A.8.23 Technological
Web filtering
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (13)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-4mostlyaligns with — Both enforce policy-based restrictions on the flow of information between users and external web destinations.
- SC-7mostlyaligns with — Both controls use boundary-level filtering to block access to known malicious or unauthorized external resources.
- AT-2partialaligns with — Both require user awareness training on the risks of accessing unsafe or unauthorized web content.
- CM-7partialaligns with — Both limit the functionality available to users by restricting access to specific categories of web resources.
- CM-7partialcovers — A.8.23 web filtering directly implements the prohibition/restriction of certain web resources, protocols and services (a slice of CM-7's least-functionality requirement), but does not address configuration of overall system functionality, non-web ports/software, or the broader baseline.
- SI-4partialaligns with — Both rely on threat intelligence feeds to identify and block malicious web sites and command-and-control infrastructure.
- AC-4covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- SC-7covers — A.8.23 web filtering is one specific mechanism for monitoring/controlling external web traffic at a boundary, but SC-7 is a much broader control that also includes physical/logical separation, all non-web protocols, subnetwork segmentation, and general managed interfaces — leaving the bulk of SC-7 uncovered.
Aligned NIST CSF 2.0 outcomes (17)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.IR-01mostlyaligns with — Web filtering implements a technical control that blocks unauthorized or malicious network destinations, directly supporting the outcome of protecting networks and environments from unauthorized logical access and usage.
- GV.PO-01partialaligns with — Establishing rules for appropriate web use and keeping them current supports the creation of cybersecurity risk management policy based on organizational context and priorities.
- ID.RA-02partialaligns with — The control incorporates threat intelligence to identify and block malicious websites, aligning with the outcome of receiving cyber threat intelligence from external sources.
- PR.AT-01partialaligns with — The control requires training personnel on safe web usage and organizational rules, which contributes to ensuring personnel have the knowledge to perform tasks securely.
- PR.PS-05partialaligns with — By preventing access to malicious or unauthorized web resources, the control reduces the risk of unauthorized software being downloaded or executed on organizational systems.
- GV.PO-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- ID.RA-02implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.AT-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.IR-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.PS-05implements — A.8.23 web filtering gives operational effect to preventing unauthorized software execution by blocking malware delivery vectors and unauthorized download sites, which sits inside the PR.PS domain but is not the only or explicitly named means (e.g. allowlisting, execution controls also serve it)
Related OWASP ASVS 5.0 requirements (5)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Related weaknesses / CWE (14)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-200prevents — By blocking known malicious or phishing domains, the control reduces the chance that users will reach attacker-controlled pages that could exfiltrate sensitive data or credentials.
- CWE-352mitigates — By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
- CWE-451mitigates — Web filtering can block known phishing sites that exploit UI misrepresentation.
- CWE-508prevents — Web filtering can block delivery vectors for non-replicating malware.
- CWE-509prevents — Web filtering blocks malware downloads that lead to virus/worm replication.
- CWE-601mitigates — Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.
Mitigated MITRE ATT&CK techniques (396)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
T1001←MT1001.001←MT1001.002←MT1001.003←M →PT1006←PT1008→PT1011←PT1014←MT1016.001←MT1020←MT1027.001←MT1027.002←MT1027.003←MT1027.005←MT1027.006←M →PT1027.007←MT1027.008←PT1027.009←PT1027.010←MT1027.011←PT1027.012←MT1027.014←MT1027.017←M →PT1027.018←MT1030←PT1036←MT1036.002←MT1036.003←MT1036.005←MT1036.007←MT1036.008←MT1036.009←MT1036.012←MT1041←M →PT1048←M →PT1048.001←MT1048.002←MT1048.003←M →PT1055←MT1055.001←MT1055.002←MT1055.003←MT1055.004←MT1055.005←MT1055.008←PT1055.009←MT1055.011←MT1055.012←MT1055.013←MT1055.014←MT1055.015←MT1056←M →PT1059←M →PT1059.001←MT1059.007←M →PT1070←MT1070.010←PT1071←M →PT1071.001←M →PT1071.002←MT1071.003←MT1071.004←M →PT1071.005←MT1078←PT1078.004←MT1090←MT1090.001←M →PT1090.002←M →PT1090.003←M →PT1090.004←MT1095←MT1098.005←PT1102→PT1102.001←M →PT1102.002→PT1102.003→PT1104←M →PT1105←M →PT1110.001→PT1127←MT1127.001←MT1127.002←M →PT1132←MT1132.001←MT1132.002←MT1133←MT1176←M →PT1176.001←M →PT1185←MT1187←PT1189←M →PT1190←M →PT1197←P →PT1203←M →PT1204←M →PT1204.001←M →PT1204.002←M →PT1204.003←PT1204.004←M →PT1204.005←PT1205←MT1205.001←PT1205.002←MT1207←PT1211←PT1216←MT1216.001←MT1218←MT1218.001←PT1218.004←MT1218.005←M →PT1218.007←MT1218.008←PT1218.010←M →PT1218.011←PT1218.012←PT1218.013←PT1219←M →PT1219.001←MT1219.002←M →PT1219.003←MT1220←PT1221←M →PT1480←PT1480.001←PT1484←PT1484.002←PT1496.002→PT1497←PT1498←PT1505.003←MT1528←MT1534←M →PT1535←MT1537←MT1539←M →PT1542←MT1542.002←PT1542.003←MT1546.012←PT1546.015←MT1548←PT1550←MT1550.001←MT1550.004←FT1553←MT1553.001←PT1553.002←PT1553.003←PT1553.004←MT1553.005←MT1557←M →PT1557.003←MT1557.004←MT1566→PT1566.001→PT1566.002←M →PT1566.003←M →PT1566.004←PT1567→PT1567.001←M →PT1567.002←M →PT1567.003→PT1567.004←M →PT1568→PT1568.001→PT1568.002←M →PT1568.003←M →PT1571←MT1572←M →PT1573←MT1573.001←MT1573.002←MT1574←MT1574.001←MT1574.013←PT1578.001←PT1578.002←PT1578.004←PT1583←MT1583.001←M →PT1583.002←M →PT1583.003←MT1583.004←M →PT1583.005←MT1583.006←MT1583.007←MT1583.008←P →PT1584←MT1584.001←MT1584.002←MT1584.003←MT1584.004←M →PT1584.006←MT1584.007←MT1584.008←MT1585.002←MT1586.002←MT1587.001←MT1588←MT1588.001←M →PT1588.002←MT1588.004←PT1589→PT1589.001→PT1595.003→PT1598←M →PT1598.001←M →PT1598.002←MT1598.003←M →PT1599←MT1599.001←MT1601.002←PT1606←MT1606.001←MT1608←M →PT1608.001←MT1608.002←PT1608.003←PT1608.004←M →PT1608.005←M →PT1608.006←MT1610←PT1612←MT1620←PT1621←PT1659←M →PT1665←MT1674←PT1678←PT1684←M →PT1684.001←P →PT1684.002←PT1685←MT1685.003←MT1686←MT1686.001←MT1686.002←MT1686.003←MT1687←PT1688←MT1689←P
Why these map — AI rationale (under review)
- T1001.003detects — A.8.23 web filtering (including blocking known/suspected malicious sites and C2 servers from threat intel) can surface attempts to reach impersonated web services or C2 domains that match its blocklist, but the technique's core blending via protocol/HTTP/SSL impersonation is designed to evade exactly such network-level detection and is not addressed by the control's guidance.
- T1001.003prevents — A.8.23 blocks access to known/suspected C2 servers and malicious sites via domain/IP filtering (and associated training/rules), which stops some impersonated C2 traffic to those destinations but does not address impersonation of legitimate web services, HTTP header/URI/SSL manipulation, or unknown C2 domains.
- T1008detects — A.8.23's web filtering (blocking known/suspected malicious sites, C2 servers, and threat-intel domains) surfaces attempts to reach fallback C2 channels when those match the blocked list, but does not broadly instrument or detect fallback behavior itself across all possible alternate channels or non-web protocols.
- T1008prevents — A.8.23 explicitly blocks access to command-and-control servers (and malicious sites acquired from threat intel), which stops the adversary from reaching many fallback C2 channels; it does not address all possible alternate channels an already-compromised host could use, nor does it guarantee blocking of every C2 domain/IP.
- T1027.006detects — A.8.23's web filtering (including auto-configured browser/anti-malware blocks on known malicious domains/IPs from threat intel) can surface some HTML smuggling attempts when the delivery site or C2 matches a blocked list, but the technique's core (benign MIME-wrapped blobs/JS that deobfuscate client-side) is explicitly designed to evade content filters and leaves most instances undetected.
- T1027.006prevents — A.8.23's web filtering (by domain/IP, known-malicious lists, and upload-function blocks) stops many delivery vectors for HTML smuggling payloads before they reach the user, but the technique's use of benign MIME types, inline obfuscation, and client-side deobfuscation (T1140) routinely evades static content filters as the source prose itself notes.
- T1027.017detects — A.8.23's web filtering (IP/domain blocking of known malicious sites, C2, phishing) can surface SVG smuggling when it redirects to or pulls from a blocked malicious domain, but the core technique (hiding JS payloads inside SVG-as-image that never leaves the local system or uses a known-bad domain) is invisible to it.
- T1027.017prevents — A.8.23's web filtering (domain/IP blocks on known malicious sites, C2, phishing, malware distributors) stops some SVG smuggling vectors that redirect to or fetch from listed bad sites, but does not stop SVG-embedded JS, payload assembly, or smuggling inside documents/PDFs that never touch a blocked web resource.
- T1041detects — A.8.23's web filtering and blocking of known/suspected C2 servers (plus training on not bypassing warnings) can surface attempts to reach listed malicious C2 domains/IPs, but does not broadly instrument or detect encoded exfiltration once a channel is already established, leaving most of the technique unseen.
- T1041prevents — A.8.23 explicitly blocks access to command-and-control servers (and malicious sites acquired from threat intel), which stops the C2 channel from being reachable and therefore stops exfiltration over it; the remainder is C2 infrastructure that is not on a blocked list, uses unfiltered protocols or ports, or is reached before the blocklist is updated.
- T1048detects — web filtering can surface attempts to reach known-bad C2 or exfil destinations (malicious sites, C&C servers, threat-intel blocks) but does not observe or flag the many legitimate-protocol exfil paths (FTP/SMTP/HTTP to IaaS/SaaS consoles, curl, SMB, cloud APIs) that are outside its blocklist scope
- T1048prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and threat-intel-derived malicious domains/IPs, which can cut off some alternate-protocol exfil channels (especially web-based or to attacker-controlled sites), but leaves many others (FTP, SMTP, DNS, SMB, curl to benign-but-abusable services, IaaS/SaaS consoles, encrypted/obfuscated channels) untouched.
- T1048.003detects — A.8.23's web filtering and blocking of known/suspected malicious sites, C2 servers, and threat-intel feeds can surface attempts to reach exfil destinations that match those categories, but most T1048.003 exfil (to arbitrary unencrypted alternate locations via HTTP/FTP/DNS with obfuscation) is not known-malicious in advance and therefore goes undetected.
- T1056prevents — A.8.23 blocks access to known/suspected malicious sites (incl. phishing and C2) that rely on deceiving users into credential entry, directly stopping that slice of T1056; it has no effect on transparent mechanisms such as API hooking or non-web input capture.
- T1059prevents — A.8.23 explicitly blocks access to command-and-control servers (and malicious sites that could deliver interpreter-abusing payloads), which stops some T1059 execution paths that rely on downloading/running secondary payloads from C2; this is only a slice of the technique, which also covers local interpreters, embedded scripts in initial-access documents, and interactive/remote shells that do not traverse web filtering.
- T1059.007detects — A.8.23's web filtering (especially of known/suspected malicious sites, C2, and threat-intel feeds) surfaces many JS-hosting or drive-by sites before execution, but leaves non-web JS (JXA, local .js files, Node, in-memory OSAKit, obfuscated payloads) entirely unreached.
- T1059.007prevents — A.8.23 blocks access to malicious websites (including those hosting JS for drive-by compromise or download), which stops the web-based delivery vector for T1059.007; it has no effect on non-web JS abuse such as local JScript, JXA, Node.js, or already-delivered payloads.
- T1071prevents — A.8.23 blocks access to known/suspected C2 domains, malicious sites and command-and-control servers (and trains users not to bypass warnings), which stops the subset of T1071 that relies on those blocked web resources; it leaves untouched the many other application-layer protocols, internal enclave protocols, and unlisted C2 domains that the technique can and does use.
- T1071.001prevents — By denying access to attacker-registered or compromised domains, the control reduces the viability of web protocols as covert C2 channels.
- T1071.001detects — A.8.23's web filtering (blocking known/suspected malicious sites, C2 servers, and threat-intel domains) surfaces attempts to reach those specific indicators, which is a slice of T1071.001's C2 blending; it does not broadly detect concealed HTTP/S or WebSocket abuse that mimics normal traffic.
- T1071.004detects — A.8.23's web filtering and malicious-site blocking (including C2 servers from threat intel) can surface anomalous DNS patterns that resolve to blocked domains, but the control is scoped to web resources and does not mandate DNS-specific monitoring or detection of embedded tunneling/beaconing that blends with legitimate traffic.
- T1071.004prevents — A.8.23 explicitly blocks known/suspected malicious domains, C2 servers and threat-intel-sourced malicious sites, which stops the subset of T1071.004 that uses pre-known bad domains; it does not stop novel, uncatalogued, or blended legitimate-domain DNS tunneling.
- T1090.001detects — A.8.23 web filtering (including blocking known/suspected malicious sites and C2 servers from threat intel) can surface anomalous internal proxy/C2 redirection attempts when they involve external or known-bad destinations, but the technique is primarily internal/lateral (e.g. SMB p2p between compromised hosts) and the control's scope is outbound web filtering rather than internal traffic inspection.
- T1090.002detects — A.8.23's web filtering and blocking of known/suspected malicious sites, C2 servers, and threat-intel-derived domains can surface attempts to reach external proxies used for C2 when those match the blocked list or trigger browser advisories, but the control is scoped to web resources and does not broadly instrument or surface proxy-based redirection across all platforms and non-web C2 paths.
- T1090.002prevents — A.8.23 explicitly blocks access to command-and-control servers (and malicious sites acquired from threat intel), which stops the victim system from reaching the external proxy used for C2 when that proxy is on a blocked list; this is a genuine but minority slice of the technique because most external proxies are chosen from innocuous or low-suspicion infrastructure that would not be on any such block list.
- T1090.003detects — A.8.23 web filtering can surface attempts to reach known/suspected malicious proxy or C2 domains/IPs (via blocklists or threat intel), but most multi-hop proxy chains (Tor, ORB, P2P, blockchain routing, compromised internal devices) use unknown or encrypted paths that evade domain/IP blocking and produce no detectable web request.
- T1102detects — A.8.23's web filtering (blocking known/suspected malicious sites, C2 servers, and threat-intel feeds) surfaces attempts to reach blocked C2 web services, but common legitimate services (Google, Twitter, etc.) used for T1102 are rarely blocked and thus undetected by the filter.
- T1102prevents — A.8.23 explicitly blocks known/suspected malicious websites, C2 servers, and those acquired from threat intelligence, which directly stops many T1102 uses of external web services for C2; however, popular legitimate services (Google, Twitter, etc.) that adversaries leverage for cover are unlikely to be blocked per the control's own rules for business-permitted access, leaving a substantial slice unaddressed.
- T1102.001detects — A.8.23's web filtering and blocking of known/suspected malicious sites or C2 servers (from threat intel) can surface attempts to reach dead-drop resolvers hosted on blocked domains/IPs, but popular legitimate services (Google/Twitter) used for this technique fall outside typical block lists and produce no detection
- T1102.001prevents — A.8.23 explicitly blocks access to command-and-control servers and malicious sites acquired from threat intelligence, which stops victims from reaching many dead-drop resolvers hosted on known-bad domains/IPs; it does not stop use of popular legitimate services (Google, Twitter, etc.) that are not blocked, nor does it address obfuscated/encoded payloads or the initial malware infection that reads the resolver.
- T1102.002detects — A.8.23's web filtering (including blocking known/suspected malicious sites and C2 servers from threat intel) can surface attempts to reach C2-hosting web services, but popular legitimate services (Google/Twitter) used for bidirectional C2 are rarely blocked and produce expected traffic that the control does not flag
- T1102.002prevents — A.8.23 explicitly lists command-and-control servers among the categories whose domains/IPs should be blocked, directly stopping the technique from reaching those C2 web services; it reaches only a slice because popular legitimate services (Google, Twitter, forums) that adversaries repurpose for bidirectional C2 cannot be blanket-blocked without breaking business use, and the control's own guidance requires an exception process and rules that permit valid access.
- T1102.003detects — A.8.23's web filtering and blocking of known/suspected malicious sites or C2 servers (from threat intel) can surface attempts to reach them, but popular legitimate web services (Google/Twitter) used for one-way C2 are rarely blockable and fall outside the control's scope
- T1102.003prevents — A.8.23 explicitly blocks access to command-and-control servers and malicious websites acquired from threat intelligence, which directly stops compromised systems from reaching the external web services used for one-way C2 instructions in T1102.003; it is only partial because popular legitimate services (Google, Twitter, etc.) that adversaries hijack for cover are rarely blockable without breaking business use, and the control's scope is limited to identified/blocked sites rather than all possible one-way channels.
- T1104prevents — A.8.23 explicitly blocks access to command and control servers (and malicious sites acquired via threat intel), which stops the initial callback to a first-stage C2 and therefore prevents the multi-stage channel from ever being exercised on that path.
- T1105prevents — A.8.23 blocks access to known/suspected malicious websites, C2 servers, and threat-intel-sourced malicious domains/IPs that adversaries commonly use to host and deliver tools, directly stopping many web-based download vectors in T1105; it leaves non-web protocols (ftp, scp, rsync, lateral transfer, cloud sync abuse, package managers) and unknown/new sites untouched.
- T1110.001prevents — A.8.23 web filtering can block access to malicious/phishing/command-and-control sites that adversaries use as sources for common-password lists or as external guessing endpoints (e.g. cloud SSO, Office 365, or HTTP management services), but most of the technique's vectors (local services on SSH/RDP/LDAP/Kerberos/SMB/etc., on-prem identity providers, network devices, containers) are untouched by web filtering.
- T1127.002detects — A.8.23's web filtering (blocking known/suspected malicious sites, C2, threat-intel feeds) surfaces the malicious website vector that delivers the ClickOnce payload, but does not address the other abuse paths (rundll32 proxy, startup folder persistence, or local file-share execution).
- T1127.002prevents — A.8.23 blocks access to known/suspected malicious websites (including those delivering malware via ClickOnce popups from the web), directly stopping the primary User Execution vector described; it does not address non-web vectors such as file shares, rundll32 abuse, or startup folder persistence.
- T1176prevents — A.8.23 web filtering (especially of malicious/phishing/C2 sites and upload-capable sites) can block many delivery vectors for malicious browser extensions (a major slice of T1176 on the dominant browser platform), but leaves manual/sideloading, compromised marketplaces, benign-extension abuse, and non-web IDE extensions untouched.
- T1176.001prevents — A.8.23 blocks access to known/suspected malicious websites, C2 servers, and threat-intel-sourced malicious domains (including those used for malicious extension distribution or C2 via extensions), stopping some installation vectors and post-install C2; it does not stop local/silent file-based installs, social engineering that bypasses filtering, or file manipulation of browser prefs.
- T1189prevents — Preventing access to malicious websites reduces the chance that drive-by downloads or browser exploits will succeed.
- T1189detects — A.8.23's web filtering (especially of known/suspected malicious sites, C2, and threat-intel feeds) surfaces many drive-by sites before or during the visit, but leaves undetected the compromise of legitimate sites, malvertising on permitted ad networks, watering-hole targeting of unlisted communities, and client-side exploitation that evades domain/IP blocks.
- T1190prevents — web filtering blocks access to known/suspected malicious sites (including C2 and those from threat intel) that could host the exploitable public-facing apps, but leaves unblocked the vast remainder of unknown, zero-day, or non-web-vector public-facing weaknesses (e.g. unpatched SMB, SSH, SNMP, edge appliances, or novel web vulns)
- T1197detects — A.8.23 web filtering can detect and block access to known/suspected malicious websites, C2 servers, or threat-intel-sourced domains used in BITS jobs for download/ingress, but does not surface the local BITS job creation, execution, persistence, upload/exfil, or cleanup behaviors themselves.
- T1203prevents — A.8.23 blocks access to known/suspected malicious sites (including C2 and those distributing malware), which stops the browser-based drive-by vector of T1203 before the vulnerable client is reached; it has no effect on Office, third-party app, or non-web vectors, leaving an open-ended majority of the class untouched.
- T1204detects — A.8.23 web filtering (plus its associated training and rules) can surface attempts to reach known/suspected malicious sites, C2, or phishing resources that commonly deliver the payloads or links whose execution the technique relies on, but it does not observe or surface the actual user execution action itself or the many non-web vectors (desktop files, shared dirs, vishing, manual copy-paste, RAT enablement) described in the T1204 prose.
- T1204prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and phishing/malware distribution sites (plus training on not overriding warnings), which stops the user from reaching many of the web-delivered payloads or malicious links that trigger T1204 execution; it leaves open non-web vectors, user-placed local files, social engineering that bypasses the filter, and any unlisted or new malicious sites.
- T1204.001prevents — Filtering malicious links before users can click them lowers the probability that a user will execute malware delivered through a malicious URL.
- T1204.001detects — web filtering can surface known/suspected malicious sites or C2 domains (via block lists or browser advisories) before or during the click, but does not broadly detect novel links, social-engineering delivery, or post-click execution artifacts
- T1204.002detects — Web filtering can detect and block access to known malicious websites or C2 that deliver the files (or the files themselves when downloaded via web), surfacing the technique in flight for some delivery vectors, but does not detect local file execution, shared-drive drops, or non-web vectors on Linux/macOS/Windows.
- T1204.002prevents — A.8.23 blocks access to known/suspected malicious websites (including those distributing malware) and C2, which stops delivery of many malicious files that arrive via web vectors or drive-by downloads; it does not address files already resident on the system, delivered by email, USB, or internal sharing, nor does it stop the user action of opening a file once obtained.
- T1204.004prevents — A.8.23 blocks access to known/suspected malicious websites (including those used in drive-by compromise) that deliver the ClickFix-style prompts, so the social-engineering vector never reaches the user on those sites; it does not address the phishing-email vector, user training to ignore prompts, or non-web delivery, leaving a genuine minority slice prevented.
- T1218.005detects — A.8.23's web filtering (IP/domain blocking of known malicious sites, C2, phishing, and threat-intel feeds) can surface mshta.exe's URL-based HTA/script fetches when they target blocked resources, but the technique's inline vbscript, non-web execution paths, and browser-bypass nature leave most instances undetected by this control alone.
- T1218.005prevents — A.8.23 blocks access to malicious websites, C2 servers and known threat-intel domains that would deliver the .hta/.sct payload, stopping the technique from ever running; it does not stop mshta.exe abuse of a local or already-delivered HTA file, nor non-web delivery vectors.
- T1218.010prevents — A.8.23 blocks access to malicious C2 servers, known/suspected malicious websites (including those distributing malware), and threat-intel-sourced malicious sites; the Squiblydoo variant of T1218.010 explicitly loads a remote COM scriptlet from an external web server, so the control stops that network fetch and thereby prevents the technique from executing, but the remainder (local DLLs, COM hijacking for persistence, or non-web-loaded regsvr32 abuse) is untouched.
- T1219prevents — A.8.23 blocks access to known/suspected C2 servers and malicious websites (via IP/domain filtering), which can stop some post-compromise RAT/C2 channels when they rely on those; it does not stop legitimate internal tools, protocol tunnels, EDR response features, or non-web C2.
- T1219.002detects — A.8.23 web filtering can detect and block access to known/suspected C2 servers or malicious websites hosting remote desktop tools when they are reached via HTTP/HTTPS, but this is only a slice of the technique (many legitimate RMM tools are already installed/allowed, use non-web protocols, or are invoked internally).
- T1221detects — web filtering can detect and block the online URL fetch step (malicious template, C2, or forced-auth resource) when the reference is to a known-bad domain/IP from threat intel or malware lists, but the core technique (modifying the document/template itself) occurs offline and evades the control
- T1221prevents — A.8.23 blocks access to known/suspected malicious websites, C2 servers, and threat-intel-derived malicious domains/IPs that deliver the remote template payload, directly stopping the fetch step of T1221 on those named resources; it does not stop local template modification, RTF control-word tampering, or use of unlisted/unknown template URLs.
- T1496.002detects — A.8.23's web filtering and blocking of known/suspected malicious sites, C2 servers, and threat-intel feeds can surface anomalous outbound connections or malware-driven bandwidth use that matches those categories, but most of the technique (proxyjacking sales, seeding torrents, internet-wide scanning from already-compromised hosts, or non-web C2) occurs without hitting the named blocklist triggers.
- T1496.002prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and malware/phishing resources (including those used for botnet seeding or proxyware), which stops initial compromise or C2-driven bandwidth abuse on some vectors; it does not address already-compromised internal systems, non-web malware, or scanning from co-opted hosts.
- T1534detects — A.8.23 web filtering (and its associated training) can detect and block access to known/suspected malicious external sites, C2, or phishing material used in the external-link or attachment stages of internal spearphishing, but has no view of internal chat apps, impersonation from already-compromised accounts, or non-web delivery vectors.
- T1534prevents — A.8.23 blocks access to known/suspected malicious external websites (including phishing sites and C2) and requires rules/training against unsafe web use, which stops the external-link and external-site portions of internal spearphishing but leaves internal chat-app vectors, already-compromised accounts, and non-web delivery untouched.
- T1539detects — A.8.23 web filtering (especially of known/suspected malicious sites, C2, and threat-intel feeds) can surface some T1539 vectors such as phishing proxies or malicious JS sites, but most vectors (local malware stealing cookies from disk/memory, AitM without a blocked domain, or post-auth cookie use) are invisible to it.
- T1539prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and phishing material (including those used in Evilginx2/Muraena proxy phishing or JS injection), stopping the technique from reaching the victim browser; it does not address local malware theft from disk/memory, network sniffing, or already-compromised sessions.
- T1557prevents — A.8.23 blocks known/suspected malicious domains, C2 servers, and threat-intel feeds that adversaries often abuse for DNS/LLMNR poisoning or redirect-to-AiTM; this stops some (but far from all) AiTM setup vectors, especially those relying on user-driven web access or known bad infrastructure.
- T1566detects — A.8.23's web filtering (and associated training) can detect and block access to known/suspected malicious websites, C2 servers, or phishing URLs once a victim clicks a link, but does not detect the phishing messages themselves (email, social media, spoofed/thread-hijacked delivery, attachments, or phone-directed lures) which are the core of T1566.
- T1566prevents — A.8.23 blocks access to known/suspected malicious websites (including phishing sites and C2) via IP/domain filtering and rules, which stops the malicious-link/URL portion of T1566 from succeeding; it leaves the email-delivery, attachment, social-engineering, spoofing, and phone-number vectors untouched.
- T1566.001prevents — Web filtering can block access to known/suspected malicious domains, C2 servers, or phishing sites (including those hosting or linked from spearphishing payloads), stopping the technique from reaching the user; it does not stop email delivery itself, social engineering, or unknown/zero-day attachment vectors.
- T1566.002prevents — Blocking known phishing domains and malicious sites directly prevents users from reaching attacker-controlled links that deliver initial payloads.
- T1566.002detects — A.8.23's web filtering (especially auto-blocking of known/suspected malicious sites, C2, and threat-intel feeds) surfaces many spearphishing-link destinations before or during access, but the control is silent on email-level link detection, obfuscated/homograph URLs, consent-phishing OAuth flows, and non-web vectors, leaving a large genuine slice unreached.
- T1566.003prevents — web filtering can block access to known/suspected malicious sites, C2, or phishing content delivered via third-party webmail/social services (per explicit guidance in a/b/c/d), stopping the user from reaching the malicious link/attachment; it does not stop the social-engineering rapport-building phase itself or block unknown/zero-day phishing sites, leaving a genuine minority slice prevented
- T1567detects — A.8.23's web filtering (especially of malicious/C2 sites from threat intel) can surface anomalous or policy-violating use of web services for exfil, but the technique's use of legitimate popular services with pre-existing allow rules and TLS leaves most instances undetected by domain/IP blocking alone.
- T1567prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and threat-intel-derived malicious domains, which can stop some T1567 uses of malicious or C2 web services; however, the technique's core reliance on popular legitimate services (with pre-existing firewall/SSL allowances) is explicitly outside the blocked list and remains reachable.
- T1567.001detects — A.8.23's web filtering (including blocking known malicious sites, C2, and threat-intel feeds) can surface anomalous outbound connections to code-repository APIs when they match a blocked category, but the technique's use of popular legitimate services over HTTPS provides cover that the control's scope and automatic/browser-based mechanisms do not reliably catch.
- T1567.001prevents — A.8.23's web filtering (blocking malicious/C2 domains and upload-function sites) can stop outbound exfil to many code-repo APIs or known-bad repos, but leaves popular legitimate ones (GitHub, GitLab) that adversaries routinely abuse for cover unblocked per the control's own business-reason exception and identification step.
- T1567.002prevents — A.8.23 blocks access to identified malicious, C2, or threat-intel domains/IPs (and upload-capable sites unless business-approved), which can stop exfil to some cloud-storage services when they match those categories, but leaves the bulk of legitimate services (Dropbox, Google Drive, etc.) that adversaries routinely abuse untouched.
- T1567.003detects — A.8.23's web filtering and associated monitoring can surface attempts to reach known malicious or threat-intel-identified text storage sites used for exfil, but many such sites (e.g. pastebin.com) are legitimate developer tools that are not blocked or flagged by default, and the control's scope is limited to web resources rather than all exfil channels.
- T1567.003prevents — A.8.23 explicitly blocks access to malicious websites, C2 servers, and sites acquired from threat intelligence (which includes many pastebin-like text storage sites used for exfil), but does not block all such sites (e.g. legitimate business-permitted upload sites, new/unknown paste services, or encrypted paid tiers), leaving a genuine slice unaddressed.
- T1567.004detects — A.8.23's web filtering and blocking of known/suspected malicious sites, C2 servers, and threat-intel feeds can surface webhook exfil attempts that match those categories, but most webhook exfil blends with normal SaaS/HTTPS traffic to legitimate collaboration services and is not blocked or flagged by the control's defined mechanism.
- T1567.004prevents — A.8.23's web filtering (block known/suspected malicious sites, C2 servers, threat-intel domains) can stop exfil to adversary-controlled webhook endpoints that match those categories, but leaves the bulk of the technique untouched: legitimate SaaS webhook endpoints (Discord/Slack), manual posts to common collaboration services, and blending with normal HTTPS traffic.
- T1568detects — A.8.23's web filtering and blocking of known/suspected C2 domains or IPs (from threat intel) can surface attempts to reach them, but dynamic resolution via algorithms (e.g. DGA) generates fresh, unknown domains that evade static blocklists and detection until after the fact.
- T1568prevents — A.8.23 explicitly blocks known/suspected C2 servers and malicious domains/IPs acquired from threat intel, which stops the malware from reaching many dynamic-resolution C2 points; it does not stop the algorithm itself or resolve-to-new-unknown domains that have not yet been identified as malicious.
- T1568.001detects — A.8.23's web filtering and blocking of known/suspected malicious domains or C2 servers can surface fast-flux resolutions when they match threat intel or blocklists, but the rapid IP churn, double-flux proxies, and lack of mandated DNS-layer monitoring mean it only catches a chosen slice of observable cases rather than the technique broadly.
- T1568.001prevents — A.8.23 explicitly blocks access to command-and-control servers (and malicious sites acquired from threat intel), which directly stops the Fast Flux domain from being resolved and reached; the remainder is that the control is a static block list while the technique's rapid IP churn and double-flux proxies can still evade many deployed filters.
- T1568.002detects — A.8.23's web filtering and malicious-website blocking (including from threat intel) can surface DGA-generated C2 domains when they match known-bad patterns or lists, but the technique's core strength is generating unpredictable, non-static domains that evade static blocklists and prior intel.
- T1568.002prevents — A.8.23 explicitly blocks known/suspected C2 servers and malicious domains acquired from threat intel, which stops some DGA-generated domains once identified; however, the core DGA technique (thousands of unpredictable, time-seeded domains) is designed to evade static blocking, leaving most instances unprevented by the control's mechanism.
- T1568.003detects — web filtering that blocks known/suspected C2 domains or malicious sites (explicitly listed in A.8.23) can surface DNS Calculation attempts when they resolve to those blocked resources, but the core technique of address/port computation itself is not instrumented or reported by the control
- T1568.003prevents — A.8.23 blocks known/suspected C2 domains and IPs (including those from threat intel), which stops the DNS-calculation technique when the resolved address is on a pre-blocked list; it does not stop the calculation itself or use of unlisted/rotating C2 infrastructure.
- T1572detects — web filtering can surface tunneling when it uses blocked domains/IPs (e.g. known C2, malicious sites, or DoH resolvers) but the core technique of protocol encapsulation itself produces no blocked web artifact and is invisible to domain/IP-based filtering
- T1572prevents — A.8.23's web filtering (domain/IP blocks on malicious, C2, or upload sites plus safe-use rules) stops some tunneling vectors such as DoH or access to known-bad C2 domains, but leaves many others (SSH tunneling, custom protocols, non-web C2) untouched.
- T1583.001prevents — A.8.23 blocks access to known/suspected malicious domains (including C2, phishing, malware sites) via web filtering, which stops many post-acquisition uses of adversary domains against the organization; it does not stop the adversary from acquiring/repurposing the domain itself (the named weakness) nor block all possible uses (e.g. internal compromised-environment registration, non-web delivery).
- T1583.002prevents — A.8.23 explicitly blocks access to command-and-control servers and malicious sites acquired from threat intelligence, which directly stops adversaries from reaching their own DNS servers set up for C2 during targeting or post-compromise.
- T1583.004prevents — A.8.23 blocks access to known/suspected malicious websites, C2 servers, and threat-intel-derived malicious domains/IPs, which directly stops personnel or systems from reaching adversary-controlled servers used for C2, phishing, or watering-hole staging; it does not stop the adversary from acquiring or configuring the server itself.
- T1583.008prevents — A.8.23 blocks access to known/suspected malicious websites (including those distributing malware) and command-and-control servers, which directly stops users from reaching the malicious landing pages or domains created via malvertising; it does not stop the adversary from purchasing the ad, nor does it block every possible evasion or zero-day malvertising vector.
- T1584.004prevents — A.8.23 blocks access to known/suspected C2 servers and malicious websites (including those from threat intel), which stops the adversary from using already-compromised third-party servers for C2 or watering-hole staging in the post-compromise phase; this is only a slice of the technique because it does not stop the initial compromise of the server itself nor block unknown/unlisted servers.
- T1588.001prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and malware-distributing resources (including some acquisition vectors), but cannot stop purchase, theft, offline download, or acquisition from non-web sources.
- T1589prevents — Web filtering blocks access to malicious/phishing sites and C2 (a named slice of the technique's online data-set and phishing-for-information vectors), but leaves active scanning, social media, search victim-owned websites, and non-web elicitation untouched.
- T1589.001prevents — A.8.23 blocks access to known/suspected malicious sites (including phishing, C2, and malware distributors) that are a primary vector for credential gathering via T1589.001, but leaves many other collection methods (breach dumps, dark web markets, infostealer logs, search-engine leaks, direct elicitation) untouched.
- T1595.003prevents — A.8.23 blocks access to known/suspected malicious domains, C2 servers, and threat-intel-sourced sites (including those hosting malware or illegal content), which can stop some wordlist-scanning tools from reaching victim infrastructure when those tools rely on blocked hosts; however, it does not block generic crawling of unlisted legitimate sites, custom wordlist generation, or scanning of the organization's own public-facing assets.
- T1598detects — web filtering can detect and block access to known/suspected malicious or phishing sites (including C2) via blocklists or browser advisories, surfacing the technique when a user attempts to follow a phishing link, but does not detect the phishing messages themselves (email/IM/phone/social engineering vectors) or non-web delivery
- T1598prevents — A.8.23 blocks access to known/suspected malicious websites, C2 servers, and phishing-related domains/IPs (via filtering or browser protections), stopping victims from reaching the phishing sites that would elicit information; this covers only the subset of T1598 that relies on web delivery rather than email, IM, phone, or direct messaging vectors.
- T1598.001prevents — A.8.23 blocks access to known/suspected malicious websites, phishing material, and C2 (including via threat intel), which stops users from reaching many spearphishing lures delivered via third-party webmail/social media; it does not stop all such messages (e.g. those arriving in permitted enterprise email or via unblocked services) nor the social-engineering rapport-building that precedes the click.
- T1598.003detects — A.8.23's web filtering (blocking known/suspected malicious domains, phishing sites, C2, and threat-intel feeds) surfaces many spearphishing-link destinations before or during access, but misses obfuscated URLs, BitB, QR/quishing, tracking pixels in email, and any unlisted or novel phishing sites.
- T1598.003prevents — A.8.23 blocks known/suspected malicious domains, C2 servers, and phishing sites (via IP/domain filtering and threat intel), stopping the browser from reaching the credential-harvesting site in the T1598.003 flow; it does not stop the social-engineering email itself, obfuscated/QR links, BitB, or unlisted new phishing domains.
- T1608prevents — A.8.23 blocks access to known/suspected malicious websites, C2 servers, and threat-intel-derived malicious sites (including those staging web resources for drive-by compromise or spearphishing links), directly stopping victim personnel from reaching them; this leaves the adversary's upload/staging act itself on attacker-controlled infrastructure untouched, plus any non-web or unknown staging vectors.
- T1608.004prevents — A.8.23 blocks access to known/suspected malicious sites, C2 servers, and threat-intel-derived domains that adversaries would use to stage drive-by content, stopping the browse from reaching the prepared environment; it does not stop the adversary from acquiring/compromising infrastructure or staging the content itself, nor does it block every possible watering-hole site an organization has not yet identified.
- T1608.005detects — A.8.23's web filtering (blocking known/suspected malicious sites, C2, threat-intel feeds) surfaces many link targets before the click, but misses cloned sites on trusted/PaaS/shortener domains, IPFS, one-time URIs, and masking that the control's own text acknowledges as evasion vectors.
- T1608.005prevents — A.8.23 blocks access to known/suspected malicious domains, C2, phishing sites and upload-capable sites (plus rules and training), which stops many link targets from being reachable and thus prevents the T1608.005 resources from being used in downstream phishing; it does not stop adversaries from staging the resources themselves (especially on trusted shorteners, IPFS, or unlisted domains).
- T1659prevents — web filtering blocks known/suspected malicious sites, C2 domains and threat-intel feeds that would otherwise deliver injected content, but cannot stop upstream ISP-level channel compromises or novel injection that does not rely on a blockable domain/IP
- T1684detects — A.8.23's web filtering and malicious-website blocking (plus associated training on browser advisories) surfaces some social-engineering vectors that rely on users visiting or being lured to known-bad/phishing sites, but the bulk of T1684 occurs over email, voice, help-desk interactions, SaaS consent flows and non-web channels that web filtering never observes.
- T1684prevents — A.8.23 blocks access to known/suspected malicious websites (including phishing and C2) and requires rules/training on safe web use, which stops some social-engineering vectors that rely on users visiting those sites or following malicious links; it leaves the bulk of T1684 untouched (voice, email, help-desk impersonation, non-web channels, and any unlisted or new phishing domains).
- T1684.001detects — web filtering can detect and block access to known/suspected malicious or phishing websites (including C2 or those from threat intel) that deliver impersonation lures, but does not detect the social-engineering impersonation content itself when delivered via email, SMS, or non-web vectors
- T1684.001prevents — web filtering can block access to known/suspected malicious websites, phishing content, C2 servers, or impersonation infrastructure acquired from threat intel, stopping some delivery vectors that rely on victims visiting those resources
Prevented OWASP Web Top 10 (2025) risks (6)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01mitigates — web filtering can bound the consequence of some realized access-control failures (e.g. blocking C2 or exfiltration domains reached via SSRF or command injection) but does not limit the impact of the category's dominant members such as IDOR, missing authorization checks, CSRF or path traversal inside the application
- A02mitigates — Web filtering bounds the consequence of a realized misconfiguration (e.g. by blocking access to malicious C2, phishing, or malware sites that an exposed surface would otherwise reach), but does not address the weakness of weak defaults, incomplete hardening, or exposed attack surface itself.
- A05mitigates — Web filtering can bound the consequence of realized injection (e.g. blocking outbound C2 from successful command injection or SSRF) but does not limit the in-band impact of the dominant members (SQLi, XSS) that stay inside permitted channels.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.