host/process monitoring that would catch the bulk of local UACME-style bypasses.
T1548.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces misconfigurations or abuse of temporary elevation mechanisms in cloud networks; this is a genuine but minority slice because the clause is scoped to network-level actions rather than the dominant identity/permission-layer abuse described in the technique.
T1548.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface TCC database manipulation or anomalous permission grants on macOS networks/devices; however, the control is scoped to network-level activity and does not mandate host/process-level detection of TCC abuse.
T1550detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces use of stolen alternate auth material during lateral movement; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal coverage of all auth-material misuse vectors across every platform.
T1550prevents — A.8.20's network-level controls (firewalls, segregation, authentication of systems/devices, protocol hardening, isolation under attack) can stop lateral movement that relies on stolen alternate auth material over the network, but do not address in-memory theft, local use, or non-network vectors, leaving a large remainder of the technique untouched.
T1550.001detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces token abuse over networks and APIs as anomalous behavior; however, the control is scoped by organizational requirements and network focus, leaving API-only or non-network token misuse (e.g., local container or offline SaaS abuse) outside its guaranteed view.
T1550.001prevents — A.8.20 requires network-level protections (segmentation, filtering/firewalls, device authentication, protocol hardening, logging/monitoring, isolating subnetworks under attack) that can stop token exfiltration or lateral use over the network in many cases, but the technique's core (stealing and replaying a valid token via API) lives above the network layer and can succeed without traversing monitored boundaries or using vulnerable protocols.
T1550.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface PtH lateral movement (observable via anomalous authentication or network behavior), but the control's scope is set by organizational requirements and does not mandate instrumentation depth for all PtH vectors (e.g., in-process or non-networked use).
T1550.002prevents — A.8.20 requires network-level protections (segmentation, authentication of systems, restricting/filtering connections, hardening devices, disabling vulnerable protocols, isolating subnetworks under attack) that can stop PtH lateral movement in many Windows network scenarios, but leaves a genuine minority slice (local PtH, non-networked use, or credential use that does not traverse a protected network boundary) untouched.
T1550.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces PtT lateral movement in network traffic or on monitored hosts; this is only a slice because the control's scope is set by organizational requirements and does not mandate instrumentation depth sufficient to catch all PtT variants (e.g., golden/silver tickets or overpass-the-hash).
T1550.003prevents — A.8.20 requires network-level protections (segmentation, firewalls, protocol hardening, device authentication, logging/monitoring of network actions, and isolation under attack) that can stop many PtT lateral-movement attempts that rely on network transport or exposed services, but leaves the core credential-theft and ticket-use steps (OS Credential Dumping, local ticket manipulation, and Kerberos auth bypass) untouched.
T1550.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once lateral movement via PtT is underway; the remainder of the clause (firewalls, logging, hardening, protocol disablement) is preventive or detective rather than responsive.
T1550.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous use of a stolen web session cookie (e.g. via network or application telemetry); this is only a slice of the technique's surface because the control's scope is set by organizational requirements rather than mandating detection of all cookie replay vectors.
T1550.004prevents — A.8.20 requires network-level protections (firewalls, segmentation, protocol hardening, device authentication, logging/monitoring, and isolating subnetworks under attack) that can stop cookie theft vectors such as network sniffing, lateral movement, or compromised devices on the same network, but leaves the dominant post-compromise replay of an already-stolen cookie (imported into an adversary-controlled browser) untouched.
T1552detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces credential-search activity on networks and devices; this is only a slice of the technique (network-visible actions, not local filesystem searches inside a compromised host), so partial rather than mostly.
T1552.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces searches for credential files and related anomalous access; this is a genuine but minority slice of the technique (network-focused monitoring reaches only a subset of local/container file-system searches).
T1552.001prevents — A.8.20 requires safeguards for confidentiality/integrity of data in transit over networks (incl. encryption, segregation, hardening, filtering, disabling vulnerable protocols, and virtualized network isolation), which stops many network-based exfiltration or discovery vectors for credential files but does not stop local filesystem searches, insecure local storage itself, or post-compromise access to files already on a compromised host.
T1552.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces adversary searches of shell history files for credentials as anomalous file access or command execution on Linux/macOS/Windows endpoints.
T1552.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces searches for or export of private keys on network devices and endpoints; this is only a slice of the technique (network-focused monitoring, not host filesystem searches or offline brute-force), so partial per the A.8.16 vs T1055 anchor.
T1552.004prevents — A.8.20's network protections (segregation, authentication of systems, restricting/filtering connections, hardening devices, disabling vulnerable protocols, and safeguards for data over networks) can stop some discovery/export paths for private keys on network devices or over the wire, but do not address insecure local storage/search on endpoints (Linux/Windows/macOS) or most of the technique's post-compromise filesystem focus.
T1552.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces attempts to query the Instance Metadata API from a compromised instance or via SSRF, but the clause's scope is set by organizational requirements and does not mandate coverage of all cloud-specific metadata access vectors.
T1552.005prevents — A.8.20 requires network-level safeguards (firewalls, filtering, segregation, protocol hardening, monitoring, and virtualized network isolation) that can block direct or SSRF-based access to the 169.254.169.254 metadata endpoint from unauthorized network contexts, but leaves residual paths when the adversary already has code execution inside the instance itself.
T1552.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces the enumeration and access of GPP XML files on SYSVOL as anomalous network or file-share activity; this is a genuine but minority slice of the technique (the core weakness is the presence of the decryptable credential store itself, not its detection).
T1552.006prevents — A.8.20 requires network-level protections (firewalls, segregation, authentication of systems/devices, hardening, disabling vulnerable protocols, monitoring) that can block unauthenticated domain users from reaching the SYSVOL share or enumerating XML files over the network, but leaves the core GPP credential-embedding practice itself untouched and does not stop an already-privileged user or in-band access.
T1552.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces unauthorized API access or credential-gathering attempts in container environments; this is only a slice because the clause sets scope by organizational requirements rather than mandating universal container-specific API instrumentation.
T1552.007prevents — A.8.20 requires network-level protections (firewalls, segregation, hardening, protocol disabling, authentication of systems/devices, monitoring) that can block unauthorized remote API access to container environments over the network, but leaves open many intra-host, misconfigured, or permission-based paths inside the container platform itself.
T1552.008detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces credential exposure in chat services when it occurs within monitored network, system or application telemetry; this is only a slice because the control's scope is set by organizational requirements and does not mandate coverage of every chat service, endpoint message store, SaaS admin portal or integration workflow on every platform.
T1552.008prevents — A.8.20 requires safeguards for data confidentiality/integrity over networks (incl. encryption, segregation, filtering, hardening, protocol disablement and monitoring), which stops many unsecured credential transmissions in chat services from being intercepted or exploited over the network, but leaves user-endpoint sharing, direct server/portal access, and integration-tool compromise untouched.
T1553detects — A.8.20 item f explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces some T1553 subversions (e.g. anomalous network activity tied to cert theft or registry changes on monitored segments) but does not target trust-control bypass itself and leaves most platform-specific mechanisms outside network scope
T1553.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces anomalous network or system activity that could indicate SIP/trust provider tampering (e.g. registry changes or unexpected DLL loads), but the control is scoped to networks and does not specifically target or guarantee detection of this Windows trust-subversion technique.
T1553.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces root-certificate installation as anomalous network-trust or key-management behavior; the remainder (silent or non-networked installation methods on Linux/Windows, or supply-chain pre-installation) is outside the clause's network-centric scope.
T1553.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface MOTW-bypass activity (e.g. anomalous container extraction/mounting or execution of untagged payloads) when that activity falls inside the chosen monitoring scope; the remainder is the many implementations where network-focused monitoring does not instrument the host file-system or process behaviors that realize this technique.
T1553.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; policy modification (registry, bcdedit, csrutil, kernel vars) is such an action and would surface in network/host logs or anomalous behavior monitoring, but the control is scoped to networks rather than endpoint/kernel enforcement so only a slice is covered.
T1554detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces binary modification on hosts (especially via network-borne activity or anomalous execution); this is a genuine but minority slice because the clause is network-centric and does not mandate host-level integrity monitoring of all binaries.
T1555detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces credential-access activity on networks and systems; this is a genuine but minority slice of the technique (local password-store searches on endpoints can occur without network-visible actions, and the clause's scope is set by organizational requirements rather than mandating universal credential-store instrumentation).
T1555.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface browser credential access when it triggers observable network, file, or anomalous behavior within the monitored scope; however the control's network-centric focus leaves most local file/memory reads on endpoints outside that scope.
T1555.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces credential access from the Windows Credential Manager when it occurs within monitored network, system or application scope; the remainder is unmonitored local processes or endpoints outside that scope.
T1555.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface credential extraction from password manager memory or related network activity on supported platforms, but the control is scoped to network-level actions and does not broadly instrument process memory or brute-force attempts against local password manager databases.
T1555.006detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces credential access from cloud secrets stores when it occurs in monitored network or system activity, but the control is scoped to network-level monitoring rather than comprehensive cloud API or privilege-abuse detection.
T1556detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces modifications to authentication processes on covered network assets; this is bounded by the control's network-centric scope and does not reach all platforms or authentication mechanisms named in T1556 (e.g. local LSASS/PAM edits on endpoints).
T1556prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, which stops many network-based paths to reach and modify auth processes (especially on network devices or via remote services); this is only a slice of T1556 because the technique also targets local mechanisms (LSASS, SAM, PAM) on endpoints that the network-focused control does not address.
T1556.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous authentication or LSASS behavior on a domain controller; this is only a slice because the control is scoped by organizational requirements rather than mandating specific detection of domain-controller patching.
T1556.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces malicious password filter registration or anomalous authentication behavior on Windows networks; this is a genuine but minority slice of the technique's full attack surface (e.g., local non-networked endpoints, stealthy in-memory registration).
T1556.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface PAM modifications or anomalous authentication on Linux/macOS systems, but this is scoped by organizational requirements and does not guarantee coverage of all PAM tampering vectors.
T1556.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous authentication or network-device modifications post-compromise; this is limited to a slice because the control's network-focused monitoring does not guarantee detection of the image-patching technique itself on all device types or before the backdoor is used.
T1556.004prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), authenticating systems on the network, segregating admin channels, and disabling vulnerable protocols, all of which can stop the image-patching prerequisite or the resulting backdoor from being reachable on the network; this is a genuine but minority slice of the technique (which lives in the device firmware/OS image itself, outside the network-layer controls).
T1556.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which would surface the setting of AllowReversiblePasswordEncryption (or related AD changes) when network/AD monitoring scope includes it; partial because the control sets scope by organizational requirements rather than mandating detection of this specific property change.
T1556.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces adversary modifications to MFA mechanisms once they occur on the network.
T1556.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces anomalous authentication or configuration changes in hybrid identity processes on networks, but the control is scoped to network-level activity and does not address on-premises/cloud authentication process patching itself
T1556.007prevents — A.8.20 requires hardening network devices, segregating admin channels, restricting/filtering connections (e.g. firewalls), authenticating systems, logging/monitoring network actions, and isolating subnetworks under attack, which can prevent some on-premises vectors for reaching and modifying PTA/AD FS processes but does not address cloud-side modifications, DLL injection inside already-authenticated processes, or the core authentication backdooring itself.
T1556.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces anomalous network-provider DLL registration or credential-capture behavior on Windows; this is only a slice of the full technique because the control's scope is set by organizational requirements rather than mandating universal host-level detection of Registry or DLL loading.
T1556.009detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces modifications to conditional access policies in identity and network contexts; this is a genuine but minority slice because the control's dominant focus is network traffic, device connections, and infrastructure rather than identity-provider policy changes.
T1557detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16), hardening (k), protocol disabling (n), and isolating under attack (m), all of which surface AiTM positioning or its precursors (ARP/DNS abuse, downgrades, anomalous routing) in network traffic or device behavior.
T1557prevents — A.8.20 directly prescribes network segmentation, protocol hardening, disabling vulnerable protocols, authentication of systems/devices, traffic filtering/firewalls, logging/monitoring, and safeguards for data over public/wireless networks, all of which stop the protocol-abuse and downgrade steps that enable AiTM positioning; the bounded remainder is post-compromise or non-network-layer AiTM variants.
T1557responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once an AiTM positioning attempt is underway; this is only a slice of the full technique (other vectors like ARP/DNS poisoning or downgrade attacks are not addressed by the isolation response).
T1557.001detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which surface LLMNR/NBT-NS/mDNS spoofing and relay activity on Windows local networks.
T1557.001prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, restricting/filtering connections (e.g. firewalls), segregating admin channels, authenticating systems, and isolating subnetworks under attack, all of which can stop LLMNR/NBT-NS/mDNS poisoning and relay on the local network; however these are a minority slice of the named mitigations (most authoritative ones live in 8.5/8.24/5.14) and the control is a broad requirement-setting clause whose actual coverage depends on which of its items the implementer selects.
T1557.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related monitoring/logging items directly act on an in-flight name-resolution-poisoning/relay event to contain its spread once underway, but the bulk of the control's guidance is preventive (hardening, disabling protocols, authentication, filtering) rather than responsive.
T1557.002detects — A.8.20 explicitly requires logging/monitoring (item f, cross-referencing 8.16) of actions affecting network security plus detection/restriction/authentication of device connections (item j) and attack isolation (item m); this surfaces ARP poisoning in flight on monitored segments or via anomalous ARP traffic, but the clause sets scope by organizational requirements rather than mandating universal ARP-specific instrumentation, leaving real gaps on unmonitored segments or silent poisoning.
T1557.002prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which can stop ARP cache poisoning from succeeding on managed segments; it does not reach the full class because ARP remains unauthenticated by design on unmanaged or legacy local segments where the control's implementation choices leave residual exposure.
T1557.002responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once ARP poisoning (and its follow-on effects) is underway; this is only a slice of the full technique surface rather than the bulk.
T1557.003detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which surface rogue DHCP servers, malicious offers, or anomalous DHCP traffic on the monitored network.
T1557.003prevents — A.8.20 explicitly lists network segregation, authentication of systems, restricting/filtering connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, and safeguards for data over networks/wireless, all of which close the majority of rogue-DHCP vectors on the wire; the named remainder is the initial unauthenticated broadcast DISCOVER phase on an already-compromised LAN segment before any of those controls engage.
T1557.003responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once rogue-DHCP spoofing/AiTM is underway; this is only a slice of the full technique (does not address exhaustion variant, rogue server prevention, or post-impact eradication).
T1557.004detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting equipment connections) and m (isolating subnetworks if under attack), which surface evil-twin rogue APs in monitored environments; this is only a slice because the control's scope is set by organizational requirements and does not mandate wireless-specific rogue-AP detection.
T1557.004prevents — A.8.20 explicitly requires safeguards for confidentiality/integrity over wireless networks, restricting/filtering connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, and logical separation in virtualized networks, all of which close major slices of evil twin deception and unauthorized connection; residual remains for physical proximity, signal strength coercion, and unmonitored client-side PNL probes that the control does not universally stop.
T1557.004responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once an evil twin attack is underway; this is only a slice of the full technique (rogue AP setup, probe response, credential capture, sniffing/manipulation) so the verb holds but not mostly.
T1558detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface Kerberos ticket theft or forgery in network traffic or on monitored systems, but the control is scoped by organizational requirements and does not mandate coverage of this specific technique across all platforms or attack vectors.
T1558prevents — A.8.20's network protections (segmentation, firewalls, protocol hardening, disabling vulnerable protocols, authenticating systems, logging/monitoring) can stop ticket theft or forgery from succeeding across network boundaries or via exposed protocols, but do not address local credential dumping, in-memory ticket extraction, or forging on an already-compromised endpoint.
T1558responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once a network-borne attack is underway, which is the core of `responds`; the remainder of the clause (hardening, logging, segregation, protocol disablement) is preventive or detective and does not address an in-flight T1558 event.
T1558.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces golden ticket usage on the network (e.g. anomalous TGS requests or KDC interactions); this is only a slice of the technique because the control is scoped by organizational requirements rather than mandating universal coverage of all possible detection points.
T1558.001prevents — A.8.20's network protections (segmentation, hardening, protocol disabling, authentication of systems, logging/monitoring, isolating subnetworks under attack) can block lateral movement or TGS requests that use a golden ticket over the network, but do not stop KRBTGT hash theft on a DC or the initial forgery itself.
T1558.001responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once a golden-ticket-enabled compromise is underway, but the remainder of the clause (firewalls, logging, hardening, protocol disablement, etc.) is preventive or detective rather than responsive.
T1558.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces silver ticket usage in network traffic or anomalous Kerberos patterns on monitored segments; this is only a slice because the control's scope is set by organizational requirements and does not mandate detection of offline forgery or all stealthy offline TGS uses.
T1558.002prevents — A.8.20 guidance explicitly requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which can stop the network-borne use of a forged silver ticket to reach the target service; this is a genuine but minority slice of the technique (which lives in the authN/authZ layer and begins with hash theft).
T1558.002responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring (f) plus network segmentation (e,i,j) enable containment once a silver ticket is used on the network, but the control is scoped to network-level response and does not address the forged-ticket use itself or post-access actions on the target service.
T1558.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces Kerberoasting network activity or anomalous TGS requests; this is only a slice because the clause sets scope by organisational requirements rather than mandating universal instrumentation of all Kerberos traffic or offline cracking attempts.
T1558.003prevents — A.8.20 requires safeguards for confidentiality/integrity of data over networks (incl. encryption per 8.24), logging/monitoring of actions, hardening of devices, disabling vulnerable protocols, and network segregation; these stop sniffing of TGS tickets or force stronger encryption that removes RC4 etype 23 vulnerability, but the technique can also be executed without sniffing via a valid TGT so only a minority slice is prevented.
T1558.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces AS-REP roasting network traffic or anomalous Kerberos requests; this is a genuine but minority slice because the control is scoped by organizational requirements rather than mandating universal instrumentation of all Kerberos pre-auth or cracking indicators.
T1558.004prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and protecting confidentiality/integrity over networks; these can block discovery, AS-REQ/AS-REP exchange or offline cracking traffic for some but not all instances of the technique (e.g. local domain enumeration via LDAP/PowerShell or already-compromised accounts remain possible).
T1558.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces Kerberos ticket theft from ccache files when it occurs on monitored Linux/macOS systems; partial because scope is set by organizational requirements rather than mandating coverage of all credential-cache access.
T1558.005prevents — A.8.20's network-level protections (segregation, authentication of systems, restricting/filtering connections, hardening devices, disabling vulnerable protocols, and isolating subnetworks) can stop adversaries from reaching ccache files over the network on Linux/macOS, but do not block local collection after initial access or in-memory extraction.
T1559detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface IPC abuse in monitored environments, but the control's network-centric focus (firewalls, network device hardening, virtualized network separation, isolating subnetworks) leaves most local OS-level IPC mechanisms (COM, DDE, pipes, sockets inside a host) outside its primary scope.
T1559.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface COM abuse as anomalous behavior on Windows endpoints or networks, but the control is scoped by organizational requirements and does not mandate specific COM-focused detection.
T1559.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface DDE-based command execution as anomalous behavior on Windows endpoints or networks, but the control is scoped by organizational requirements and does not mandate instrumentation that would reliably catch all DDE usage vectors (e.g., local IPC, Office poisoning, or registry-enabled cases).
T1559.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface XPC abuse on macOS (especially network-related or anomalous privileged IPC); this is limited to a slice because the control is scoped by organizational requirements rather than mandating XPC-specific detection.
T1560detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface anomalous compression/encryption of collected data prior to exfiltration (e.g. via host or network telemetry), but this is scoped by organizational requirements and does not guarantee coverage of the technique itself.
T1560.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface use of archiving utilities (tar/zip/7-Zip/etc.) as anomalous behavior on the network or endpoints; this is scoped by organizational requirements rather than mandating universal coverage of all such utilities or all platforms, leaving a large implementer-chosen slice uncovered.
T1560.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface anomalous use of archival libraries (e.g. via process, API, or network monitoring) in the post-collection/pre-exfil phase; this is a genuine but minority slice because the clause is scoped by organizational requirements rather than mandating detection of this specific technique or all library usage.
T1561detects — A.8.20 explicitly calls for logging/monitoring of actions affecting or relevant to information security (including network attacks that can lead to wiping) plus detection of device connections and network anomalies, which surfaces some T1561 instances (especially worm-like propagation or network-device erase commands) but leaves the bulk of endpoint raw-disk overwrite activity outside its network-centric scope.
T1561prevents — A.8.20's network protections (segmentation, hardening, protocol disabling, device authentication, logging/monitoring, and isolating subnetworks under attack) can stop worm-like propagation that spreads disk-wipe malware across the network, but do not block local direct-write access or CLI erase commands once an adversary is already authenticated on the target host or device.
T1561recovers — A.8.20 explicitly requires controls to maintain the availability of network services and connected computers (item e), plus logging/monitoring (f), hardening (k), temporary isolation of critical subnetworks under attack (m), and secure virtualized/SDN separation; these directly enable post-wipe recovery of availability for the network-wide resources targeted by T1561, with the bounded remainder being non-network data or endpoints outside the managed network fabric.
T1561responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) plus logging/monitoring in f directly enable containment once disk-wipe propagation or network-device erasure is underway; the remainder of the control (hardening, segregation, protocol disable, etc.) is preventive rather than responsive.
T1561.001detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including network attacks that could enable disk-wipe malware propagation), which surfaces the technique when it triggers observable network or device anomalies, but this is only a slice of the full technique (local direct disk access and overwrite on endpoints is outside the network-focused scope).
T1561.001prevents — A.8.20's network protections (segmentation, hardening, protocol disabling, device authentication, logging/monitoring, and isolating subnetworks under attack) can stop worm-like propagation that spreads disk-wipe malware across the network, but do not block local direct-disk-access or single-system execution of the technique itself.
T1561.001recovers — A.8.20's explicit purpose is to protect networks and connected facilities from compromise, with guidance on availability of network services/computers, logging/monitoring, isolating subnetworks under attack, and virtualized network separation; this supports post-wipe recovery of availability for unaffected or isolated network resources but does not address restoring wiped disk content itself.
T1561.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once destructive wiping is underway, but the clause's other items are preventive, detective or architectural and do not address an in-progress wipe.
T1561.002detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including network attacks that could enable disk-structure wipes), but this is scoped by organizational requirements and does not guarantee detection of the post-compromise technique itself on endpoints or network devices.
T1561.002recovers — A.8.20 explicitly requires maintaining availability of network services and connected computers (including via backup/recovery controls referenced in its own guidance), which restores state after disk-structure wipe has rendered systems unbootable.
T1561.002responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (drawbridges) when the network is under attack, which is a containment action once a destructive technique like disk-structure wipe is underway; the remainder (most of the technique's execution on endpoints, propagation, and post-wipe recovery) is outside this control's scope.
T1563detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, and items i/j/m/n plus network diagrams and virtualized network separation provide observable signals (e.g. anomalous connections, protocol use, isolation events) that can surface session hijacking in flight; this is limited to a slice because the clause sets scope by organizational requirements rather than mandating universal depth or coverage of all hijack vectors (e.g. in-memory RDP/SSH manipulation with no network artifact).
T1563prevents — A.8.20 requires network-level protections (firewalls, protocol hardening/disabling, authentication of systems/devices, segregation, logging/monitoring, and isolation under attack) that stop many session-hijacking vectors on remote services, but leaves open session-level weaknesses such as weak SSH/RDP session tokens, lack of encryption on the wire, or hijacking after initial authenticated access.
T1563responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once hijacking is underway, but the clause's other items are preventive or detective and the remainder (hijacks completed inside an already-authenticated session without triggering network segmentation) is substantial
T1563.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to information security (including network activity), which can surface SSH session hijacking indicators such as anomalous agent/socket access or lateral movement from a compromised host, but only where those fall inside the scoped monitoring rather than all possible cases.
T1563.001prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack, all of which can stop SSH agent/socket compromise vectors on the network; this is a genuine but minority slice of the technique (root-level agent hijacking on an already-compromised Linux/macOS host remains reachable).
T1563.001responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once lateral movement via an active SSH session is detected/underway, but the bulk of the clause is about static network hardening, authentication, logging, and prevention rather than active response to an in-progress hijack.
T1563.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface RDP hijacking in flight (especially via anomalous network or session behavior), but the clause's scope is set by organizational requirements rather than mandating comprehensive RDP-specific instrumentation, leaving a large slice of stealthy or local hijacks undetected.
T1563.002prevents — A.8.20 requires network-level protections (segmentation, firewalls, protocol hardening, disabling vulnerable protocols, authenticating systems, logging/monitoring, and isolating subnetworks under attack) that can block many vectors for RDP session hijacking over the network, but leaves local hijacking with System privileges (tscon.exe) and several configuration/credential-management slices untouched.
T1563.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once RDP hijacking is underway, but the clause's other items are preventive or detective and the remainder (local hijacks, non-network-impacting sessions) is not bounded by the control's network focus.
T1564detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces some hiding behaviors (e.g. anomalous network activity, unauthorized device connections, or virtualization anomalies), but leaves the bulk of T1564's OS-level and isolated-region hiding techniques outside its network-centric scope.
T1564.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces hidden file system activity on monitored networks or devices; this is only a slice because the control is scoped to network-level activity and does not mandate host-level detection of abstracted file systems or non-standard disk structures.
T1564.006detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection/restriction of device connections (items j, m) and hardening (k), which surfaces some virtual-instance behaviors on monitored networks or via anomalous traffic/shadow VMs, but leaves the core evasion (in-guest artifacts invisible to host tools) and non-networked instances untouched.
T1564.006prevents — A.8.20 explicitly requires hardening network devices, restricting/filtering connections (e.g. firewalls), detecting/restricting/authenticating equipment and device connections to the network, segregating admin channels, disabling vulnerable protocols, and applying controls to virtualized/SDN networks including logical separation; this directly stops many (but not all) of the native, dropped-binary, temporary-sandbox, rogue-VM, and bridged-networking vectors named in the T1564.006 prose.
T1564.006responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment response once a virtualization-based evasion technique is detected and underway.
T1564.008detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces the creation or modification of email hiding rules (especially via PowerShell or admin transport rules) as anomalous activity; this is a genuine but minority slice of the technique because the control is scoped by organizational requirements rather than mandating detection of every rule change or hidden email across all clients and platforms.
T1564.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface the anomalous use of nohup, SilentlyContinue or similar interrupt-ignoring commands when they occur inside monitored scope; the remainder is that the control's scope is set by organizational requirements rather than mandating universal process-signal instrumentation, so many invocations stay unseen.
T1564.013detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface anomalous bind-mount activity (e.g. via host telemetry on mount events or process anomalies), but the clause's scope is set by organizational requirements and does not mandate coverage of this specific Linux filesystem hiding technique.
T1564.014detects — A.8.20.f explicitly requires logging and monitoring to detect actions relevant to information security, which can surface xattr abuse when monitoring scope includes file metadata, process execution, or anomalous loader behavior; however the control is scoped by organizational requirements and does not mandate inspection of extended attributes, leaving many implementations without coverage of this specific hiding technique.
T1565detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces data manipulation once it occurs on or via the network; this is a genuine but minority slice of the broad technique (most T1565 occurs inside applications, files, or non-networked processes).
T1565prevents — A.8.20's network protections (segregation, filtering/firewalls, protocol hardening, authentication of systems/devices, logging/monitoring, isolation under attack) can stop many network-borne data manipulation techniques from reaching the target data or process, but do not address local or application-layer manipulation after access is obtained.
T1565responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) directly enacts containment once manipulation is underway, but the clause's dominant focus is on preventive network hardening, segmentation, logging, and access controls rather than active incident response to an in-progress data-manipulation event.
T1565.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which would surface stored data manipulation once it occurs; the remainder (e.g. stealthy offline tampering of non-networked or unmonitored stores) is outside the network-centric scope of the control.
T1565.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting or relevant to network information security (item f, cross-referencing 8.16), which surfaces adversary manipulation of data in transit over networks (the technique's primary vector).
T1565.002prevents — A.8.20 explicitly requires controls to safeguard the confidentiality and integrity of data passing over networks (including encryption, segregation, filtering, hardening, protocol disabling, and isolation under attack), which directly stops transmitted-data manipulation from succeeding on the network paths that are the technique's primary vector.
T1565.002responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once transmitted-data manipulation is detected and underway, which is the core of `responds`; the remainder of the clause is preventive or detective and does not act on an in-flight event.
T1565.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface runtime data manipulation once it occurs (especially via network activity or anomalous system changes), but this is scoped only to what the organization defines as relevant and does not broadly instrument the technique across all platforms or binaries.
T1566detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces phishing delivery and related anomalous network behavior; this is limited to a slice because the control is scoped to network-level observables and does not address non-network vectors such as social media, phone calls, or purely endpoint/user-execution phishing.
T1566prevents — A.8.20 requires network-level safeguards (firewalls, protocol hardening, authentication of systems/devices, segregation, monitoring, isolation under attack) that can block delivery or execution vectors once a phish reaches the network (e.g. malicious links, attachments, spoofed traffic), but the core social-engineering delivery and user click/execution live outside the network and are untouched by these controls.
T1566.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces spearphishing attachment delivery and anomalous email behavior on monitored networks; this is a genuine but minority slice because the control's dominant focus is network infrastructure protection rather than email content inspection or user-targeted social engineering.
T1566.002detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which can surface spearphishing link delivery or anomalous follow-on behavior such as unusual URL clicks or OAuth consent flows; this is limited to a slice because the control is scoped to network-level actions and does not mandate detection of the social-engineering email content or link obfuscation itself.
T1566.002prevents — A.8.20's network-focused controls (firewalls, filtering/restricting connections, authenticating systems/devices, hardening, disabling vulnerable protocols, segregating channels, isolating subnetworks, logging/monitoring, and virtualized separation) can block delivery, C2, or exploitation steps that follow a clicked spearphishing link, but do not stop the social-engineering email itself or the user from clicking it.
T1566.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface anomalous third-party service messages or related behaviors (e.g., via 8.16 cross-reference), but the control is scoped to network/facility protection and does not mandate detection of social-engineering content or rapport-building on external services.
T1566.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface vishing-driven anomalous user behavior or follow-on access (e.g. via 8.16 cross-reference), but the control is scoped to network/facility protection and does not address voice-channel social engineering itself
T1567detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces exfiltration over web services when it occurs within monitored network scope; extent is partial because the control sets scope by requirements rather than mandating universal depth or coverage of all exfiltration channels (see A.8.16 event-lane anchor).
T1567prevents — A.8.20 explicitly requires restricting/filtering network connections (firewalls), segregating admin channels, hardening devices, disabling vulnerable protocols, and protecting confidentiality/integrity over public/third-party/wireless links, which directly blocks many common exfiltration paths over web services; however, it does not reach the dominant case of already-permitted legitimate web services (the technique's core cover and the reason firewall rules often already allow it).
T1567responds — A.8.20 item m (temporarily isolating critical subnetworks when the network is under attack) and the overall network monitoring/logging in f directly address containment once exfiltration-over-web-service is underway, but most of the clause is about static hardening, prevention and detection rather than active response to an in-progress event.
T1567.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous outbound HTTPS/API traffic to code repositories (especially from unexpected hosts), but the control's scope is set by organizational requirements and does not mandate detection of every possible exfiltration vector or cover all network layers uniformly.
T1567.001prevents — A.8.20 requires network-level safeguards (firewalls, protocol disabling, segregation, monitoring, authentication of systems/devices, and isolation under attack) that can block many outbound exfiltration paths to external code-repo APIs, but leaves a bounded remainder where the traffic is permitted (e.g. legitimate developer use of GitHub from managed hosts) or uses already-allowed HTTPS channels that the control does not universally prohibit.
T1567.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous exfiltration to cloud storage (especially if it deviates from baseline network traffic or approved services), but the control's scope is network-oriented and does not mandate detection of the specific technique or data content.
T1567.002prevents — A.8.20 requires network-level safeguards (firewalls, filtering, segregation, protocol hardening, monitoring, and isolating subnetworks under attack) that can block many outbound exfiltration paths to cloud storage, but leaves open legitimate/approved cloud-service channels that adversaries can abuse for cover, plus it does not reach the data-originating application or endpoint logic itself.
T1567.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface exfiltration to text storage sites when it matches monitored patterns or anomalies; this is only a slice because the clause leaves scope, depth, and specific detection rules to the implementer (see A.8.16 cross-reference and virtual-network guidance).
T1567.003prevents — A.8.20 requires safeguards for data confidentiality/integrity over public/third-party/wireless networks (item e), logging/monitoring of relevant actions (f), restricting/filtering of network connections (i), and disabling vulnerable protocols (n); these can stop many exfil paths to pastebin-like sites but leave open slices such as encrypted HTTPS posts from already-authorized endpoints or insider use of allowed developer tools.
T1567.004detects — A.8.20 item f explicitly requires logging and monitoring of network actions relevant to information security (cross-referenced to 8.16), which can surface webhook exfiltration when it produces observable anomalous outbound HTTPS traffic to SaaS endpoints; this is only a slice because the control is scoped to network-level monitoring that the adversary can blend into normal traffic, and does not guarantee detection of the webhook linkage or manual post itself.
T1567.004prevents — A.8.20 requires network-level safeguards (firewalls, protocol disabling, segmentation, monitoring, authentication of systems/devices) that can block many webhook exfiltration paths over public/third-party networks, but leaves open adversary-controlled SaaS webhooks that blend with legitimate HTTPS traffic from approved services.
T1567.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and the overall purpose of protecting networks from compromise directly enable containment once webhook exfiltration is detected in flight, but this is only one narrow slice of full incident response (no eradication, no actor removal, no coordination with IR processes).
T1568detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as restricting/filtering connections, detecting device attachments, and isolating subnetworks under attack, which can surface dynamic C2 resolution on observable network parameters; this is a genuine but minority slice because the technique's core (algorithmic generation of domains/IPs/ports) can occur outside monitored boundaries or via encrypted/obfuscated channels the control does not mandate instrumentation for.
T1568prevents — A.8.20 requires network-level safeguards (firewalls, protocol disabling, segmentation, monitoring, device authentication/hardening) that can block many dynamic C2 resolution patterns (e.g. suspicious domains/ports, vulnerable protocols, unauthorized connections), but leaves residual coverage gaps for algorithmically-generated or encrypted resolutions that do not obviously violate the configured rules.
T1568responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once dynamic resolution C2 is detected and underway, which is the core of `responds`; the remainder of the clause is preventive or detective and does not address an in-flight technique.
T1568.001detects — A.8.20.f explicitly requires logging and monitoring to detect actions relevant to information security, and network monitoring can surface anomalous DNS behaviors (rapid IP flux, short TTLs, round-robin patterns) associated with this C2 technique; however the control is scoped by organizational requirements rather than mandating DNS-specific flux detection, leaving most implementations as a chosen slice.
T1568.001prevents — A.8.20 requires network-level protections including restricting/filtering connections (firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, segregating admin channels, and isolating subnetworks under attack; these can block many single-flux resolutions or C2 connections at the network boundary or via protocol restrictions, but do not stop domain registration, rapid DNS updates, or double-flux proxying that operates upstream of the defended network.
T1568.001responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related monitoring/logging items act on an in-progress C2 channel once detected, containing its spread; this is a genuine but minority slice of the overall technique (most flux handling lives in detection or prevention).
T1568.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and network monitoring can surface anomalous DNS queries or C2 patterns produced by DGA use; this is limited to a slice because the control's scope is set by organizational requirements rather than mandating universal deep packet inspection or DGA-specific heuristics, leaving many implementations without coverage for this technique.
T1568.003detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous DNS responses and derived C2 port/IP calculations when network telemetry is in scope; partial because the control sets requirements rather than mandating universal depth or coverage of all calculation variants across every network segment.
T1568.003prevents — A.8.20's network protections (egress filtering via firewalls in i, protocol disabling in n, segregation/hardening in e/l/k, and monitoring in f) can stop the calculated C2 port from being reachable or used, but the core technique of performing the DNS-based calculation itself is untouched and many dynamic ports remain open by design.
T1569detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces abuse of system services/daemons when it produces observable network, device or anomalous behavior within the scoped monitoring; this is a genuine but minority slice of the technique (most local service abuse on endpoints is outside network-focused detection).
T1569prevents — A.8.20's network-level hardening, protocol disabling, segmentation, authentication of systems/devices, logging/monitoring, and isolation under attack can stop many remote-abuse vectors for creating/executing malicious services (especially on Windows/Linux where services often involve network-exposed management), but leaves local abuse, boot-time persistence, and non-networked daemon abuse untouched.
T1569.001detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface launchctl abuse on macOS networks when it is within the monitored scope (e.g. anomalous process or network activity), but the clause sets scope by requirements rather than mandating universal coverage of this macOS-specific technique.
T1569.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface service-control-manager abuse (especially remote or anomalous service execution); this is a genuine but minority slice because the clause's scope is set by organizational requirements rather than mandating host-level service telemetry, leaving most local/abuse-in-process cases outside the named coverage.
T1569.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface systemctl abuse when it produces observable network, process, or service anomalies within the monitored scope; the remainder is that the clause sets scope by requirements rather than mandating host-level detection of every systemctl invocation.
T1570detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus network separation, authentication, connection filtering/firewalls, device connection detection, and protocol hardening, all of which surface lateral file-transfer activity over SMB/RDP/scp/etc. on the monitored estate; the bounded remainder is transfers that use already-allowed paths with no anomalous signature.
T1570prevents — A.8.20 requires network segmentation, hardening, protocol disabling, connection filtering (firewalls), authentication of systems/devices, and monitoring, which can block many common lateral file-transfer vectors (SMB shares, RDP, insecure protocols, unauthorized device connections); it leaves open vectors that use already-permitted authenticated channels, allowed tools (scp/curl), or web services inside the authorized network perimeter.
T1570responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once lateral tool transfer is underway on the network; the remainder of the clause (firewalls, logging, hardening, protocol disabling) is preventive or detective rather than responsive to an in-flight event.
T1571detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, and items i/j/k/n require network filtering, device authentication, hardening and protocol disabling that surface anomalous non-standard port usage when implemented; however the clause sets requirements rather than mandating universal instrumentation depth, so only a slice chosen by the implementer is guaranteed to be detected.
T1571prevents — A.8.20 explicitly lists restricting/filtering systems connections (e.g. firewalls), restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, segregating admin channels, and protecting data over networks/wireless — all of which can block non-standard port usage intended to bypass filtering or muddle parsing, but leaves open non-firewalled custom ports, protocol changes on victim systems, and non-network vectors.
T1571responds — A.8.20 item m (temporarily isolating critical subnetworks if the network is under attack) and related logging/monitoring/hardening items enable containment actions once non-standard port C2 is detected in flight, but most of the technique's stealth and bypass aspects are already realized before response begins.
T1572detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which surface tunneling that deviates from expected traffic, blends with allowed protocols, or uses unauthorized encapsulation.
T1572prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, segregating admin channels, logging/monitoring, and safeguards for data over public/wireless networks, all of which can stop many tunneling vectors (SSH, DoH, etc.) from being established or from bypassing filters; it does not address all encapsulation methods or post-compromise tunneling from an already foothold-equipped endpoint, leaving a genuine minority slice unaddressed.
T1572responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once tunneling is detected and underway, which is the core of `responds`; the remainder of the clause is preventive or detective and does not address an in-flight tunneling event.
T1573detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces encrypted C2 channels when they deviate from baseline network behavior; this is limited to a chosen monitoring scope rather than a bounded remainder of the technique itself.
T1573prevents — A.8.20 requires safeguards for confidentiality/integrity of data over networks (incl. encryption per cross-references, hardening, protocol disabling, segmentation, and monitoring), which can stop weak or reverse-engineerable C2 encryption from succeeding on protected segments, but leaves adversary-controlled endpoints, custom malware keying, and non-network vectors untouched.
T1573.001detects — A.8.20.f explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface use of symmetric crypto for C2 (especially anomalous patterns or known weak algorithms on monitored networks), but this is scoped by what the organization chooses to monitor rather than mandating detection of the technique itself
T1573.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface C2 traffic using asymmetric crypto (especially on monitored networks or devices), but this is scoped by organizational requirements and does not guarantee detection of all such traffic (e.g. fully encrypted, non-anomalous, or on unmonitored segments).
T1574detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces some hijack execution flow techniques (e.g. anomalous process or network behavior) when they fall inside the chosen monitoring scope, but the clause sets that scope by organizational requirements rather than mandating coverage of all execution-flow hijacks.
T1574prevents — A.8.20's network-level hardening, segregation, protocol disabling, authentication of systems, connection filtering (firewalls), and isolation under attack can stop several hijack vectors that rely on network discovery, lateral movement, or poisoned network-sourced resources, but leaves the dominant local OS mechanisms (DLL search order, registry poisoning, PATH hijacking, etc.) untouched.
T1574.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface network-borne DLL abuse (e.g. remote hijacking or lateral movement), but the control is scoped to networks and does not address host/process-level detection of most sideloading/search-order/phantom/substitution cases.
T1574.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface dylib hijacking as anomalous process behavior or network activity on monitored macOS endpoints, but the control's network-centric scope and implementation-dependent breadth leave many local hijack cases (especially those without observable network effects) unreached.
T1574.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface installer hijacking or anomalous writes to TEMP/installer directories when those fall inside the monitored scope; however the clause sets scope by organizational requirements rather than mandating coverage of this specific technique, leaving a large slice of Windows installer behavior outside typical network-centric monitoring.
T1574.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous environment-variable or library-loading behavior on networks and systems; this is a genuine but minority slice of the technique (network-visible effects or post-hijack anomalies) rather than the in-process hijack itself.
T1574.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface PATH hijacking when it manifests as anomalous process execution or network activity, but the control is scoped to network-level monitoring rather than host-level environment variable or binary search path anomalies.
T1574.008detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface search-order hijacking artifacts (e.g. anomalous process execution or file placement in program directories) when those fall inside the chosen monitoring scope; the remainder is the slice of implementations whose scope excludes host/process telemetry for this technique.
T1574.009detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces path-interception attempts or anomalies on Windows networks; this is a genuine but minority slice because the control is scoped to network-level actions rather than the dominant local filesystem/registry hijacking mechanics of the technique.
T1574.010detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface anomalous service binary replacement or related privilege-escalation indicators on Windows networks; this is only a slice because the control is scoped to network-level actions and does not mandate host/process-level detection of the file-permission hijack itself.
T1574.011detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces Registry permission abuse and service hijacking attempts on Windows networks when those actions fall inside the monitored scope.
T1574.012detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous .NET CLR profiler loading or registry changes on Windows networks; this is a genuine but minority slice of the technique's possible in-memory, per-process, or non-networked executions.
T1574.013detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface anomalous process behavior or memory tampering involved in KernelCallbackTable hijacking on monitored Windows systems, but the control is scoped to network-level actions, responsibilities, and virtualized network separation rather than host/process memory or GUI callback monitoring.
T1578detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces modifications to cloud compute infrastructure (e.g. instance/snapshot changes) when those fall inside the defined monitoring scope; the remainder is unbounded because scope is set by the organization rather than mandated for this technique.
T1578.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces snapshot creation (a privileged IaaS action) when it falls inside the monitored scope; partial because the clause sets scope by organizational requirements rather than mandating universal coverage of all cloud snapshot events.
T1578.002detects — A.8.20 item f explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces creation of a new cloud instance/VM as anomalous network or compute activity; this is only a slice because the clause is scoped by organizational requirements rather than mandating universal cloud-instance telemetry.
T1578.002prevents — A.8.20 requires network-level controls (firewalls, connection filtering, device authentication, protocol hardening, segregation, and virtualized network logical separation) that can block unauthorized cloud instance creation or its network bypass effects in IaaS environments, but leaves open slices such as IAM-driven creation, non-networked instances, and policy application after creation.
T1578.003detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including via 8.16 cross-reference), which surfaces the deletion of a cloud instance as an anomalous or suspicious event on IaaS networks; this is only a slice of the full technique because the control is scoped to network-level actions rather than all instance lifecycle events or non-network forensics.
T1578.003responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) plus logging/monitoring (f) and network segmentation allow containment of a cloud-instance deletion event once underway in IaaS environments, but most of the listed controls target prevention or general network hygiene rather than active response to this specific evasion technique.
T1578.004detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces reversion of a cloud instance (or use of ephemeral storage reset) as an anomalous event in a virtualized network; the remainder is that the control's scope is set by organizational requirements and does not mandate instrumentation of every cloud API or snapshot action.
T1578.004responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related logging/monitoring/hardening guidance enable containment response once reversion is detected in a virtualized/cloud network, but the control is scoped to network-level isolation rather than full incident response, cloud API snapshot reversion, or evidence removal on IaaS instances.
T1578.005detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces quota/policy/region modifications in cloud networks as anomalous activity; this is a genuine but minority slice because the clause is scoped to network-level actions rather than all tenant-wide compute configuration changes and the bulk of the technique lives in IAM/policy layers outside network monitoring.
T1580detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including network activity and device connections), which can surface anomalous API calls or enumeration of IaaS resources, but only where those actions fall inside the chosen monitoring scope rather than guaranteeing detection of every discovery attempt.
T1580prevents — A.8.20's network-level controls (firewalls, segregation, authentication of systems/devices, protocol hardening, monitoring, and isolation under attack) can block some discovery paths that rely on network traversal, exposed services, or unauthenticated scanning, but the technique's core (authenticated API/CLI calls using valid access keys against IaaS resources) is outside network-boundary enforcement and remains reachable.
T1584detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which can surface adversary compromise of network devices/infrastructure, but this is scoped only to the defender's own networks rather than broadly detecting third-party/pre-compromised infrastructure used by adversaries.
T1584prevents — A.8.20 requires network protections (firewalls, segregation, hardening, protocol disabling, device authentication, monitoring, and virtualized separation) that stop many forms of infrastructure compromise on an organization's own networks, but leaves the adversary's independent compromise of arbitrary third-party infrastructure (domains, cloud servers, botnets, other adversaries' assets) untouched.
T1584.002detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which can surface anomalous DNS behavior or record changes on monitored networks; this is only a slice because the control is scoped to the organization's own networks/facilities and does not inherently monitor or detect compromise of arbitrary third-party DNS servers.
T1584.002prevents — A.8.20 requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and protecting against unauthorized network access; these directly raise the bar for an adversary to compromise a third-party DNS server or alter its records, but only for networks and devices the organization itself operates or can enforce policy on — the technique's core (compromising arbitrary external/third-party DNS infrastructure) sits outside that boundary.
T1584.004detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which can surface adversary compromise of third-party servers used for C2/watering-hole/phishing but only for those whose network behavior or connection falls inside the monitored scope.
T1584.005detects — A.8.20 explicitly requires logging/monitoring (item f, cross-referencing 8.16) plus detection of device connections (item j) and attack indicators (item m) that can surface botnet C2, scanning or DDoS behaviors on or from the network; this is genuine but only a slice because the control is scoped to the organization's own networks/facilities and does not reach adversary-owned botnet infrastructure or pre-compromise reconnaissance on third-party systems.
T1584.005prevents — A.8.20's network protections (firewalls, segregation, hardening, protocol disabling, monitoring, isolation under attack) stop many third-party compromises that build or expand a botnet, but leave open vectors such as client-side exploits, supply-chain compromise, or non-network initial access that the control does not address.
T1584.005responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once a botnet-driven event such as DDoS is underway; the remainder of the clause is preventive or detective and does not address an in-progress botnet technique.
T1584.007detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces anomalous or unauthorized use of serverless runtimes once they are compromised and generating traffic or responding to machines.
T1584.007prevents — A.8.20 requires network-level protections (firewalls, authentication of systems/devices, protocol hardening, segregation, logging/monitoring, and isolation under attack) that can block unauthorized serverless runtime compromise or its use for proxying/hiding C2 when the function executes over or connects to the protected network; this is only a slice of the pre-compromise supply-chain, account takeover, and misconfiguration vectors named in the technique.
T1584.008detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which surface adversary compromise or use of third-party network devices; this is a genuine but minority slice of the technique's full scope (e.g., credential harvesting or post-compromise C2 use may evade network-level detection).
T1584.008prevents — A.8.20 directly names hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, and isolating subnetworks under attack — all of which stop adversaries from gaining control of third-party/edge network devices used for follow-on operations.
T1586.003prevents — A.8.20's network-focused controls (firewalls, segregation, hardening, protocol disabling, authentication of systems/devices, logging/monitoring, and virtualized network isolation) can block some post-compromise or lateral uses of cloud accounts over networks, but do not stop the pre-attack compromise methods (phishing, password spraying, token theft, reconnaissance) that occur outside the defended networks.
T1590detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces network-gathering activity (especially active scanning or anomalous queries) once it occurs; this is bounded by the clause's scope-setting language and cross-references, leaving passive/open-source collection (T1596) and pre-compromise actions on non-monitored surfaces as a large uncovered slice.
T1590prevents — A.8.20 mandates network segmentation, hardening, protocol disabling, logging/monitoring, authentication of systems/devices, and isolation under attack, which directly blocks or raises the cost of many active/passive gathering methods (scanning, exposed topology via open services, wireless leakage) on the victim network itself; it does not address external OSINT, public WHOIS/DNS, or phishing that occur before any network interaction.
T1590.002prevents — A.8.20 requires safeguards for confidentiality/integrity of data over public/third-party/wireless networks, hardening devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, and isolating subnetworks under attack, which can block some active DNS queries, zone transfers from misconfigured servers, and passive exposure vectors; however, it does not address public registration data, open datasets, or passive DNS collection that require no direct network interaction with the victim.
T1590.004detects — A.8.20 explicitly requires logging/monitoring (item f, cross-referencing 8.16) of actions affecting network security, which can surface topology-gathering activity such as active scanning; this is limited to a slice because the control's scope is set by organizational requirements rather than mandating detection of all topology reconnaissance vectors (e.g., passive public data exposure).
T1590.004prevents — A.8.20 requires network segregation, hardening, protocol disabling, authentication of systems, connection filtering (firewalls), logging/monitoring, and temporary isolation under attack, all of which constrain an adversary's ability to gather accurate topology via scanning or exposed data; it does not stop all collection vectors such as phishing for information or public data sets.
T1590.006detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces reconnaissance against network security appliances (especially via active scanning or exposed data); this is a genuine but minority slice of the pre-attack technique, as most of the control addresses protective network design rather than detection of pre-compromise information gathering.
T1592.002detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces reconnaissance activity such as active scanning or exposed host-software details on the network; this is bounded by the control's network-centric scope and does not address non-network vectors like phishing, metadata in public files, or pre-compromise open-source data.
T1595detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack; n: disabling vulnerable protocols), which surface active scanning probes on the monitored infrastructure; the bounded remainder is scans that fall outside the defined monitoring scope or use protocols not covered by the hardening/filtering.
T1595prevents — A.8.20 explicitly requires restricting/filtering network connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, and segregating/isolating networks under attack, which stops many forms of active scanning from reaching or succeeding against victim infrastructure; it does not cover all scanning variants (e.g. external ICMP or protocol-native probes before any perimeter is engaged).
T1595responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once active scanning (the technique) is already underway; this is only a slice of the full technique surface (other sub-techniques and pre-attack scanning remain unaddressed).
T1595.001detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j, m) that surface scanning of IP blocks or anomalous connection attempts on the organization's networks.
T1595.001prevents — A.8.20 explicitly requires restricting/filtering network connections (firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, and segregating/isolating networks, which directly blocks many forms of external IP-block scanning before it can gather information.
T1595.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes network-based vulnerability scanning as a reconnaissance action; however, the control is scoped to network-level monitoring rather than all possible pre-attack scanning vectors (e.g., external non-network methods).
T1595.002prevents — A.8.20 requires hardening network devices, disabling vulnerable protocols, restricting/filtering connections (e.g. firewalls), segregating admin channels, and isolating subnetworks under attack, which stops many network-based vulnerability scans from reaching or succeeding against internal assets; it does not address scans of public-facing internet-exposed services or pre-compromise external reconnaissance.
T1595.003detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces wordlist-driven probing of web directories, cloud buckets, or other infrastructure as anomalous network or application behavior; this is only a slice because the clause leaves scope and depth to the implementer (see A.8.16 cross-reference) and does not guarantee detection of all PRE reconnaissance variants.
T1595.003prevents — A.8.20 requires network-level protections (firewalls, connection filtering/restriction, protocol disabling, device authentication, logging/monitoring, and isolation under attack) that stop many wordlist-driven discovery probes from reaching targets or succeeding, but leaves open web/app-layer crawling, custom/targeted wordlists, and pre-network reconnaissance that the control does not address.
T1598detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces phishing-for-information attempts delivered over monitored networks or email channels, but the control's network-centric focus leaves non-network vectors (phone, social media) and pre-delivery evasion outside its scope.
T1598.002detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces spearphishing attempts delivered over the network; this is a genuine but minority slice because the control is scoped to network-level observables and does not address the social-engineering or pre-delivery crafting of the lure itself.
T1598.003detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces spearphishing link delivery and related network activity such as connections to malicious domains or tracking pixels; this is limited to a slice because the control is scoped to network-level observables and does not address the social-engineering lure, email content, or non-network delivery vectors such as QR codes.
T1599detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which surface boundary-bridging activity on network devices; this is only a slice of the full technique because the clause is scoped to organizational network assets and does not mandate detection of all post-compromise reconfigurations or lateral movement across organizational boundaries.
T1599prevents — A.8.20 directly prescribes hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, maintaining configs, and isolating subnetworks under attack — all of which stop adversaries from gaining the control needed to reconfigure perimeter or segmentation devices and thereby bridge boundaries.
T1599responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once boundary bridging is underway; this is only a slice of the full technique (reconfiguration of compromised routers/firewalls, internal segmentation devices, or lateral movement into new orgs).
T1599.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks if under attack), which can surface anomalous NAT modifications on boundary devices, but this is only a slice of the technique's full scope (e.g., post-compromise config changes or custom NAT via OS patching remain outside routine network monitoring).
T1599.001prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, and isolating subnetworks under attack — all of which close off the boundary-device compromise and configuration-modification paths that enable T1599.001; the remainder is that the control does not stop an already-compromised device from being further abused for NAT changes.
T1599.001responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once boundary-bridging via NAT modification is underway; this is only a slice of the full technique (does not address all NAT changes, obscuring, or custom mechanisms).
T1600detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) plus detection of device connections (item j) and attack isolation (item m), which can surface T1600 behaviors on network devices; partial because the clause sets scope by organizational requirements rather than mandating instrumentation that guarantees discovery of all encryption-weakening manipulations (e.g. firmware changes on isolated devices).
T1600prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, authenticating systems, restricting/filtering connections, segregating admin channels, and using cryptography (via 8.24) to safeguard confidentiality/integrity of data over networks, which directly counters weakening or bypassing device encryption on network traffic; however, it is only a partial slice because the control is scoped to network-level protections and does not address all sub-techniques like firmware modification or key-space reduction on the device itself.
T1600.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) and detecting device connections (item j), which can surface anomalous configuration changes or weakened crypto parameters on network devices; this is only a slice of the full technique because the control does not mandate detection of the specific key-space reduction itself.
T1600.001prevents — A.8.20 explicitly requires hardening network devices, disabling vulnerable protocols, safeguarding confidentiality/integrity of data over networks (incl. via 8.24 cryptography), and restricting/filtering connections, which directly stops an adversary from weakening ciphers or key sizes on network devices before or during T1600.001; partial because the control is governance-oriented (consider/implement) rather than a universal mechanism, with residual risk on already-compromised devices or incomplete implementation.
T1600.002detects — A.8.20 explicitly requires logging/monitoring (item f, cross-referencing 8.16) of actions affecting network security plus detection of unauthorized device connections (item j), which would surface the anomalous disable-hardware action or its prerequisites on managed network devices; this is only a slice of the full technique because the control is scoped to organizational networks and does not mandate detection inside every possible compromised device or post-disable software-encryption phase.
T1600.002prevents — A.8.20 explicitly lists hardening of network devices, disabling vulnerable network protocols, authenticating systems, restricting/filtering connections, segregating admin channels, and protecting confidentiality/integrity of data over networks, which directly counters the device takeover and hardware-disable steps required for T1600.002; it is only partial because the control is a list of considerations rather than a mandatory mechanism that guarantees prevention on every device.
T1601detects — A.8.20 explicitly requires logging/monitoring (item f, cross-referencing 8.16) of actions affecting network security plus detection/restriction/authentication of device connections (items j, m), which surfaces anomalous OS-image changes on network devices in a subset of cases but leaves real gaps for in-memory modifications, unmonitored embedded platforms, and non-device-layer changes.
T1601prevents — A.8.20's hardening, protocol disabling, authentication, connection filtering, logging/monitoring, and virtualized network segregation directly stop many live or boot-time modifications to monolithic network device OS images by limiting access vectors, vulnerable entry points, and unauthorized changes.
T1601.001detects — A.8.20 explicitly requires logging/monitoring of actions affecting network information security (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which can surface anomalous patching activity on network devices; this is only a slice of the full technique surface (in-memory/bootloader methods, storage overwrites via TFTP/console, false command output) rather than a bounded remainder.
T1601.001prevents — A.8.20 explicitly lists hardening network devices, restricting/filtering connections (e.g. firewalls), disabling vulnerable protocols, authenticating systems, segregating admin channels, and isolating subnetworks under attack, which directly blocks the standard operator procedures, debug commands, protocol use (TFTP/FTP/SCP), and unauthenticated changes needed to patch a network device's OS image in storage or memory.
T1601.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f) plus detection of equipment connections and vulnerable protocols (items j,n), which can surface a downgrade on managed network devices; it does not guarantee detection on every embedded device or every downgrade method, leaving a genuine slice unreached.
T1601.002prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, authenticating/restricting device connections, segregating admin channels, and isolating subnetworks under attack — all of which directly stop an adversary from successfully installing a downgrade on a live network device; the remainder is pre-positioned or supply-chain delivery of the older image before those controls engage.
T1602detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which would surface adversary access to configuration repositories on the network; this is only a slice of the full technique (e.g., it depends on scope, does not inherently cover all exposure protocols or post-collection exfil, and virtualized/SDN aspects are not monitoring-specific).
T1602prevents — A.8.20's network protections (firewalls, segregation, protocol disabling, device authentication, hardening, monitoring, and virtualized separation) stop many repository-access vectors on the network, but leave open slices such as already-authenticated management channels, misconfigured internal repositories, and non-network exposure methods.
T1602.001detects — A.8.20 explicitly requires logging and monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections), m (isolating subnetworks under attack), and n (disabling vulnerable protocols); these surface SNMP MIB queries on managed network devices, with the bounded remainder being stealthy or non-network-visible queries outside the monitored scope.
T1602.001prevents — A.8.20 explicitly lists hardening network devices, disabling vulnerable protocols, restricting/filtering connections (e.g. firewalls), segregating admin channels, authenticating systems, and logging/monitoring network actions, all of which can block unauthenticated or unnecessary SNMP queries that expose the MIB; this is only a slice because SNMP remains a required management service on many devices and the control sets requirements rather than mandating universal SNMP-specific blocks such as community-string enforcement or ACLs on every OID.
T1602.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16), hardening (k), protocol disabling (n), and isolating under attack (m), all of which surface the SNMP/SMI queries or config-export actions described in T1602.002.
T1602.002prevents — A.8.20 directly lists hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, authenticating systems, logging/monitoring, and protecting confidentiality/integrity over networks, which stops most paths (SNMP/SMI queries, unauthorized config access) to dumping the configuration file.
T1606detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces forged web credential usage on monitored networks; this is only a slice because the control is scoped to network-level actions and does not mandate detection of the credential forging itself or non-network aspects of the technique.
T1606.001detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces anomalous or forged-cookie authentication events on monitored networks and services; this is only a slice because the control's scope is set by what the organization chooses to log/monitor rather than mandating detection of cookie forgery itself.
T1606.002detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces anomalous SAML token issuance or federation activity on the network; this is a genuine but minority slice of the technique, which is primarily an offline cryptographic forgery not dependent on network transit.
T1606.002prevents — A.8.20 requires network-level protections (firewalls, protocol hardening, device authentication, segmentation, monitoring, and isolating subnetworks under attack) that can stop an adversary from reaching the certificate store, AD FS server, or federation trust setup needed to forge SAML tokens, but leaves the core cryptographic signing and identity-provider logic untouched.
T1608.004detects — A.8.20 item f) explicitly requires logging and monitoring of network actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces adversary staging of malicious web content or infrastructure used for drive-by targeting, but only for the network-visible slice and not the full pre-attack preparation on PRE platforms.
T1609detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces container admin command abuse when it falls inside the scoped monitoring (e.g. anomalous API/kubelet/docker activity); the remainder is implementation-dependent scope that can exclude container-specific telemetry.
T1609prevents — A.8.20 requires network-level protections (firewalls, authentication of systems/devices, protocol hardening, segregation, isolation under attack) that can stop remote abuse of exposed container administration services (Docker daemon, Kubernetes API, kubelet) over the network, but leaves local privilege, misconfigured RBAC, and non-network vectors inside the container platform untouched.
T1610detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting information security, which can surface container deployment activity (especially anomalous or privileged ones) when it falls inside the chosen monitoring scope; however the clause sets scope by business needs rather than mandating container-specific instrumentation, leaving many deployment vectors (API calls, workload manifests, benign-image runtime payloads) outside that scope by design.
T1610prevents — A.8.20 requires network-level controls (firewalls, filtering, segregation, hardening, disabling vulnerable protocols, monitoring, and logical separation via virtualized/SDN networks) that stop many common container deployment vectors (e.g. unauthenticated Kubernetes API, exposed Docker daemon, weak network policies, or vulnerable protocols), but leaves open deployment via already-authenticated admin channels, malicious images pulled through allowed paths, or privileged containers that still satisfy the network rules.
T1611detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) and detecting/restricting device connections (item j), which can surface anomalous container escapes that traverse or affect the network; this is a genuine but minority slice of the technique's many non-network vectors (privileged containers, bind mounts, syscalls, docker.sock abuse, hypervisor vulns).
T1611prevents — A.8.20 explicitly requires hardening network devices, segregating admin channels, restricting/filtering connections (e.g. firewalls), isolating critical subnetworks under attack, disabling vulnerable protocols, and logical separation via virtualized/SDN networks; these directly block several named escape vectors (privileged containers, vulnerable protocols, exposed management sockets, hypervisor network attacks) but leave others (bind mounts, unshare/keyctl syscalls, symbolic-link exploits) untouched.
T1612detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which surfaces anomalous build activity on the Docker API or host; this is a genuine but minority slice because the clause is scoped by organizational requirements rather than mandating instrumentation that reliably catches container-specific build evasion.
T1613detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces container/resource discovery attempts in network or API traffic; this is only a slice of the technique (network-visible queries, not all local container API or dashboard use).
T1613prevents — A.8.20 requires network-level protections (segmentation, firewalls, protocol hardening, monitoring, authentication of systems/devices, and isolation under attack) that can block many discovery queries over the network (e.g. to Kubernetes APIs or dashboards), but leaves local/container-runtime discovery vectors and unhardened internal paths untouched.
T1615detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which can surface Group Policy Discovery activity on Windows networks when that activity is within the monitored scope (e.g. anomalous queries to SYSVOL or use of gpresult/PowerShell), but the control's scope is set by organizational requirements rather than mandating detection of this specific technique.
T1619detects — A.8.20 explicitly requires logging/monitoring of actions that can affect or are relevant to information security (including network activity that would surface cloud storage enumeration via APIs), but this is scoped by organizational requirements rather than mandating detection of this specific discovery technique.
T1620detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface reflective loading as anomalous in-process behavior (especially on monitored hosts), but the clause's scope is set by organizational requirements and does not mandate the specific process-memory instrumentation needed to catch all variants of this fileless technique.
T1621detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security (cross-referenced to 8.16), which surfaces anomalous login/MFA request patterns such as MFA fatigue bombing; this is a genuine but minority slice of the technique because the control is scoped to network-level actions rather than application/identity-provider telemetry that would catch most MFA request generation.
T1648detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces serverless abuse in monitored cloud networks; partial because scope is set by organizational requirements and many serverless invocations (e.g. in SaaS/office suites) sit outside network-layer visibility.
T1649detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces certificate theft or anomalous use on networks; this is bounded by the control's network-scope focus, leaving non-network certificate forgery, offline theft from stores, or CA compromise mostly unreached.
T1649prevents — A.8.20 requires network-level protections (authentication of systems, restricting/filtering connections, hardening devices, disabling vulnerable protocols, segregating admin channels, logging/monitoring, and isolating subnetworks under attack) that stop many certificate theft vectors and some forgery paths that rely on network access or exposed services, but leaves the bulk of the technique (local theft from stores/APIs/files, enrollment abuse, CA private-key compromise, and misconfigurations) untouched.
T1651detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which can surface abuse of cloud management services (e.g. anomalous admin commands or connections); this is a genuine but minority slice because the clause is scoped to network-level actions, not the full breadth of cloud VM command execution (including via trusted relationships or non-network vectors).
T1651prevents — A.8.20 requires network segmentation, hardening, protocol disabling, authentication of systems, logging/monitoring, and isolation of critical subnetworks under attack, which can prevent the initial administrative foothold or lateral movement needed to abuse cloud management services for VM command execution in many IaaS scenarios, but leaves open the remainder of direct cloud API/admin account compromise paths that do not rely on network traversal.
T1653detects — A.8.20.f explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; power-setting abuse (especially on network devices or via anomalous config changes) is observable in that scope, but the clause's network-centric focus leaves most endpoint powercfg/hibernation tampering outside its primary instrumentation.
T1654detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which surfaces log-enumeration activity (especially on centralized/SIEM infrastructure or anomalous access), but the clause is scoped by organizational requirements and does not mandate coverage of all host-level or real-time enumeration methods across every platform.
T1654prevents — A.8.20 requires logging/monitoring (f), network segmentation/hardening/restriction of connections (i,j,k,l,n), and protection of network data flows, which can block some paths to centralized logs or SIEMs and limit lateral discovery via logs, but does not stop local host log enumeration via wevtutil, PowerShell, or similar on endpoints.
T1657detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions affecting or relevant to information security, which surfaces many T1657 precursors (account compromise, unauthorized transfers, exfiltration, ransomware encryption) on networks; it does not address non-network social engineering, physical theft or post-impact monetary movement outside monitored infrastructure.
T1659detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks if under attack), which surface content-injection attempts in monitored network traffic; this is only a slice because upstream ISP-level or encrypted-channel injection often evades enterprise network monitoring scope.
T1659prevents — A.8.20 requires safeguards for data over public/third-party/wireless networks, logging/monitoring, restricting/filtering connections (e.g. firewalls), hardening, disabling vulnerable protocols, and isolating subnetworks under attack, which can block many upstream ISP-level or traffic-manipulation vectors for content injection; it does not address all compromised channels or every injection method (e.g. side-injection races).
T1659responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once content injection is underway, but the clause's other items are preventive, detective or hardening and do not address an in-progress attack.
T1665detects — A.8.20.f explicitly requires logging and monitoring of network actions relevant to information security (cross-referenced to 8.16), which surfaces anomalous traffic patterns or filtering attempts that can reveal hidden C2 infrastructure; this is only a slice of the full technique because the control is scoped to organizational networks and does not address preemptive domain masking, resource-development hiding, or adversary-side filtering of defender tools.
T1665prevents — A.8.20 requires network segmentation, hardening, protocol disabling, traffic filtering/firewalls, logging/monitoring, and virtualized network separation that can stop many traffic-manipulation and filtering techniques used to hide C2 infrastructure, but leaves open adversary use of proxies/VPNs, domain masking, trusted hosting, and geo-spoofing that blend with allowed traffic.
T1665responds — A.8.20's m) (temporarily isolating critical subnetworks with drawbridges if the network is under attack) and related monitoring/logging items directly enable containment of a live T1665 event once underway, but most of the technique's traffic-manipulation and preemptive hiding steps sit outside this narrow response slice.
T1666detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces hierarchy-modification API calls or anomalous account/subscription changes in IaaS networks; the remainder is that the clause sets scope by organizational requirements rather than mandating universal cloud-hierarchy instrumentation, so only a chosen slice is guaranteed to be detected.
T1667detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which would surface the anomalous flood of inbound messages or signup activity at network or mail-gateway layers; however the clause's scope is set by organizational requirements and does not mandate inbox-level or end-user mail-client monitoring, leaving a large slice of the technique (especially client-side burial of alerts) unreached.
T1669detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks under attack), which surface Wi-Fi connection attempts and related anomalies on supported platforms.
T1669prevents — A.8.20 explicitly requires safeguards for confidentiality/integrity over wireless networks, authentication of systems on the network, restricting/filtering connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, disabling vulnerable protocols, and logical separation in virtualized networks — all of which stop most T1669 vectors (open networks, weak auth, rogue devices, vulnerable protocols) from succeeding, with a bounded remainder around physical-proximity attacks on strong auth or pre-compromised dual-homed bridges.
T1669responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once a Wi-Fi compromise is underway, but the clause's other items are preventive/hardening/logging rather than active response to an in-progress T1669 event.
T1671detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security, which surfaces OAuth consent, new application registrations, anomalous service principals, and related persistence activity in SaaS/cloud networks; partial because the clause sets scope by organizational requirements rather than mandating universal depth or coverage of every integration vector.
T1673detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which includes anomalous enumeration of VMs on a hypervisor; the remainder is that the clause sets scope by organizational requirements rather than mandating universal instrumentation of every hypervisor CLI/GUI query.
T1674detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security, which can surface input-injection behaviors (e.g. anomalous keystroke simulation or HID activity) when they fall inside the chosen monitoring scope; the remainder is the many injection vectors (USB HID, in-process GUI scripting, preprogrammed tooling) that lie outside typical network-centric monitoring.
T1675detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items such as j (detecting device connections) and m (isolating subnetworks under attack), which can surface anomalous ESXi admin API use or guest command execution over the network; this is only a slice of the technique, which can also be purely local to the hypervisor or use non-network vectors.
T1675prevents — A.8.20 requires network-level protections (segmentation, authentication of systems/devices, hardening, protocol disabling, logging/monitoring, and isolation under attack) that can block many remote abuse paths into ESXi administration services and guest command execution, but leaves open vectors that rely on already-authenticated management channels, misconfigured virtualized/SDN boundaries, or guest-side daemon abuse once inside the hypervisor.
T1677detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces anomalous activity during a poisoned pipeline build on monitored networks; this is only a slice because the technique is a code/config change that can be entirely silent, the control is scoped to network-level observables rather than repository or CI process inspection, and many scenarios (e.g. public PR triggers, indirect file poisoning) leave no detectable network footprint until later lateral movement.
T1680detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions relevant to information security, which can surface local storage enumeration commands or anomalous queries on supported platforms; this is only a slice because the control is scoped to network-level protections and does not mandate host-level detection of every local discovery technique.
T1684.002detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16), which surfaces spoofed emails when they trigger anomalous network, mail-gateway or authentication events; this is a genuine but minority slice of the technique because the control is scoped to network-level monitoring rather than mandating comprehensive email-header or DMARC-failure detection.
T1684.002prevents — A.8.20 explicitly requires controls to safeguard confidentiality/integrity of data over networks (including authentication of systems, restricting/filtering connections, hardening devices, and disabling vulnerable protocols), which directly counters spoofed email headers that rely on absent or weak DMARC/SPF/DKIM enforcement; this prevents the technique on covered network paths but leaves internal Direct Send, misconfigured policies, and non-network vectors as a large remainder.
T1685detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks under attack), which surface some T1685 instances on networks/devices (e.g. tampering with network sensors or protocols) but miss the bulk of host/cloud/endpoint tool tampering named in the technique.
T1685prevents — A.8.20's network hardening, protocol disabling, segmentation, logging/monitoring, and isolation of critical subnetworks under attack directly stop many network-layer ways of disabling or tampering with security tools (e.g. network IDS/EDR sensors, syslog forwarding, SIEM ingestion, or remote management channels), but the technique's dominant host/endpoint and cloud slices (killing processes, tampering with local configs, ETW, Sysmon, etc.) lie outside its network-focused scope.
T1685responds — A.8.20 item m (temporarily isolating critical subnetworks with drawbridges if the network is under attack) directly enacts containment once an attack that could involve tool tampering is underway, which is the core of `responds`; the remainder of the control (hardening, logging, segregation, protocol disablement) is preventive or detective and does not address an in-progress T1685 incident.
T1685.001detects — A.8.20 item f) explicitly requires logging and monitoring (cross-referenced to 8.16/8.15) to record and detect actions affecting information security, which surfaces tampering with the EventLog service or audit policy on Windows; this is only a slice of the full technique surface because the control is scoped to network-level actions and does not mandate host telemetry or specific EventLog integrity checks.
T1685.002detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16/8.15), which would surface an adversary's disable/modify of cloud logging as anomalous activity; however the control is scoped to network-level actions and does not mandate detection of all cloud/IaaS/SaaS logging-tampering methods.
T1685.002prevents — A.8.20 requires logging/monitoring of network actions (f), hardening of devices (k), disabling vulnerable protocols (n), segregation of admin channels (l), and network-level restrictions/firewalls (i,j) that can block many paths to disabling cloud logging integrations, but leaves open privilege-based modification of cloud-native logging services that do not transit the monitored/hardened network layer.
T1685.004detects — A.8.20 item f) explicitly requires logging and monitoring to record and detect actions affecting information security (cross-referenced to 8.16/8.15), which surfaces tampering with auditd/rules as anomalous activity; however the clause sets scope by organizational requirements rather than mandating universal kernel-level audit monitoring, leaving a slice of implementations that conform yet miss the technique.
T1685.005detects — A.8.20 item f) explicitly requires logging and monitoring to detect actions that can affect or are relevant to information security; clearing Windows event logs is such an action (especially on the Security log) and would be surfaced by network or host monitoring of admin commands, file deletions, or anomalous log-clear events, but the control is scoped to networks and does not mandate endpoint-level detection of all local log-clearing mechanisms.
T1686detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented items (j: detecting device connections; m: isolating subnetworks if under attack), which can surface firewall tampering in monitored network traffic or anomalous device behavior, but this is scoped to network-level observables and does not systematically detect all host-based or platform-specific (e.g. ESXi esxcli) modifications named in T1686.
T1686prevents — A.8.20 explicitly lists restricting/filtering connections (e.g. using firewalls), hardening network devices, disabling vulnerable protocols, and segregating channels, which directly stop many forms of firewall disablement or rule tampering from succeeding; this is only partial because the control is scoped to network-level protections and does not reach all host-based firewall modification vectors (especially post-compromise on endpoints).
T1686responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (drawbridges) when the network is under attack, which is a containment action once T1686 has begun impairing the firewall; the remainder of the clause is about static prevention and hardening rather than active response to an in-flight technique.
T1686.001detects — A.8.20 explicitly requires logging and monitoring of actions that can affect or are relevant to information security (including network activity, configuration changes, and attacks), which surfaces adversary firewall modifications in cloud environments as anomalous events, but only where those actions fall inside the scoped monitoring rather than all possible cloud control-plane changes.
T1686.001prevents — A.8.20 explicitly requires restricting/filtering network connections (e.g. using firewalls), hardening network devices, segregating admin channels, disabling vulnerable protocols, and protecting against unauthorized access over networks, which directly stops adversaries from disabling or modifying cloud firewalls to add permissive rules.
T1686.001responds — A.8.20 item m explicitly names temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once the adversary technique of modifying cloud firewall rules is already underway; the remainder of the clause is about static/preventive network hardening, logging, and segregation that do not act on an in-progress modification.
T1686.002detects — A.8.20 explicitly requires logging/monitoring of actions affecting network security (item f, cross-referencing 8.16) and detecting device connections (item j), which surfaces firewall rule changes or device tampering on managed network equipment; partial because it depends on scope and does not guarantee detection of all indirect host-based manipulations or unmonitored devices.
T1686.002prevents — A.8.20 explicitly requires implementing network security controls including restricting/filtering connections (firewalls), hardening devices, segregating admin channels, disabling vulnerable protocols, and authenticating systems — directly stopping adversaries from disabling or reconfiguring device firewalls and ACLs in most cases, with a bounded remainder for post-compromise management interface access via valid accounts or unhardened exposures.
T1686.002responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment response once adversarial firewall tampering is underway; this is only a slice of the full technique (other listed items are preventive or detective).
T1686.003detects — A.8.20 explicitly requires logging and monitoring of actions that can affect or are relevant to information security (including network device hardening, connection restrictions, and protocol use), which surfaces firewall tampering in monitored environments, but the clause sets scope by organizational requirements rather than mandating universal host-level detection of all modification vectors.
T1686.003prevents — A.8.20 explicitly lists restricting/filtering connections (e.g. using firewalls), hardening network devices, disabling vulnerable protocols, and segregating channels, which directly stop many of the firewall-disable/rule-modify actions named in T1686.003; it is only partial because the control is scoped to network-level and virtualized-network measures rather than mandating host-firewall integrity on every Windows endpoint.
T1686.003responds — A.8.20 explicitly lists temporary isolation of critical subnetworks (e.g. with drawbridges) if the network is under attack, which is a containment action once the firewall-disable technique is underway; this is only a slice of the full technique (does not address rule modification, registry changes, or non-network impacts).
T1687detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection-oriented practices such as restricting/filtering connections, authenticating systems/devices, and isolating subnetworks under attack, which surface exploitation attempts or anomalies against network-layer defenses (e.g. firewalls) but leave most endpoint, EDR, or non-network defensive-component exploitation outside its scope.
T1687prevents — A.8.20's hardening, protocol disabling, authentication, segregation, logging/monitoring, and isolation measures (plus virtualized network separation) stop many exploitation paths that would reach and impair defensive components, but leave residual paths via unhardened devices, unpatched vulnerabilities in the defensive tools themselves, and non-network vectors.
T1689detects — A.8.20 explicitly requires logging/monitoring of network actions (item f, cross-referencing 8.16) plus detection/restriction of device connections (item j) and vulnerable protocols (item n), which surfaces some downgrade attempts on network protocols or attached devices but does not address non-network downgrades such as PowerShell version rollback, boot manager downgrade, or most command interpreter cases.
T1689prevents — A.8.20 explicitly lists disabling vulnerable network protocols, hardening network devices, authenticating systems, restricting/filtering connections, and safeguarding confidentiality/integrity of data over networks (including via 8.24 crypto), which directly stops protocol or feature downgrades that enable sniffing, MitM or loss of logging on the network slice of T1689; this is only a minority slice of the technique's full scope (PowerShell interpreter downgrade, boot manager downgrade, non-network features).
T1690detects — A.8.20 item f) explicitly requires logging and monitoring of actions that can affect or are relevant to information security (cross-referenced to 8.16/8.15), which surfaces the adversary's disabling of command history on hosts and especially on network devices; this is only a slice of the technique because the control is scoped to network-relevant actions rather than all command interpreters or host-side history changes.

Prevented OWASP Web Top 10 (2025) risks (18)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A02→M A04→P A05←P →P A06→P A07←P →P A08→P A09→P A10→P

Why these map — AI rationale (under review)

A01mitigates — A.8.20's network-level boundary protections (firewalls, segregation, filtering, isolation under attack, protocol hardening) bound the blast radius or block some attack paths for a realized broken-access-control weakness, but do not address the core authorization-decision failures that dominate the category (e.g. IDOR, missing function-level checks, CSRF).
A01prevents — A.8.20's network-level mechanisms (firewalls, connection filtering/restriction, segregation, protocol disabling, virtualized isolation) squarely prevent several A01 members that cross network boundaries (e.g. SSRF, path traversal over networks, certain CSRF vectors), but leave the bulk of the category (IDOR, missing function-level checks, authorization logic flaws inside the app) untouched.
A02mitigates — A.8.20's network-level safeguards (firewalls, segregation, protocol disabling, isolation under attack, virtualized separation) bound the blast radius or block some attack paths that can exploit an exposed misconfiguration, but do not address the core weakness of weak defaults or incomplete hardening on the systems themselves.
A02prevents — A.8.20 explicitly requires hardening network devices, restricting/filtering connections (e.g. firewalls), segregating admin channels, disabling vulnerable protocols, and applying controls to virtualized/SDN networks, which directly closes most misconfiguration attack surfaces named by A02:2025; the bounded remainder is non-network application/framework defaults and incomplete hardening of endpoints that sit outside the network layer.
A04mitigates — A.8.20 item e) explicitly calls for controls safeguarding confidentiality/integrity of data over public/third-party/wireless networks (cross-referencing 8.24 crypto), which bounds the realized consequence of weak/misused crypto in transit; the remainder (at-rest failures, absent crypto, key management, algorithm selection) is untouched by network-level measures.
A05mitigates — A.8.20's network boundary protections (firewalls, segregation, protocol disabling, isolation under attack, logging/monitoring) bound the consequence of some injection families (e.g. outbound OS/command, SSRF) but leave the dominant in-band cases (SQLi, XSS) untouched.
A05prevents — A.8.20's network-level measures (firewalls, protocol disabling, segmentation, isolation under attack, virtualized separation) prevent several injection families from reaching their interpreters (e.g. OS command, SSRF, some LDAP), but leave the dominant in-band cases (SQL, XSS, most template) untouched.
A06mitigates — A.8.20's network-level protections (segmentation, firewalls, protocol hardening, isolation under attack, virtualized separation) bound the blast radius or consequence of design-level flaws such as missing authentication/authorization or insecure data flows, but do not address the baked-in architectural weaknesses themselves.
A07mitigates — A.8.20's network-level protections (firewalls, segregation, authentication of systems/devices, protocol hardening, isolation under attack) bound the blast radius or block some hijacking vectors for realized auth failures, but do not address credential stuffing, weak reset flows, or session flaws at the application layer.
A07prevents — A.8.20 explicitly lists authenticating systems on the network, restricting/filtering connections (e.g. firewalls), detecting/restricting/authenticating device connections, hardening devices, segregating admin channels, disabling vulnerable protocols, and virtualized network separation; these directly block many authentication bypass, credential stuffing, session hijacking, and weak reset vectors at the network layer, but leave application-layer auth flaws (e.g. logic errors, weak password policies) untouched.
A08mitigates — A.8.20's network protections (firewalls, segregation, monitoring, protocol hardening, isolation under attack) bound the blast radius or detect some integrity-failure consequences (e.g. CI/CD paths, unsigned updates reaching production), but do not address the core weakness of trusting unverified code/data or insecure deserialization.
A09mitigates — A.8.20 item f) explicitly requires logging and monitoring of actions relevant to information security (cross-referencing 8.16/8.15), which bounds the realized consequence of undetected incidents even if the logging/alerting implementation itself is flawed.
A10mitigates — A.8.20's network boundary protections, logging/monitoring, protocol hardening, isolation under attack and virtualized segmentation can bound the blast radius or observability of a realized exception-handling failure (e.g. fail-open auth or leaked error data crossing a network), but do not address the core weakness of inconsistent or leaky error paths in application logic.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.