A.8.3 Technological
Information access restriction
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (32)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-3fullcovers — Both controls require the system to enforce access decisions that limit what subjects can do to objects based on policy-defined rules and attributes.
- AC-16mostlyaligns with — Dynamic access management in the ISO guidance relies on security and privacy attributes (identity, device, location, classification) to drive real-time enforcement decisions.
- AC-2mostlycovers — A.8.3's requirement to restrict access to authorized users and assets is largely met by ac-2's detailed account provisioning, role/group membership, privilege specification and approval workflow; a residual of ac-2's account-type definition and manager-assignment obligations sits outside A.8.3's focus on enforcement.
- AC-6mostlyaligns with — The ISO control’s emphasis on granting only the specific permissions (read, write, delete, execute) needed for each identity or group directly supports the principle of least privilege.
- AC-6mostlycovers — A.8.3's requirement to restrict access to only what is authorized and prevent unauthorized access accounts for the bulk of AC-6's least-privilege mandate, but a real residual remains because AC-6 explicitly requires the finer-grained 'necessary to accomplish assigned tasks' analysis that A.8.3 does not mandate.
- AC-17partialaligns with — The ISO control’s rules for external or remote users and the use of dynamic techniques to restrict access outside the organization align with remote-access policy enforcement.
- AC-2partialaligns with — Managing which identities or groups receive which permissions is an integral part of account and privilege provisioning covered by account management.
- AC-4partialaligns with — The requirement to isolate sensitive applications and data and to control information flows between subjects and objects overlaps with information-flow-enforcement objectives.
- AC-17covers — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- AC-4covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Aligned NIST CSF 2.0 outcomes (17)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-05fullcovers — The ISO control's core requirement to define, enforce, and review access permissions and entitlements directly fulfills the CSF outcome of managing authorizations according to policy.
- PR.AA-01mostlyaligns with — By requiring authenticated identities and prohibiting anonymous access to sensitive information, the control supports the CSF outcome of managing identities and credentials for authorized users and services.
- PR.AA-03mostlyaligns with — The control's emphasis on authentication, credentials, and certificates before granting access aligns with the CSF outcome of authenticating users, services, and hardware.
- PR.AA-06partialaligns with — The control's call for physical or logical access controls to isolate sensitive systems and data partially addresses the CSF outcome of managing and monitoring physical access commensurate with risk.
- PR.DS-01partialaligns with — Dynamic access management techniques that use encryption and restrict printing or copying help protect the confidentiality and integrity of data-at-rest.
- PR.DS-02partialaligns with — Dynamic controls that enforce time-bound access and encryption during transmission contribute to protecting data-in-transit.
- PR.AA-01implements — A.8.3's operational mechanism of restricting access to only authorized identities directly operationalizes the management of those identities/credentials required by PR.AA-01 within the access-control domain
- PR.AA-03implements — A.8.3 directly operationalizes authentication of users/services/hardware as the core mechanism to enforce authorized access and prevent unauthorized access, matching PR.AA-03 exactly
- PR.AA-06implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.DS-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.DS-02implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Related OWASP ASVS 5.0 requirements (14)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V8.2.1mostlycovers — The ISO control's requirement to restrict function-level access according to established policies directly implements the ASVS mandate that applications enforce function-level authorization based on explicit consumer permissions.
- V8.2.2mostlycovers — By controlling which data items a given user or identity may access, the ISO guidance aligns with the ASVS requirement that applications restrict data-specific access to only those consumers holding explicit permissions for those items.
- V8.3.1mostlycovers — Requiring that access decisions be enforced through trusted configuration mechanisms and service-layer controls matches the ASVS rule that authorization must be performed at a trusted service layer rather than relying on untrusted client-side enforcement.
- V6.3.3partialaligns with — The ISO insistence that unknown or anonymous identities must not access sensitive information aligns with the ASVS requirement that sensitive operations be protected by multi-factor or combined single-factor authentication mechanisms.
- V8.2.3partialaligns with — The ISO emphasis on controlling read, write, delete and execute rights for identities or groups maps to the ASVS expectation that field-level access is limited to consumers with explicit permissions on those fields.
- V8.4.1partialaligns with — The ISO directive to isolate sensitive applications and data through physical or logical controls supports the ASVS requirement that multi-tenant applications implement cross-tenant controls to prevent one tenant from affecting others.
Related weaknesses / CWE (299)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1057←PCWE-1083←PCWE-1191←PCWE-1220←M →MCWE-1230←P →MCWE-1231←PCWE-1244←PCWE-1256←PCWE-1257←PCWE-1259←P →MCWE-1262←PCWE-1268←P →PCWE-1272←PCWE-1274←PCWE-1280←P →PCWE-1299←PCWE-1323←P →MCWE-15←P →MCWE-178←PCWE-200→MCWE-202←P →MCWE-213←PCWE-214←PCWE-219←PCWE-22←PCWE-266←P →PCWE-268←P →MCWE-269→MCWE-270←P →PCWE-274←P →MCWE-277←PCWE-278←P →PCWE-279←PCWE-28←PCWE-280←PCWE-281←PCWE-282←PCWE-283←PCWE-284→MCWE-285→MCWE-288←P →MCWE-289←P →PCWE-290←PCWE-291←P →PCWE-302←PCWE-304←PCWE-305←PCWE-308←PCWE-317←PCWE-32→PCWE-359→MCWE-378→PCWE-40←PCWE-402←P →MCWE-408←P →MCWE-412←PCWE-419←P →MCWE-420→MCWE-421→PCWE-424←P →MCWE-425←M →MCWE-441←PCWE-471←PCWE-488←PCWE-520←PCWE-524←P →MCWE-527←P →MCWE-528←P →MCWE-529←P →MCWE-530←P →MCWE-548←P →MCWE-551←PCWE-552→MCWE-556←PCWE-564←PCWE-566←P →MCWE-57←P →PCWE-602→MCWE-603←PCWE-61←PCWE-612←P →MCWE-62←PCWE-638←P →MCWE-639←P →MCWE-64→PCWE-642←P →MCWE-647←P →PCWE-65←P →MCWE-653←PCWE-654←P →PCWE-669←PCWE-671←PCWE-673←PCWE-689←P →PCWE-69←PCWE-706←PCWE-708←P →PCWE-732→MCWE-749←P →MCWE-767←PCWE-782←P →MCWE-784←P →MCWE-807→MCWE-837←PCWE-842→PCWE-862→MCWE-863→MCWE-921←P →MCWE-926←P →MCWE-939←P →M
Why these map — AI rationale (under review)
- CWE-1220blocks — Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.
- CWE-1220removes — A.8.3 mandates configuration mechanisms, per-user/group rights, isolation, and dynamic access management that directly supply the missing granularity for this weakness; well-implemented, the flaw (over-broad policy) stops being present in the product, with only a bounded remainder (e.g. certain physical or non-dynamic edge cases) left over.
- CWE-1230blocks — A.8.3's core (access restriction per policies, per-user/group rights, isolation of sensitive data/apps, dynamic techniques that restrict/encrypt/monitor) directly stops exploitation of metadata-derived exposure by enforcing that derived metadata is treated as sensitive and access-controlled; the bounded remainder is metadata that is not access-controlled at all (e.g. public headers or side-channels outside any policy).
- CWE-1257blocks — Enforcing information access restrictions on memory-mapped regions directly mitigates inconsistent alias permissions.
- CWE-1257removes — A.8.3 restricts and enforces access to information and assets per policy (including isolation, dynamic techniques, and credentials); it does not remove or alter the inconsistent read/write permissions on aliased/mirrored memory regions that define CWE-1257
- CWE-1259blocks — Information access restriction directly limits which entities can obtain or use security tokens.
- CWE-1262blocks — Information access restriction explicitly limits software access to memory-mapped register interfaces.
- CWE-1262removes — A.8.3 restricts logical and dynamic access to information/assets per policies (including registers via config/isolation/credentials), but does not remove the improper access control flaw from the hardware interface design itself; the weakness remains present in the product.
- CWE-1268blocks — Implements technical restrictions on information access that can prevent inconsistent privilege enforcement.
- CWE-1274blocks — Information access restriction directly addresses unauthorized access to volatile memory holding boot code.
- CWE-1274removes — A.8.3 restricts access to information and assets via policies, configuration, authentication, encryption and dynamic controls; it does not remove the specific boot-process design flaw of insufficient VM protections after NVM-to-VM transfer, which is a first-party code/hardware defect outside its locus and mechanism.
- CWE-1280blocks — Enforces access restrictions before asset use, directly addressing the timing flaw.
- CWE-1299blocks — Information access restriction mandates controls on every path to protected assets, mitigating bypass via shadow or external interfaces.
- CWE-1317removes — A.8.3 restricts access to already-produced information and assets per policy; it does not remove the improper access-control check that the fabric bridge is missing from the product design or implementation.
- CWE-1323blocks — Technical access restrictions directly prevent unauthorized access to trace storage.
- CWE-15blocks — A.8.3's access restriction mechanisms (config controls, identity/group rights, isolation, dynamic management) directly stop external configuration tampering from being exploited in most cases, with a bounded remainder in non-access-control configuration vectors such as environment variables or build-time settings.
- CWE-200blocks — Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.
- CWE-202blocks — A.8.3's access restriction mechanisms (config, per-user/group rights, isolation, dynamic techniques with auth/encryption/time-bound rules/alerts) directly stop statistical inference attacks on queries by enforcing who can query what and how, covering the dominant cases; the bounded remainder is non-query channels (e.g. side-channel timing or pure physical emanations) outside its logical-access scope.
- CWE-266blocks — Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.
- CWE-268blocks — A.8.3 directly restricts access by identities/groups/roles (b,c,d,e), dynamic techniques, and isolation, which stops most unsafe privilege combinations from being exploitable; the bounded remainder is chaining that occurs inside an already-authorized session or via non-access mechanisms such as code-level rights escalation.
- CWE-269blocks — A.8.3 directly restricts access per policies (config mechanisms, per-user/group rights, isolation, dynamic techniques, auth/credential enforcement), which stops exploitation of most improper privilege management cases even if the assignment/tracking flaw remains; named remainder exists for non-access-control privilege errors (e.g. pure assignment bugs outside enforcement).
- CWE-270blocks — Information-access-restriction rules help limit privileges but do not cover dynamic switching errors.
- CWE-273removes — A.8.3 restricts access to information/assets via policies, configuration, dynamic management, authentication, encryption etc.; it never mandates or performs the specific check for successful privilege drop that CWE-273 names, nor does it remove that first-party code defect from the product.
- CWE-274blocks — Information-access-restriction mechanisms enforce least-privilege checks that mitigate the weakness at runtime.
- CWE-278blocks — Information access restriction mechanisms can enforce least-privilege checks during object creation or archive extraction.
- CWE-284blocks — A.8.3 directly mandates and configures the access restriction mechanisms (configuration, per-user/group rights, isolation, dynamic techniques) that enforce authorized access and stop exploitation of improper access control; the bounded remainder is non-access-decision exposures such as CWE-209 error messages or CWE-215 debug info (per the A.8.3 vs CWE-200 anchor).
- CWE-285blocks — A.8.3 directly mandates and configures the authorization mechanisms (identity/group rights, dynamic access rules, isolation, credential enforcement) that stop CWE-285 exploitation; the bounded remainder is non-authorization exposure vectors such as error messages or observable discrepancies.
- CWE-288blocks — A.8.3's core (access restriction per policies, config mechanisms, identity/group controls, isolation, dynamic techniques requiring auth/credentials) directly stops exploitation of alternate unauthenticated paths for most instances; the bounded remainder is non-access-channel cases (e.g. pure logic errors in alternate-path checks) or pre-auth bypasses outside its enforcement scope.
- CWE-289blocks — Information-access-restriction mechanisms can implement canonical-name checks to prevent bypass.
- CWE-290blocks — Information access restriction relies on proper authentication but does not implement it.
- CWE-291blocks — Information-access-restriction mechanisms must authenticate subjects before granting access.
- CWE-32blocks — Information-access-restriction policies limit which files can be reached, mitigating impact but not the traversal vector itself.
- CWE-378blocks — Information access restriction can limit exposure but does not address file creation itself.
- CWE-402blocks — A.8.3's core (access restriction per policies, per-user/group rights, isolation, dynamic techniques, authentication, time-bound access, encryption, monitoring, alerts) directly stops untrusted parties from exploiting leaked private resources in most transmission scenarios; the bounded remainder is cases where the leak is not an access-control decision at all (e.g. the resource is deliberately public but still contains unintended private data).
- CWE-408blocks — A.8.3's access restriction mechanisms (pre-authz enforcement, identity/group controls, isolation, dynamic techniques) stop early amplification from being exploitable in the great majority of cases; the bounded remainder is amplification that occurs entirely before any access decision point (e.g. unauthenticated protocol-level resource exhaustion).
- CWE-419blocks — A.8.3's core (access restriction per policies, config mechanisms, identity/group controls, isolation, dynamic management, auth requirements, time-bound/encryption/print restrictions) directly stops exploitation of an unprotected admin/restricted channel in the vast majority of cases; the bounded remainder is non-access-channel exposures (e.g. purely physical or non-identity-based primary channels outside its named scope).
- CWE-420blocks — A.8.3's core (access restriction per policies, config mechanisms, identity/group controls, isolation, dynamic techniques with auth/encryption/time-bound rules) stops exploitation of unprotected alternate channels in the dominant case of differing logical protections; the bounded remainder is physical alternate channels (explicitly scoped to PE family in analogous 800-53 anchors) plus fully external channels outside any managed system/app/service.
- CWE-421blocks — A.8.3's access restriction mechanisms (config, identity/group controls, isolation, dynamic techniques) can stop exploitation of the alternate channel for many cases, but the race condition itself is a timing/concurrency flaw in channel management that is not prevented by access rules alone (remainder includes flawed alternate-channel logic that still races regardless of configured restrictions).
- CWE-424blocks — A.8.3 directly restricts access (config mechanisms, per-user/group rights, isolation, dynamic techniques) on all paths to restricted resources, stopping exploitation of alternate paths; the bounded remainder is non-access-control paths such as those relying on improper neutralization or error-message leakage.
- CWE-425blocks — Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.
- CWE-497prevents — created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).
- CWE-524blocks — A.8.3's access restriction mechanisms (config controls, per-user/group rights, isolation, dynamic techniques with auth/encryption/time-bound rules, monitoring, and alerts) directly stop external actors from reading the sensitive cache in most cases, but a bounded remainder exists for caches that are not treated as 'information' under the access policy (e.g., transient in-memory structures or non-file/application data outside the clause's explicit scope).
- CWE-527blocks — A.8.3's core (access restriction per policies, per-user/group rights, isolation, dynamic techniques, auth/credential enforcement) directly stops unauthorized actors from reaching the exposed repo; the bounded remainder is misconfigurations where the repo is placed in a public/anonymous location that the clause itself forbids but does not technically block without additional enforcement layers.
- CWE-528blocks — A.8.3's access restriction mechanisms (config controls, identity/group rights, isolation, dynamic management, authentication requirements) directly stop unauthorized actors from reaching or exploiting a core dump containing sensitive data; the bounded remainder is core dumps whose exposure is not an access-control decision at all (e.g. via error messages or observable discrepancies).
- CWE-529blocks — A.8.3 directly restricts access to ACL files per its guidance on controlling identities/groups/permissions, isolating sensitive data, and dynamic techniques, preventing exploitation in most cases; the bounded remainder is misconfigurations where the ACL itself is stored with overly permissive defaults that the restriction mechanisms do not override.
- CWE-530blocks — A.8.3 directly restricts access to backup files per its guidance on controlling identities/groups, data access, isolation, and dynamic techniques, preventing unauthorized exploitation in most cases; the bounded remainder is backups outside any managed access control sphere (e.g. offline media or unmanaged locations).
- CWE-548blocks — A.8.3's core (restricting access per policies via config, per-user/group rights, isolation, dynamic techniques, auth requirements, time-bound restrictions, encryption) directly stops exploitation of exposed directory listings by enforcing authorization on the directory and its contents; the bounded remainder is listings that surface non-sensitive or non-access-controlled resources (e.g. purely public static files with no sensitive exposure).
- CWE-566blocks — A.8.3 directly restricts access per policies via config mechanisms, per-user/group rights, isolation, dynamic techniques, auth requirements, time-bound restrictions, and encryption — squarely blocking exploitation of a user-controlled primary key that would otherwise allow unauthorized record access; the bounded remainder is non-access-control slices of CWE-566 such as flawed key generation logic itself.
- CWE-57blocks — Enforces access-control rules on files and directories, directly blocking unauthorized path traversal.
- CWE-602blocks — Information access restriction is undermined when the client is trusted to enforce it.
- CWE-612blocks — A.8.3 directly restricts index access via configuration mechanisms, per-user/group rights, isolation, dynamic techniques, authentication and encryption, preventing exploitation for the dominant authorization slice of CWE-612; the bounded remainder is flawed index-generation logic itself (e.g. over-inclusion of sensitive docs before any access control is applied).
- CWE-638blocks — A.8.3 directly mandates access restriction mechanisms (configuration, per-user/group rights, isolation, dynamic management, authentication, time-bound access, encryption) that enforce complete mediation on every access; the bounded remainder is that it cannot reach mediation defects already baked into application logic that bypasses those mechanisms entirely.
- CWE-639blocks — Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
- CWE-64blocks — Information access restriction can limit the impact of unauthorized file operations triggered by malicious shortcuts.
- CWE-642blocks — A.8.3 directly restricts access to critical state data per policies, identities, dynamic techniques, isolation and encryption, stopping most unauthorized exploitation while named residuals (e.g. external-control via unconsidered channels or misconfigured dynamic rules) remain
- CWE-647blocks — Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.
- CWE-65blocks — Access-control rules can restrict which files a process may open, limiting the impact of hard-link redirection.
- CWE-654blocks — Information access restriction can require multi-factor checks, yet the control is wider than authentication.
- CWE-689blocks — Enforces access restrictions on resources, reducing exposure during copy operations.
- CWE-708blocks — Information-access-restriction mechanisms rely on correct ownership; eliminating incorrect ownership strengthens this control.
- CWE-732blocks — Requiring explicit configuration of access controls and permissions for files, applications and services counters the assignment of overly permissive default or incorrect file-system rights.
- CWE-749blocks — A.8.3's access restriction mechanisms (config controls, identity/group rights, isolation, dynamic management, auth/credential enforcement) directly stop external actors from calling the exposed dangerous method; remainder is nameable cases where the dangerous function is reachable without crossing an access decision at all (e.g. same-process trusted caller).
- CWE-782blocks — A.8.3 directly restricts access to IOCTL functionality per its guidance on controlling identities/groups/permissions (read/write/execute), isolating sensitive applications/data, and dynamic techniques that enforce authentication/credentials/time-bound access, so the improper access control weakness remains but cannot be exploited in most cases; the bounded remainder is non-standard IOCTL paths or physical/kernel interfaces outside the clause's system/application focus.
- CWE-784blocks — Information access restriction requires proper validation of identity tokens before granting access.
- CWE-807blocks — A.8.3's core (access restriction per policies, identity/group controls, isolation, dynamic techniques with auth/encryption/time-bound rules) directly stops untrusted inputs from influencing security decisions for most instances of CWE-807; the bounded remainder is cases where the decision uses an input outside any access control point (e.g. purely client-side or pre-enforcement computation).
- CWE-842blocks — Information access restriction is enforced via groups, but the control addresses restriction mechanisms, not membership correctness.
- CWE-862blocks — A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce authorization decisions, which squarely stops exploitation of missing authorization (CWE-862); the bounded remainder is non-access mechanisms such as path traversal or CSRF that are outside its scope per the AC-3/A01:2025 anchor.
- CWE-863blocks — A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce correct authorization decisions, addressing most but not all slices of CWE-863 (e.g., remainder in non-access-decision authorization errors like timing or environmental factors).
- CWE-915blocks — Information access restriction limits who can modify objects but does not address which attributes may be changed.
- CWE-921blocks — A.8.3 directly restricts access to stored sensitive information via configuration, per-user/group rights, isolation, and dynamic techniques (including encryption and monitoring), preventing exploitation of unprotected storage in most cases; the bounded remainder is storage mechanisms lacking any enforceable access control surface at all (e.g. purely physical media with no logical interface).
- CWE-926blocks — Enforcing information-access restrictions on exported Android components directly prevents unauthorized launch or data access.
- CWE-939blocks — Enforces explicit authorization checks on which actors may invoke handlers, directly addressing the missing restriction on custom-URL-scheme access.
Mitigated MITRE ATT&CK techniques (1596)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
T1001←M →PT1001.001←MT1001.002←M →PT1001.003←M →PT1003→PT1003.001←M →PT1003.002←M →PT1003.003→PT1003.004←M →MT1003.005←M →PT1003.006→PT1003.007←M →PT1003.008→MT1005←M →MT1006←M →PT1008←M →PT1011←M →PT1011.001←M →PT1012→PT1014←MT1016→PT1016.002→PT1020←M →PT1020.001←M →PT1021→PT1021.001→MT1021.002←M →PT1021.003←P →MT1021.004→MT1021.005→PT1021.006→PT1021.007→PT1021.008→MT1025→PT1027.001←MT1027.002←MT1027.003←M →PT1027.005←MT1027.006←M →PT1027.007←MT1027.008←MT1027.009←M →PT1027.010←MT1027.011←M →PT1027.012←M →PT1027.013←MT1027.014←MT1027.016←MT1027.017←M →PT1027.018←MT1029←M →PT1030←M →PT1033→PT1036←MT1036.001→PT1036.002←MT1036.003←M →PT1036.004←M →PT1036.005←MT1036.006←MT1036.007←MT1036.008←M →PT1036.009←M →PT1036.010←MT1036.011←M →PT1036.012←MT1037←M →PT1037.001←P →PT1037.002←P →PT1037.003←P →PT1037.004→PT1037.005→PT1039←M →MT1040→PT1041←M →PT1046→PT1047←M →PT1048←M →PT1048.001→PT1048.002←M →PT1048.003←M →PT1049→PT1052←M →PT1052.001←M →PT1053←P →PT1053.002←M →PT1053.003←M →PT1053.005←M →PT1053.006→PT1053.007→PT1055←M →PT1055.001←M →PT1055.002←M →PT1055.003←M →PT1055.004←M →PT1055.005←M →PT1055.008←M →PT1055.009←M →PT1055.011←M →PT1055.012←M →PT1055.013←M →PT1055.014←M →PT1055.015←M →PT1056←M →PT1056.001←M →PT1056.002←M →PT1056.003←M →PT1056.004←M →PT1057→PT1059←M →PT1059.001→PT1059.002→PT1059.003←M →PT1059.004→PT1059.006→PT1059.007→PT1059.008←M →PT1059.009←M →PT1059.011→PT1059.012→PT1059.013←P →PT1068←M →PT1069→PT1069.001→PT1069.002→PT1069.003→PT1070←MT1070.003←M →PT1070.004→PT1070.005→PT1070.006←M →PT1070.008←M →PT1070.009→PT1070.010←MT1071←M →PT1071.001←M →PT1071.002←M →PT1071.003←M →PT1071.004←M →PT1071.005←M →PT1072←M →PT1074←M →PT1074.001→PT1074.002←M →PT1078→PT1078.001→PT1078.002→MT1078.003→PT1078.004→MT1080←M →PT1082→PT1083←M →PT1087→PT1087.001→PT1087.002→PT1087.003→PT1087.004→PT1090←MT1090.001←M →PT1090.002←M →PT1090.003←MT1090.004←MT1091←M →PT1092→PT1095←M →PT1098←M →PT1098.001←M →PT1098.002→PT1098.003→PT1098.004←M →PT1098.005→PT1098.006←M →PT1098.007←P →PT1102←M →PT1102.001←M →PT1102.002←M →PT1102.003←M →PT1104←MT1105←P →PT1106←MT1110→MT1110.001→MT1110.002→MT1110.003→MT1110.004→MT1111→PT1112←M →PT1113→PT1114←P →PT1114.001←M →PT1114.002←M →MT1114.003←M →PT1115→PT1119←M →PT1120→PT1123→PT1125→PT1127←M →PT1127.001←M →PT1127.002←M →PT1127.003←M →PT1129→PT1132←MT1132.001←MT1132.002←MT1133→PT1134→PT1134.001→PT1134.002→PT1134.003→PT1134.004←MT1134.005←M →PT1135→PT1136←P →PT1136.001←P →PT1136.002←P →PT1136.003←M →PT1137→PT1137.001→PT1137.002→PT1137.003→PT1137.004→PT1137.005→PT1137.006→PT1140←MT1176←M →PT1176.001←M →PT1176.002→PT1185→PT1187→PT1189←M →PT1190←M →PT1197→PT1199←M →PT1200←MT1202←M →PT1203←MT1204←M →PT1204.001←M →PT1204.002←M →PT1204.003←M →PT1204.004←M →PT1204.005←MT1205←M →PT1205.001←M →PT1205.002←M →PT1207←M →PT1210←M →PT1211←MT1212→PT1213→PT1213.001←M →MT1213.002→MT1213.003→MT1213.004←M →MT1213.005←M →PT1213.006←M →MT1216←M →PT1216.001←M →PT1216.002←M →PT1217←M →PT1218←M →PT1218.001←M →PT1218.002←M →PT1218.003←M →PT1218.004←M →PT1218.005←M →PT1218.007←M →PT1218.008←M →PT1218.009←M →PT1218.010←M →PT1218.011←M →PT1218.012←M →PT1218.013←M →PT1218.014→PT1218.015→PT1219←M →PT1219.001←M →PT1219.002←M →PT1219.003←M →PT1220←M →PT1221←M →PT1222←M →PT1222.001←M →PT1222.002←M →PT1480←MT1480.001←MT1484←M →PT1484.001←M →PT1484.002→PT1485→PT1485.001←M →PT1486→MT1489←P →PT1490←M →MT1491→PT1491.001→PT1491.002→PT1496→PT1496.001→PT1496.002→PT1496.003→PT1496.004←M →PT1497←MT1497.002←PT1498.001→PT1499←FT1499.001←PT1499.002←P →PT1499.003→PT1505←M →PT1505.001→PT1505.002→PT1505.003←M →PT1505.004→PT1505.005←M →PT1525→PT1526→PT1528→PT1529←P →PT1530→PT1531←M →PT1534←M →PT1535←MT1537←M →PT1538→MT1539→PT1542←MT1542.002←M →PT1542.003←M →PT1542.005←M →PT1543→PT1543.001←M →PT1543.002←P →PT1543.003←M →PT1543.004→PT1543.005←P →PT1546←M →PT1546.001←M →PT1546.002→PT1546.003→PT1546.004←P →PT1546.005→PT1546.006→PT1546.007→PT1546.008←M →PT1546.009→PT1546.010→PT1546.011←M →PT1546.012←M →PT1546.013→PT1546.015→PT1546.016→PT1546.017→PT1546.018→PT1547←P →PT1547.001←M →PT1547.002→PT1547.003→PT1547.004←M →PT1547.005←M →PT1547.006←M →PT1547.007→PT1547.008←M →PT1547.009→PT1547.010→PT1547.012←M →PT1547.013→PT1547.014→PT1547.015→PT1548←M →MT1548.001←M →PT1548.002←M →PT1548.003←M →PT1548.004←M →PT1548.005←M →PT1548.006←M →PT1550→PT1550.001→PT1550.002→PT1550.003→PT1550.004→PT1552←M →MT1552.001→PT1552.002←M →PT1552.003→PT1552.004←M →PT1552.005→PT1552.006→PT1552.007←M →PT1552.008←M →PT1553←MT1553.001←M →PT1553.002←M →PT1553.003←M →PT1553.004←M →PT1553.005←M →PT1553.006←M →PT1554←P →PT1555←M →MT1555.001→PT1555.002←M →PT1555.003←M →PT1555.004←M →PT1555.005←M →PT1555.006→PT1556→PT1556.001→PT1556.002←P →PT1556.003→PT1556.004←FT1556.005←M →PT1556.006→PT1556.007→PT1556.008←M →PT1556.009→PT1557←M →PT1557.001←M →PT1557.002←M →PT1557.003←M →PT1557.004←M →PT1558←M →PT1558.001→PT1558.002→PT1558.003←M →PT1558.004←P →PT1558.005←M →PT1559→PT1559.001→PT1559.002→PT1559.003←P →PT1560←P →PT1560.002→PT1560.003→PT1561←M →PT1561.001→PT1561.002→MT1563→PT1563.001→PT1563.002←M →PT1564→PT1564.002→PT1564.004←M →PT1564.005→PT1564.006→PT1564.008→PT1564.009→PT1564.010→PT1564.012→PT1564.014→PT1565→PT1565.001→MT1565.002←P →PT1565.003→PT1566→PT1566.001→PT1566.002←M →PT1566.003←M →PT1566.004←M →PT1567→PT1567.001←M →PT1567.002←M →PT1567.003←M →PT1567.004←M →PT1568←MT1568.002←MT1568.003←M →PT1569→PT1569.001→PT1569.002→PT1569.003→PT1570←P →PT1571←M →PT1572←M →PT1573←M →PT1573.001←MT1574←M →PT1574.001←M →PT1574.004←M →PT1574.005←M →PT1574.006←M →PT1574.007←M →PT1574.008←M →PT1574.009←P →PT1574.010←M →MT1574.011←M →MT1574.012←P →PT1574.013←M →PT1574.014→PT1578←M →PT1578.001←M →PT1578.002←M →PT1578.003←M →PT1578.004←M →PT1578.005←M →PT1580←M →PT1583.007←MT1584←MT1584.001←MT1584.006←MT1584.007←MT1585←MT1585.003←MT1586←M →PT1586.002←MT1586.003←M →PT1587.001←MT1588.004←PT1588.005←MT1589→PT1589.001→PT1593.003←MT1594←MT1595.003←M →PT1597.001→PT1598←MT1598.001←MT1598.002←MT1598.003←MT1599←M →PT1599.001←M →PT1600←MT1600.001←PT1600.002←PT1601←P →PT1601.001←M →PT1601.002←MT1602←M →PT1602.001→PT1602.002→MT1606←M →PT1606.001→PT1606.002←M →PT1608.004←MT1608.005←MT1609←P →PT1610←P →PT1611←M →PT1612←M →PT1613→PT1615→PT1619→MT1620←M →PT1621→PT1622←MT1647←M →PT1648←P →PT1649→PT1650←MT1651←M →PT1653←PT1654←P →PT1657→PT1659←P →PT1666←M →PT1667→PT1668←PT1669←M →PT1671←M →PT1673→PT1674←PT1675→PT1677→PT1678←MT1679←P →PT1684←MT1684.001←P →PT1684.002←M →PT1685←M →PT1685.001←M →PT1685.002←M →PT1685.003←MT1685.004←M →PT1685.005←M →PT1685.006←MT1686←F →PT1686.001←M →PT1686.002←M →PT1686.003←M →PT1687←MT1688←MT1689←MT1690←M →P
Why these map — AI rationale (under review)
- T1001detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access, and raising alerts on misuse attempts, which surfaces anomalous/obfuscated C2 traffic when it touches protected information assets; this is a genuine but minority slice of the broad technique (most T1001 variants occur in non-sensitive channels or pre-access).
- T1001.002detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface steganographic C2 hidden in files or traffic when those are part of monitored information flows or dynamic access controls.
- T1001.003detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces impersonation attempts that misuse or mimic legitimate protocols/services for C2; this is a genuine but minority slice of the technique (most impersonation blends passively without triggering access controls or dynamic management).
- T1003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface credential-dumping activity when it touches protected information or violates dynamic rules; this is a genuine but minority slice of the broad technique that also operates against unmonitored memory caches, structures, or non-sensitive OS artifacts.
- T1003prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, encryption, isolation of sensitive data, and monitoring) stops many common paths to credential dumping from OS caches/memory but leaves residual techniques such as in-memory extraction from already-authenticated processes or physical access that the clause does not fully close.
- T1003.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface LSASS access or dumping in real time or post-facto; this is only a slice because the clause is scoped to organizationally-defined high-value information and chosen dynamic-access techniques rather than mandating broad LSASS-specific detection.
- T1003.001prevents — A.8.3's access-restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation of sensitive data, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) directly stop many LSASS credential-harvesting vectors, but leave a bounded remainder: admin/SYSTEM-level in-memory reads, SSP DLL injection at boot, and registry modifications that bypass the restrictions when the adversary already holds sufficient privilege.
- T1003.002detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces in-memory/registry credential extraction attempts when they target high-value/SAM-classified data under dynamic access management; this is only a slice of the technique (not all SAM access is monitored or classified as high-value).
- T1003.002prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can stop SYSTEM-level enumeration and extraction of the SAM in many configurations, but the class remains reachable via unaddressed vectors such as privileged processes, misconfigured services, or post-compromise execution that the clause does not universally block.
- T1003.003detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces the technique when it triggers those controls (e.g. on the NTDS file or backups), but only for implementations that actually instrument the relevant assets rather than the bulk of the class.
- T1003.003prevents — A.8.3's access restriction rules, configuration mechanisms, physical/logical isolation, dynamic access controls, authentication requirements, time-bound restrictions, and encryption directly block many listed methods (e.g. anonymous/unauthorized reads of NTDS.dit, backups, or shares), but leave a genuine minority slice (e.g. privileged admin access on a live DC, or post-compromise use of ntdsutil.exe) unreached.
- T1003.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface LSA secrets access in real time or logs; this is only a slice because the clause is scoped to organization-chosen sensitive information and dynamic techniques rather than mandating broad SYSTEM-level credential-access detection.
- T1003.004prevents — A.8.3 directly restricts access to sensitive credential material (including via registry, memory, and dynamic techniques) per policy, preventing the T1003.004 technique from succeeding for authorized identities only; physical/logical isolation and credential requirements close most paths, with the bounded remainder being post-compromise SYSTEM-level bypasses of the policy itself.
- T1003.005detects — A.8.3 explicitly lists raising alerts on detected misuse of protected information plus operational monitoring/reporting processes, which surfaces attempts to access or dump cached credential stores when those stores are treated as sensitive; this is a genuine but minority slice of the technique because the control's scope is limited to information the organization has already classified and wrapped in dynamic access management rather than all cached credential locations or all extraction tools.
- T1003.005prevents — A.8.3's access restriction rules, authentication requirements, dynamic controls, and encryption directly stop many paths to reading the credential caches (especially on Linux and where dynamic/encrypted protection is applied), but the technique still succeeds with SYSTEM/sudo on Windows where the hashes are present and extractable by design.
- T1003.006detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface DCSync replication abuse when it occurs against protected AD data; partial because the control is scoped to organization-chosen sensitive information and dynamic techniques rather than mandating broad detection of all DCSync instances.
- T1003.006prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, time-bound restrictions, and dynamic management based on identity/device/location directly constrain who can invoke DCSync replication rights on a domain controller, but do not eliminate the underlying privileged-group membership model or all legacy protocol paths that enable the technique.
- T1003.007detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces credential-gathering attempts from /proc when dynamic access management or monitoring is applied to sensitive credential data; this is only a slice of the technique (e.g., not all /proc reads or non-protected memory patterns).
- T1003.007prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, physical/logical isolation of sensitive apps/data, and dynamic techniques like auth/encryption/time-bound access) stops many unauthenticated or unauthorized reads of /proc/<PID>/mem and credential patterns, but leaves a bounded remainder where the adversary already holds sufficient process or root privileges that the control's mechanisms do not block.
- T1003.008detects — A.8.3 explicitly lists raising alerts on misuse attempts and recording access/use as part of dynamic access management, which would surface the technique when it runs against protected files; this is only a slice of the control's broader access-restriction purpose and does not cover non-dynamic or non-monitored cases.
- T1003.008prevents — A.8.3 directly restricts access to files like /etc/shadow (readable only by root by default) via policy-driven logical/physical controls, identity/group permissions, configuration mechanisms, and dynamic techniques that block unauthorized reads throughout the data lifecycle.
- T1005detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces the T1005 search activity when it touches protected assets; this is only a slice because the control is scoped to high-value/sensitive information under dynamic access management rather than all local-system data gathering.
- T1005prevents — A.8.3's access restriction mechanisms (including dynamic ones with auth, encryption, time-bound rules, monitoring/alerts, and isolation of sensitive data) directly stop adversaries from successfully searching and gathering files of interest on local systems, though some residual paths remain via already-authenticated sessions or non-sensitive locations.
- T1006detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface T1006-style direct volume access when it involves sensitive data under dynamic management; this is only a slice of the technique (not all volumes or non-sensitive data are covered, and the control is not a dedicated detection mechanism).
- T1006prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) directly constrain the ability to obtain and abuse direct volume handles that bypass file-level ACLs, but the control is silent on raw device/volume permissions, shadow-copy utilities, and non-Windows platforms, leaving a genuine minority slice unaddressed.
- T1008detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access, and raising alerts on misuse, which can surface anomalous fallback channel activity when it involves protected/sensitive information; this is only a slice of T1008's scope (any alternate C2 channel, any data, any platform).
- T1011detects — A.8.3 requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface anomalous exfiltration over secondary media when that use falls inside the monitored scope and dynamic access rules; the control does not mandate detection of the exfiltration technique itself across all media.
- T1011prevents — A.8.3's access restrictions, configuration mechanisms, physical/logical isolation of sensitive data, dynamic access controls (including authentication, encryption, time-bound access, and monitoring), and rules based on device/location can stop exfiltration over alternate media in many scenarios, but do not cover all cases such as proximity-based exfiltration (e.g., Bluetooth) where the adversary already has local access or the medium is outside enterprise policy enforcement.
- T1011.001detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts (including dynamic access management for sensitive data), which can surface Bluetooth exfiltration if it triggers those observables, but the control's scope is limited to authorized access rules and does not mandate Bluetooth-specific detection or coverage of all proximity-based exfil channels.
- T1011.001prevents — A.8.3's access restriction (including physical/logical isolation, dynamic techniques, authentication, encryption, and monitoring) can block unauthorized Bluetooth exfiltration where it relies on improper access to data or the Bluetooth channel itself, but leaves a large remainder (Bluetooth often uses proximity pairing outside enterprise access controls, and the technique assumes the adversary already has sufficient local access).
- T1012detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface Registry queries when they target protected information or deviate from policy; this is a genuine but minority slice of T1012's broad discovery surface across any Registry data.
- T1012prevents — A.8.3 restricts access to information and assets (including via config mechanisms, identity/group controls, dynamic management, authentication, and encryption), which can prevent unauthorized registry queries for sensitive data on Windows systems, but leaves a large remainder for non-sensitive registry data, non-dynamic enforcement gaps, and post-compromise local access.
- T1016prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, isolation, and dynamic techniques that can limit who/what can run discovery utilities or reach network config data), which stops the technique on systems where those restrictions are enforced, but leaves the bulk of the class reachable on any system the adversary has already accessed or via un-restricted remote discovery paths.
- T1016.002prevents — A.8.3 restricts access to sensitive information (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic techniques, encryption, and monitoring), which can prevent an adversary from reading stored Wi-Fi names/passwords on a compromised host; however, it is only a slice because the technique also covers non-sensitive network enumeration, runtime API calls, and post-compromise execution that access controls do not block.
- T1020detects — A.8.3 explicitly requires monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces automated exfiltration in flight when it touches protected assets; this is only a slice because the control is scoped to high-value/sensitive information under dynamic management rather than all exfiltration, and the technique can succeed against unprotected data or non-monitored channels.
- T1020prevents — A.8.3's access restrictions, dynamic management, encryption, monitoring, and alerts can stop automated exfiltration of sensitive data by blocking unauthorized access/transfer at multiple lifecycle points, but this is only a slice: the technique can still succeed via other exfiltration channels, non-sensitive data, or post-compromise footholds that bypass the restrictions.
- T1020.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface traffic mirroring when it involves monitored sensitive data flows or anomalous redirection, but this is scoped only to high-value information under dynamic access management rather than general network traffic duplication.
- T1020.001prevents — A.8.3 restricts access to information/assets (including via config mechanisms, dynamic controls, encryption, monitoring/alerts on misuse, and isolation of sensitive data), which can stop adversaries from configuring or abusing mirroring features to exfiltrate data in many cases, but leaves a bounded remainder on low-level device modifications (e.g. ROMMONkit, patch system image) and certain platform-native mirroring setups that do not route through access-controlled information flows.
- T1021prevents — Enforcing explicit read/write/execute rights and device or location checks on remote services makes it harder for an adversary to abuse RDP, SMB shares, or similar channels with stolen credentials.
- T1021detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces the technique when it occurs; this is limited to a slice because the clause sets requirements rather than mandating universal instrumentation depth or coverage of all remote service abuse vectors (e.g., legitimate admin tools or pre-10.14 macOS escalation).
- T1021.001detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface RDP logins by valid accounts when they deviate from policy or baselines.
- T1021.001prevents — A.8.3's core purpose, guidance on restricting access per policies (including to identities/groups, physical/logical isolation, authentication requirements, time-bound restrictions, and dynamic access controls based on identity/device/location) directly stops unauthorized RDP logins even with valid accounts when those accounts lack the necessary permissions or when the service is isolated/disabled for them.
- T1021.002detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces SMB admin share access by valid accounts when that activity is in scope; it does not instrument or guarantee detection of all variants (e.g. pass-the-hash, non-monitored systems, or silent lateral movement).
- T1021.002prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic techniques, auth requirements, time-bound restrictions, and encryption), which can stop unauthorized SMB share access in many cases but leaves open administrator-level valid accounts, pass-the-hash, and configuration-dependent paths that the technique explicitly relies on.
- T1021.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface DCOM-based lateral movement when it involves monitored high-value assets or anomalous remote COM activation; this is only a slice of the technique's possible executions.
- T1021.003prevents — A.8.3 directly mandates ACL-based access restrictions, identity-based controls, and dynamic techniques that enforce who can remotely activate/launch DCOM objects and what they can invoke, closing the privileged-account pathway described in the technique (with the bounded remainder being misconfigurations or unmonitored legacy COM objects).
- T1021.004detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces SSH logins (especially anomalous or unauthorized ones) but does not mandate comprehensive detection of all valid-account SSH abuse across the technique's scope.
- T1021.004prevents — A.8.3 directly restricts SSH login (via auth requirements, credential enforcement, identity/group controls, dynamic rules based on identity/device/location, and no-anonymous-access rules) so the adversary cannot obtain the remote shell using a valid account; the bounded remainder is post-auth lateral movement or misconfigurations that still allow the technique.
- T1021.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface VNC-based remote control when it violates policy or exhibits anomalous behavior; partial because scope is limited to configured sensitive information and dynamic management rather than all VNC sessions or brute-force attempts on implementations.
- T1021.005prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, dynamic controls, encryption, and monitoring, which can block unauthorized VNC sessions (especially those bypassing system auth or using weak configs), but leaves residual paths via valid accounts, brute-forceable implementations, and non-sensitive system access.
- T1021.006detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface WinRM-based remote access by valid accounts when it deviates from policy or expected patterns.
- T1021.006prevents — A.8.3's core purpose and guidance (access restriction per policy, identity/group controls on read/write/execute, no anonymous access, configuration mechanisms, physical/logical isolation, and dynamic techniques requiring auth/credentials) directly stop an adversary from using a valid account over WinRM by enforcing that only authorized identities can access and interact with the remote service.
- T1021.007detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces the adversary's login and subsequent actions via cloud services; partial because the control's scope is limited to information assets under dynamic access management rather than all cloud service logins or the full technique surface across platforms.
- T1021.007prevents — A.8.3 directly restricts access to cloud services and resources via policies, identity/group controls, authentication requirements, dynamic access rules (identity/device/location), time-bound restrictions, and monitoring/alerting, which stops the adversary from successfully logging in or acting even with a valid synchronized/federated account in most cases; the bounded remainder is post-compromise use of already-authorized sessions or tokens that bypass these at the exact moment of use.
- T1021.008detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces the technique when it occurs; partial because scope is limited to information/assets under dynamic access management rather than all cloud VM connections.
- T1021.008prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic techniques requiring auth/credentials, time-bound restrictions, and monitoring/alerts), which directly stops adversaries from leveraging valid accounts for unauthorized direct cloud VM console connections on IaaS.
- T1025detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse of protected information (including via dynamic access management), which surfaces the T1025 collection activity on monitored/isolated sensitive assets but only where those assets and access paths fall inside the chosen scope and classification scheme.
- T1025prevents — A.8.3's access restriction (including physical/logical isolation of sensitive data, dynamic controls, encryption, and device/location-based rules) stops the adversary from reading files of interest on removable media in many configurations, but leaves a bounded remainder where media is already mounted, the adversary has a shell, or controls are not applied to removable devices.
- T1027.003detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which can surface steganography when it involves protected sensitive information or anomalous access patterns, but this is limited to cases where the hidden data touches monitored assets rather than all stego uses.
- T1027.006detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces HTML smuggling when it triggers dynamic access controls or anomalous behavior in monitored systems, but the clause's scope is limited to protected sensitive information under its policies rather than broadly detecting all instances of the technique across arbitrary content filters or delivery vectors.
- T1027.006prevents — A.8.3's access restriction (including dynamic techniques, authentication, encryption, monitoring, and isolation of sensitive data) can block unauthorized delivery or execution of smuggled payloads in many scenarios, but the technique's core (hiding in benign HTML/JS to bypass content filters before any access control point) is only a minority slice of what the control reaches.
- T1027.009detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access/changes, and raising alerts on misuse attempts, which surfaces embedded-payload activity when it touches protected information; this is a genuine but minority slice of the technique (most embeddings target non-sensitive files or occur outside monitored dynamic controls).
- T1027.011detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces fileless storage of payloads or collected data when it occurs inside the scoped sensitive information; this is a genuine but minority slice because the control is scoped to high-value/sensitive data under dynamic access management rather than broadly detecting all fileless storage of any malicious artifact.
- T1027.011prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation of sensitive assets, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block unauthorized writes or concealment of malicious data in many fileless locations (e.g. Registry, WMI, shared memory), but do not reach all cases such as volatile /tmp usage, read-only bypasses, or already-authorized processes performing storage.
- T1027.012detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface LNK icon smuggling when it triggers those observables (e.g. anomalous external URL fetch or post-compromise execution), but the clause's scope is set by policy and does not mandate instrumentation that reliably catches the metadata abuse itself.
- T1027.017detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which can surface SVG smuggling when it triggers those observables (e.g. anomalous script execution or unauthorized access patterns); however the control's scope is limited to information assets under its access policies and does not broadly instrument for all SVG-based smuggling vectors or content-filter bypasses.
- T1027.017prevents — A.8.3's access-restriction rules (authentication, dynamic policy, isolation, encryption, monitoring) can stop SVG smuggling at the point an untrusted SVG is opened or rendered by an authorized user or process, but the control addresses only the access/execution slice and leaves the smuggling-past-content-filter vector itself untouched.
- T1029detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces scheduled exfiltration activity when it triggers the monitored rules or anomalies; this is only a slice because the clause's scope is limited to information under dynamic access management rather than all exfiltration paths or schedules.
- T1030detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous chunked exfiltration of that data; this is only a slice because the control is scoped to authorized/sensitive information under dynamic access management rather than general network transfer thresholds or non-sensitive bulk exfil.
- T1033prevents — A.8.3 restricts access to information/assets per policies (including via auth, dynamic controls, isolation, and monitoring), which can block many discovery vectors that rely on reading user/session data from logs, processes, files, env vars or CLI; however, it does not stop all local discovery methods (e.g. whoami by an already-authenticated adversary, process enumeration, or network device commands) and is scoped to sensitive information rather than all user details.
- T1036.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and dynamic monitoring/reporting processes that can surface anomalous or suspicious binaries (including those with invalid signatures that fail validation checks), but this is scoped to information assets and access events rather than broadly detecting code-signature forgery on any binary.
- T1036.003detects — A.8.3's dynamic access management explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface renamed/masqueraded utilities when they attempt to access protected information, but this is scoped only to high-value sensitive information under dynamic controls rather than broadly detecting the rename technique itself across all utilities and paths.
- T1036.003prevents — A.8.3's access restriction rules (including dynamic techniques, identity/device/location-based grants, monitoring, and alerts on misuse) can stop renamed utilities from being granted or exercising unauthorized access, but this is a minority slice of the technique whose dominant vector is evading name/path-based detection rather than access enforcement.
- T1036.004detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface masquerading of tasks/services when it triggers anomalous access patterns or audit events; this is only a slice of the technique (name/description manipulation itself is not directly instrumented)
- T1036.008prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound access, encryption, monitoring, alerts); this can block execution or transfer of masqueraded files in some cases (e.g. via validation, isolation, or dynamic rules on sensitive data), but leaves most of the technique (header/extension/icon/content changes to bypass checks and appear benign) untouched.
- T1036.009detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that surface anomalous access patterns, which can detect the technique when it produces observable process-tree or daemonization artifacts on monitored Linux/macOS systems; this is only a slice because the control is scoped to information assets rather than all process behavior and many double-fork or PPID-spoofing instances produce no access event.
- T1036.011detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes/access, and raise alerts on misuse attempts; this surfaces anomalous process behavior (including spoofed names via argv overwrite) when it involves protected assets, but only for the subset of cases tied to monitored sensitive information rather than all process-argument spoofing.
- T1037detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous boot/logon script execution or privilege-escalating activity when it touches covered assets, but this is scoped only to the information-access slice rather than broadly detecting the technique across all platforms and persistence scenarios.
- T1037prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques like auth/encryption/time-bounds), which can stop adversaries from placing or modifying boot/logon scripts in many cases, but leaves a bounded remainder where scripts run with elevated privileges, use local/remote configs outside the access policy, or leverage admin credentials the control does not itself deny.
- T1037.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous logon-script execution or registry tampering when it involves protected assets; this is only a slice because the clause scopes to high-value/sensitive information under dynamic access management rather than broadly detecting the persistence technique on any Windows system.
- T1037.001prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, isolation, and dynamic techniques like auth/encryption/monitoring), which can block unauthorized registry/script modifications for persistence in many configurations, but leaves a bounded remainder where admin/local credentials already allow the change or where the technique leverages permitted logon-script paths.
- T1037.002detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous login-hook modifications or executions on protected assets; partial because the control is scoped to information assets under dynamic access management rather than all persistence mechanisms or system plists.
- T1037.002prevents — A.8.3's access restriction (including config mechanisms, identity/group controls on read/write/execute, isolation of sensitive apps/data, and dynamic techniques) directly constrains the admin-level modification of the loginwindow.plist that installs the hook, but the control is scoped to information and associated assets rather than all persistence mechanisms, and the technique's root-privilege requirement plus deprecation in favor of launchd leaves a bounded remainder
- T1037.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous logon-script execution or unauthorized persistence changes; this is limited to a scoped slice of sensitive/high-value information rather than all network logon script activity.
- T1037.003prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring); this can block unauthorized assignment or execution of malicious network logon scripts in AD/GPO but leaves gaps such as privileged admin accounts legitimately configuring them or incomplete enforcement on all systems.
- T1037.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous RC-script modification at runtime or on access; this is a genuine but minority slice of the technique (post-modification detection on lightweight/embedded platforms where RC is the dominant persistence vector, versus no coverage of the initial privileged write itself).
- T1037.004prevents — A.8.3 restricts access to files (including RC scripts) via policy, configuration, identity/group controls, and dynamic techniques that can block unauthorized modification, but this is only a slice of the technique: the class also covers legitimate admin/root use of RC scripts on legacy/deprecated platforms where the control does not stop the modification itself.
- T1037.005detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous startup-item creation or boot execution on monitored macOS assets, but the clause scopes this to high-value/sensitive information under dynamic access management rather than broadly detecting all persistence techniques.
- T1037.005prevents — A.8.3's access restriction rules (including on identities, groups, physical/logical isolation of sensitive apps/data, and dynamic techniques that can deny unauthorized creation/execution of startup items) stop the technique on systems where those mechanisms are applied to the relevant paths and boot process, but the control is a requirement-setting clause whose coverage depends on implementation choices and does not reach all macOS instances or the deprecated-but-still-present mechanism by default.
- T1039detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which would surface T1039 activity on protected shares; partial because this is scoped to high-value/sensitive information under dynamic access management rather than all network shares.
- T1039prevents — A.8.3's core purpose and guidance (access restriction per policy, no anonymous/sensitive access, config mechanisms, identity/group controls on read/write/etc., physical/logical isolation, and dynamic techniques including auth, time-bound restriction, encryption, monitoring/alerts) directly stop an adversary from successfully searching and collecting files from network shares they have compromised, closing the bulk of T1039; the bounded remainder is post-compromise local admin or misconfigured shares that still allow the technique despite the control.
- T1040detects — A.8.3's dynamic access management explicitly includes monitoring use, recording access/changes, and raising alerts on misuse, which can surface sniffing attempts (especially on sensitive data flows or anomalous access), but this is scoped only to protected information/assets under dynamic controls and does not broadly instrument or detect passive network sniffing in general.
- T1040prevents — A.8.3's access restriction (including encryption, dynamic controls, and isolation of sensitive data in transit) stops sniffing from yielding usable credentials or sensitive information when protocols enforce it, but leaves cleartext traffic, promiscuous-mode captures on unencrypted flows, and many configuration-reveal cases untouched.
- T1041detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces exfiltration attempts over C2 when that activity is treated as misuse of the exfiltrated information; this is a genuine but minority slice because the clause's scope is information-centric access controls rather than broad network or C2 protocol anomaly detection.
- T1041prevents — A.8.3's access restriction, dynamic management, encryption, monitoring and alerts can stop sensitive data from reaching an exfiltration point or being readable if captured in the C2 channel, but do not block all exfiltration paths or encoding into an already-established C2 session.
- T1046detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access, and raising alerts on misuse attempts, which can surface network service discovery activity when it touches protected information or violates access rules, but the clause is scoped to information assets rather than broadly detecting all port/vulnerability scans or mDNS queries across the listed platforms.
- T1046prevents — A.8.3 restricts access to information/assets per policies (including via auth, dynamic controls, encryption, isolation, and monitoring), which can block many discovery scans/tools from reaching or enumerating remote services, but leaves open-ended slices such as local network device scans, unauthenticated mDNS/Bonjour queries, and discovery that does not require access to protected information.
- T1047detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces WMI abuse when it touches monitored sensitive information or violates dynamic rules; this is only a slice of T1047 because the technique is not inherently about sensitive-data access and many executions (local discovery, non-sensitive execution) fall outside the clause's scoped monitoring.
- T1047prevents — A.8.3's access restriction rules (identity-based, authentication, time-bound, credentialed, monitored) can stop unauthorized WMI abuse for execution or discovery on Windows when the technique relies on unauthenticated or insufficiently controlled access, but many legitimate WMI uses (local admin, PowerShell/COM interfaces, remote WinRM with valid creds) remain available to adversaries.
- T1048detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface exfiltration attempts over alternate protocols when they touch protected assets; this is only a slice because the control is scoped to information classified as sensitive/high-value under dynamic access management rather than all exfiltration events across all assets/protocols.
- T1048prevents — A.8.3 restricts access to sensitive information (via policies, auth, dynamic controls, encryption, monitoring) which can stop exfiltration of that data over alternate protocols in many cases, but leaves open exfiltration of non-sensitive data, use of permitted protocols/paths, and post-compromise credential abuse.
- T1048.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces exfiltration events when they involve protected information under dynamic access management; this is limited to a slice (only high-value/sensitive data under those controls, not arbitrary exfil over symmetric channels).
- T1048.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface exfiltration attempts over asymmetric protocols when they trigger those rules or anomalies; this is a genuine but minority slice because the clause's scope is set by access policies and use cases rather than mandating broad network/protocol telemetry.
- T1048.002prevents — A.8.3 restricts access to sensitive information (including via dynamic techniques, encryption, authentication, and monitoring) which can stop exfiltration of that data over any protocol when the restriction is enforced at the data or endpoint; this is only a slice of the technique because the control does not address all exfiltration scenarios, non-sensitive data, or post-breach use of already-authorized channels.
- T1048.003detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces exfiltration events over unencrypted non-C2 channels when they involve monitored sensitive information or violate dynamic access rules.
- T1048.003prevents — A.8.3's access restriction, dynamic management, encryption mandates, and monitoring/alerting on misuse directly stop sensitive data from reaching exfiltration over unencrypted non-C2 channels in many scenarios, but leave a bounded remainder (e.g., non-sensitive data, post-breach exfil of already-compromised data, or implementations that do not apply dynamic controls to all outbound flows).
- T1049prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth, encryption, monitoring/alerts on misuse), which can prevent an adversary from querying network connection data on systems they have not yet accessed or from protected cloud/network resources, but does not stop the technique once the adversary has already compromised and is executing commands on a system.
- T1052detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface an exfiltration attempt via physical medium when it occurs inside the monitored scope (e.g. authorized device or endpoint); this is a genuine but minority slice because the control's core is access enforcement rather than broad detection of physical exfiltration techniques, and many T1052 vectors (e.g. air-gapped, offline media) sit outside its instrumentation.
- T1052prevents — A.8.3's access restriction (including physical/logical isolation of sensitive data, no anonymous access, dynamic controls, and encryption) stops many physical exfiltration paths on removable media, but leaves a bounded remainder where authorized users can still copy data they are legitimately allowed to access.
- T1052.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface USB-based exfiltration attempts when they involve monitored sensitive information or devices; this is only a slice because the control is scoped to organization-defined sensitive assets and dynamic management rather than universal detection of all USB data movement.
- T1052.001prevents — A.8.3 restricts access to information and assets (including via physical/logical controls, dynamic management, encryption, monitoring, and USB-relevant isolation or credentialing), which stops many but not all USB exfiltration paths such as those using already-authorized devices, insiders, or unmonitored insertion.
- T1053detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces scheduled-task abuse when it touches covered sensitive information or dynamic-access objects; this is a genuine but scoped slice of the broad technique (most T1053 executions are not information-centric and fall outside the clause's access-restriction focus).
- T1053prevents — A.8.3 restricts access to information/assets (including via auth, config mechanisms, dynamic controls, and privilege-aware rules on identity/device), which stops many but not all abuse paths for scheduling tasks/jobs (e.g. local unprivileged scheduling, startup tasks, or remote cases where auth is already met).
- T1053.002detects — A.8.3 explicitly calls for recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous at/scheduled-job activity, but this is scoped only to the dynamic-access-management slice rather than broadly detecting the technique across all platforms and use cases.
- T1053.002prevents — A.8.3's access restriction rules (including on identities, groups, sudo, at.allow/at.deny files, and dynamic techniques) can stop unauthorized users from invoking at for scheduling, but the technique remains fully available to any properly authorized admin/superuser or permitted account, which is the dominant usage vector described in the source prose.
- T1053.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous cron job creation or execution when it touches protected information or violates access rules; this is a genuine but minority slice of the technique (most cron abuse for persistence is not tied to high-value sensitive data monitoring).
- T1053.003prevents — A.8.3's access restriction rules (including on identities, groups, dynamic management based on identity/device/location, authentication requirements, and isolation of sensitive applications/data) can stop unauthorized creation or modification of crontab files and jobs on Linux/macOS/ESXi, but only for a slice of the technique (e.g., non-root or policy-enforced paths); root-level or already-privileged cron abuse and many platform defaults remain outside its direct reach.
- T1053.005detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes; these surface scheduled-task abuse when it touches protected information or violates dynamic rules, but the control is scoped to information assets rather than all task-scheduler execution or hidden-task artifacts on Windows.
- T1053.005prevents — A.8.3's access restriction rules (identity-based controls, least-privilege configuration, dynamic policy enforcement, and authentication requirements) stop many abuse paths that rely on unauthorized creation/execution of tasks under elevated or foreign accounts, but cannot block all vectors (e.g., SYSTEM-level tasks, hidden-registry manipulation, or abuse by already-privileged code).
- T1053.006detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous systemd-timer activity when it touches monitored sensitive assets or files, but the clause's scope is limited to information assets under dynamic access management rather than broadly detecting all timer-based scheduling or persistence.
- T1053.006prevents — A.8.3's access restriction rules (including on privileged paths, identities, dynamic controls, and isolation of sensitive assets) can block unauthorized creation/activation of systemd timers for persistence in many cases, but the control is silent on the specific scheduler-abuse vector, user-level timers, and remote activation via systemctl/SSH, leaving a substantial unaddressed slice.
- T1053.007detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous container-orchestration job scheduling in monitored environments; partial because scope is limited to information-centric or high-value assets under the access-restriction policy rather than all cluster scheduling activity.
- T1053.007prevents — A.8.3's access restriction rules (including dynamic techniques, authentication, time-bound access, isolation of sensitive apps/data, and monitoring) can stop unauthorized creation/scheduling of malicious orchestration jobs in many cases, but this is only a slice: the clause does not reach all job-scheduling vectors, misconfigurations, or already-authenticated insiders on Containers platform.
- T1055detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces some process-injection behaviors (especially those involving sensitive data access or anomalous patterns), but the clause is scoped to information-centric dynamic access controls rather than general process telemetry or injection-specific indicators.
- T1055prevents — A.8.3's access restriction (including dynamic techniques, isolation, auth, encryption, and monitoring) can stop some process-injection vectors that rely on unauthorized access to a target process's memory or resources, but most platform-specific injection methods abuse legitimate APIs from already-authorized contexts and are not reached by the control.
- T1055.001detects — A.8.3 explicitly calls for dynamic access management to monitor use, record changes, raise alerts on misuse, and provide operational monitoring/reporting processes that can surface anomalous DLL-injection behavior in live processes; this is a genuine but minority slice of the technique (most variants are not inherently misuse of 'sensitive information' under dynamic rules).
- T1055.001prevents — A.8.3's access restriction (including dynamic techniques, isolation of sensitive apps/data, credential requirements, and monitoring) can block many vectors for unauthorized process injection that rely on improper access to memory or elevated privileges, but leaves a bounded remainder of in-process techniques that do not cross an explicit access boundary.
- T1055.002detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface PE injection when it touches monitored sensitive data or triggers dynamic access anomalies; this is only a slice of the technique's scope (most in-process injection is not information-centric or under dynamic controls).
- T1055.002prevents — A.8.3's access restriction (including dynamic techniques, isolation, and credential/encryption requirements) can stop unauthorized code injection into processes when it crosses an access boundary, but leaves the dominant in-process memory-write technique (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread) inside an already-authorized context untouched.
- T1055.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording accesses/changes, and raising alerts on misuse attempts, which can surface Thread Execution Hijacking when it touches monitored assets or triggers anomalous access patterns, but this is scoped only to information-centric use cases rather than general process injection.
- T1055.003prevents — A.8.3's access restriction (esp. dynamic techniques, isolation of sensitive apps/data, auth/credential requirements, and monitoring/alerting on misuse) can stop unauthorized code injection into live processes when those processes hold protected information, but leaves most of the technique's surface (any non-sensitive process, non-dynamic enforcement, or pre-injection steps) untouched.
- T1055.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface APC injection as anomalous behavior when it touches protected information or violates dynamic rules; this is limited to the subset of injections involving monitored sensitive assets rather than all process-injection activity.
- T1055.004prevents — A.8.3's access restriction (including dynamic techniques, isolation of sensitive apps/data, identity/group controls, and monitoring) can prevent APC injection into protected processes or data by blocking unauthorized handles, memory access, or execution in isolated contexts, but leaves many standard process-injection vectors (e.g. unsensitive system processes, unmonitored threads) untouched.
- T1055.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous process behavior or unauthorized memory writes involved in TLS callback injection; however, the control is scoped to information assets and access rather than host/process memory instrumentation, leaving most in-process injection unobserved.
- T1055.005prevents — A.8.3's access restriction (including dynamic techniques, isolation, authentication, and monitoring) can prevent the elevated-privilege or unauthorized-memory-access outcome of a successful TLS callback injection, but does not stop the underlying memory-write or PE-pointer manipulation that constitutes the technique itself.
- T1055.008detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes/access, and raise alerts on misuse attempts, which can surface ptrace-based injection when it touches protected assets; this is only a slice of the technique (Linux process injection is broader than monitored sensitive info).
- T1055.008prevents — A.8.3's access restriction (including dynamic techniques, isolation of sensitive apps/data, identity/device-based rules, and monitoring/alerting) can prevent ptrace injection against protected/sensitive processes or data but leaves a large remainder for non-sensitive processes, child-process debugging, and non-dynamic Linux scenarios where the technique still succeeds.
- T1055.009detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface proc-memory injection as anomalous process behavior or unauthorized memory writes; this is limited to the slice inside the implementer-defined monitoring scope rather than a bounded remainder.
- T1055.009prevents — A.8.3's access restriction (including logical controls, dynamic management, authentication, encryption, and isolation of sensitive applications/data) can stop unauthorized process memory access and injection on Linux where the /proc filesystem or target process falls under enforced policies, but leaves a large remainder for unaddressed cases like non-sensitive processes, kernel-level mappings, or implementations without dynamic controls.
- T1055.011detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface EWM injection as anomalous process behavior or unauthorized memory/privilege activity; however the clause's scope is set by access policies and dynamic management for information assets, leaving most in-process injection techniques outside its instrumentation focus.
- T1055.011prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, encryption, time-bound access, monitoring/alerts); this can prevent some EWM injection paths that rely on unauthorized access to process memory or shared sections, but leaves the core Windows GUI class/EWM registration and legitimate-process execution vector largely untouched.
- T1055.012detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous process behavior such as hollowing, but the clause's scope is set by access-restriction and information-classification policies rather than mandating host/process instrumentation that would reliably catch the technique.
- T1055.013detects — A.8.3 explicitly calls for dynamic access management that raises alerts on misuse attempts and records access/use throughout the information lifecycle, which can surface anomalous process-memory or file-transaction behavior associated with doppelgänging; however the control is scoped to information assets and authorized-access decisions rather than host/process-injection telemetry, leaving the bulk of the technique's stealth mechanisms (TxF isolation, section loading, rollback, and masked execution) outside its direct view.
- T1055.014detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface VDSO hijacking in flight when it touches monitored sensitive information or violates dynamic rules; this is only a slice of the Linux technique's scope per the clause's own scoping language.
- T1055.015detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and operational monitoring/reporting processes, which can surface ListPlanting's anomalous window messages, memory writes, and callback execution when they touch monitored sensitive data or assets; this is only a slice of the technique's full surface (e.g., non-sensitive processes or pre-access reconnaissance remain unseen).
- T1056detects — A.8.3 explicitly lists dynamic access management that raises alerts on detected misuse of protected information, which surfaces some input-capture attempts (especially those touching monitored sensitive data), but this is scoped only to high-value assets under dynamic controls and does not broadly instrument for credential API hooking or web portal capture across all platforms.
- T1056prevents — A.8.3's access-restriction rules, configuration mechanisms, authentication requirements, dynamic controls, and encryption directly stop many forms of input capture (especially deceptive or unauthorized credential entry) but leave transparent hooking and post-authentication capture mechanisms untouched.
- T1056.001detects — A.8.3 explicitly requires dynamic access management to monitor use of sensitive information, record access/changes, and raise alerts on misuse attempts, which surfaces keylogging when it targets protected information; this is only a slice of the technique (not all keylogging is on high-value data under dynamic controls, and many methods like raw hardware reads or custom drivers sit outside monitored/credentialed paths).
- T1056.001prevents — A.8.3's access restriction, configuration mechanisms, authentication requirements, dynamic controls, and isolation of sensitive data can block several keylogging vectors (e.g. unauthorized API hooks, registry mods, or credential capture on protected apps), but leaves many others (e.g. custom drivers, hardware buffer reads, or Modify System Image on network devices) untouched.
- T1056.002detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information plus monitoring/reporting processes that surface unauthorized access attempts, which would catch many GUI-input-capture prompts that reach sensitive data or mimic legitimate credential flows; it does not instrument or surface the technique itself when it runs against non-sensitive contexts or before the prompt is answered.
- T1056.002prevents — A.8.3's access restriction rules, dynamic management, authentication requirements, and monitoring/alerting on misuse can stop many GUI prompt spoofs that rely on unauthenticated or unauthorized credential collection, but the technique's core (mimicking legitimate OS/software prompts that users will still answer) is not itself blocked by these controls.
- T1056.003detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which would surface anomalous credential-capture behavior on a portal; this is only a slice of the full technique because the control is scoped to information assets under the access policy rather than all possible web-service modifications or initial-exploitation vectors.
- T1056.003prevents — A.8.3 restricts access to information/assets per policy (including no anonymous/sensitive access, config mechanisms, dynamic controls, auth requirements, encryption, monitoring/alerts on misuse), which can stop adversaries from installing capture code on portals or block credential transmission in some scenarios, but leaves open vectors like initial web exploits, post-compromise admin access, or unaddressed portal code modification.
- T1056.004detects — A.8.3 explicitly calls for dynamic access management to raise alerts on detected misuse of protected information and to record access/use throughout the lifecycle, which surfaces credential-capturing API hooks when they target monitored sensitive data flows; this is only a slice of the technique (not all hooking targets high-value info under dynamic controls, and basic hooks on non-sensitive paths remain unseen).
- T1057detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts; this surfaces process-discovery behavior when it touches protected/sensitive information or triggers the dynamic access controls, but the clause is scoped only to information assets under access restriction rather than all process enumeration on every platform.
- T1057prevents — A.8.3 restricts access to information/assets per policies (including via auth, dynamic controls, isolation, and monitoring), which can prevent unauthenticated/unauthorized process enumeration on many platforms, but leaves open the bounded remainder of techniques using already-authorized sessions, elevated privileges, or direct kernel/memory reads that the control does not block.
- T1059prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, auth, encryption, and isolation of sensitive apps/data), which can stop adversaries from reaching the interpreters or embedding/launching their payloads in some scenarios, but leaves the bulk of interpreter abuse (built-in shells, interactive use, remote services, and non-sensitive platforms) untouched.
- T1059.001detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface PowerShell abuse when it touches monitored sensitive data or violates dynamic rules; this is only a slice of the broad technique (which also covers non-sensitive discovery, in-memory execution, and non-monitored paths).
- T1059.001prevents — A.8.3 restricts access to information/assets via policies, auth, dynamic controls, and isolation, which can block some PowerShell abuse vectors (e.g. unauthorized script execution or download of malicious code) but leaves the bulk of the technique (built-in interpreter, in-memory execution, admin-permitted cmdlets) untouched.
- T1059.002detects — A.8.3 explicitly calls for recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface AppleScript abuse (e.g. anomalous script execution or unauthorized inter-application events), but only where those fall inside the chosen scope of the dynamic-access or logging mechanisms; the clause does not mandate broad host telemetry or script-content inspection.
- T1059.002prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound access, encryption, monitoring/alerts), which can prevent some abuse vectors of AppleScript (e.g. unauthorized script execution against sensitive apps/data or via untrusted identities), but leaves many execution paths (e.g. local osascript, NSAppleScript in binaries, legitimate app interaction, or non-sensitive contexts) untouched.
- T1059.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface cmd.exe abuse when it touches high-value assets under dynamic access management; this is only a slice of the technique's scope (most cmd abuse is not against such monitored assets).
- T1059.003prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts), which can block unauthorized cmd.exe invocation/execution in many scenarios but leaves gaps like permitted admin shells, legitimate batch use, or post-auth abuse.
- T1059.004detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface Unix shell abuse when it touches monitored sensitive information or violates dynamic access rules; this is only a slice of the technique (not all shell execution is against high-value info or triggers the alerts).
- T1059.004prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, dynamic controls, and isolation, which can block adversaries from reaching or abusing Unix shells on many (but not all) Linux/macOS/ESXi systems, especially non-privileged or non-interactive ones; however, it does not remove the shells themselves or block all elevated/required shell uses.
- T1059.006detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface Python-based execution when it touches monitored sensitive assets or violates dynamic access rules, but this is scoped only to information under dynamic access management rather than broadly detecting all Python abuse across platforms.
- T1059.007detects — A.8.3 explicitly calls for monitoring use of protected information, recording access, and raising alerts on misuse attempts, which can surface JavaScript-based execution when it touches monitored sensitive assets or violates dynamic access rules, but this is scoped only to information under dynamic access management rather than broadly detecting all JS abuse across platforms.
- T1059.007prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, dynamic management, authentication, encryption, and monitoring) which can block many abuse vectors for JS execution (e.g. unauthorized download/execution of malicious scripts or access to sensitive JS interpreters), but leaves a bounded remainder such as in-browser JS, already-authorized interpreters, or non-access-control vectors like Drive-by Compromise.
- T1059.008detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces CLI abuse on network devices when it involves sensitive information under dynamic access management; this is only a slice of the technique (not all CLI abuse is on monitored sensitive data or triggers alerts).
- T1059.008prevents — A.8.3 restricts access to information/assets via policies, auth, config controls, permission levels, isolation, and dynamic techniques that can limit who/when/how network device CLIs are used, blocking many abuse paths; partial because it does not remove the interpreter itself or stop all privileged CLI use on required network devices.
- T1059.009detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces abuse of cloud APIs when it occurs within the scoped dynamic access management or logging mechanisms.
- T1059.009prevents — A.8.3 restricts access to information/assets via policies, auth, dynamic controls, encryption, and monitoring, which can block unauthorized API abuse when it relies on improper access/credentials, but leaves many execution vectors (e.g., valid sessions, misconfigured IAM, or non-sensitive APIs) untouched.
- T1059.011detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface Lua-based execution when it touches protected assets or violates dynamic rules; this is only a slice of the technique's possible executions (e.g. non-sensitive or non-monitored interpreters).
- T1059.012prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, dynamic controls, and isolation of sensitive systems/apps, which can block unauthorized hypervisor CLI abuse on platforms like ESXi where it manages VMs and data; however, this is a minority slice as the technique often leverages already-authenticated admin contexts or physical/hypervisor-level access outside the control's primary information-access focus.
- T1059.013detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the information lifecycle, which surfaces some abuse of container CLI/API calls when they involve sensitive data or resources, but the clause is scoped only to information assets rather than all container management actions or non-sensitive discovery/execution.
- T1059.013prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, dynamic controls, and isolation of sensitive apps/data/systems, which can block unauthorized CLI/API abuse against container management surfaces in some deployments but leaves many execution paths (e.g., legitimate admin kubectl, SDKs, or misconfigured daemons) unaddressed.
- T1068detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface exploitation attempts that abuse privileges or access sensitive assets; this is only a slice of T1068 (e.g., kernel/driver BYOVD cases often evade such info-centric monitoring).
- T1068prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring), which can block many exploitation paths that rely on insufficient permission levels; however, it does not address the core vulnerability exploitation (e.g., BYOVD, kernel bugs) itself and leaves residual cases where escalation is still possible.
- T1069detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface permission-group discovery activity when it touches protected information or violates dynamic rules; this is a genuine but minority slice of the broad technique that also covers passive/local enumeration outside monitored sensitive assets.
- T1069prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth, encryption, monitoring/alerts on misuse), which constrains the discovery of permission groups/settings in many environments, but leaves residual cases (e.g., already-compromised accounts, unmonitored platforms, or pre-restriction enumeration) unaddressed.
- T1069.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface the reconnaissance commands (net localgroup, groups, dscl) when they trigger those controls; this is a genuine but minority slice of the technique's possible executions rather than the bulk with a bounded remainder.
- T1069.001prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, dynamic techniques, and monitoring/alerting), which can stop many discovery commands from succeeding on protected resources, but leaves a large remainder where local group enumeration is possible without touching restricted information.
- T1069.002detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the reconnaissance commands or anomalous group queries in real time or logs; partial because the clause's scope is set by topic-specific policies and only covers what the organization classifies/monitors rather than all instances of the technique.
- T1069.002prevents — A.8.3's access restriction rules (including dynamic techniques, identity/group controls, authentication requirements, and monitoring) can stop many discovery commands from succeeding or yielding usable results, but the control is silent on the specific reconnaissance commands and does not reach the full class of domain-group enumeration on all platforms.
- T1069.003prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth requirements, encryption, monitoring/alerts on misuse), which constrains the post-auth enumeration techniques and ACL queries described in T1069.003; it is only a slice because the control governs what is accessible rather than blocking authenticated discovery itself, and the technique can still run against non-sensitive or permitted scopes.
- T1070.003prevents — A.8.3's access restriction, configuration mechanisms, physical/logical isolation, dynamic access controls, authentication requirements, time-bound restrictions, encryption, monitoring, and alerts can prevent unauthorized users from reaching or modifying command history files in many scenarios, but once an adversary has a compromised privileged account the technique (rm, Clear-History, editing the file) can still execute inside that session.
- T1070.004detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface file-deletion activity when it touches covered assets, but this is scoped only to high-value/sensitive information under dynamic access management rather than all post-intrusion cleanup.
- T1070.005detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous share-removal action when it touches protected assets; this is a genuine but minority slice of the technique's possible executions.
- T1070.006detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface timestomping anomalies when they involve monitored sensitive information or deviate from dynamic access rules.
- T1070.008detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the mailbox-clearing actions when they touch protected information under dynamic access management; this is only a slice of the technique (not all clearing uses monitored sensitive data or triggers the alerts).
- T1070.008prevents — A.8.3 restricts access to information/assets (including via auth, dynamic controls, encryption, logging, and alerts on misuse) which can block many unauthorized delete/export actions on mailbox data/logs, but does not stop all vectors such as authorized insiders, transport rules, or post-auth APIs/utilities on all platforms.
- T1070.009detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces T1070.009 cleanup actions when they touch covered information or systems; this is only a slice of the broad technique (any persistence artifact on any platform).
- T1071detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access, and raising alerts on misuse attempts, which surfaces anomalous application-layer protocol behavior when it touches protected information; this is a genuine but minority slice of the broad technique that blends with any protocol traffic (including non-sensitive flows).
- T1071.001detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces anomalous or unauthorized web-protocol C2 blending in with legitimate traffic as part of dynamic access management.
- T1071.002detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access, and raising alerts on misuse attempts, which can surface anomalous file-transfer-protocol C2 blending in with legitimate traffic; this is only a slice of the technique (real-time monitoring of high-value info, not general network/protocol anomaly detection across all platforms or concealment methods).
- T1071.003detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous mail-protocol C2 blending in with legitimate email traffic; this is a genuine but minority slice of the technique (most T1071.003 abuse lives in non-sensitive or non-monitored flows).
- T1071.004detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes that surface anomalous or unauthorized DNS-tunneled traffic when it carries sensitive data under dynamic access controls.
- T1071.005detects — A.8.3 explicitly requires monitoring use of protected information, recording access, and raising alerts on misuse attempts, which can surface anomalous pub/sub traffic or unauthorized topic subscriptions that match the technique when dynamic access management is applied to the broker or topics.
- T1072detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which would surface anomalous/abusive use of deployment tools when they touch sensitive assets; this is only a slice of the technique (not all abuse involves detectable misuse of high-value data).
- T1072prevents — A.8.3 restricts access to information/assets (including via auth, config mechanisms, dynamic controls, and isolation of sensitive systems), which can block unauthorized use of deployment tools to run commands or move laterally, but leaves open cases relying on already-compromised admin credentials, direct local access, or non-sensitive tool configurations.
- T1074detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface staging activity when it touches protected sensitive information under dynamic access management; this is a genuine but minority slice of T1074 (most staging uses ordinary file copies on any data, outside the sensitive/high-value scope or dynamic controls).
- T1074prevents — A.8.3 restricts access to information (including via dynamic techniques, encryption, monitoring, and isolation of sensitive data), which can stop adversaries from staging collected data in many scenarios, but leaves open cases such as staging from already-compromised identities, non-sensitive data, or post-breach locations where access controls are not the limiting factor.
- T1074.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces local staging activity when it touches protected information under dynamic access management; this is only a slice of the technique because the clause's scope is limited to sensitive/high-value information under its policies rather than all local data staging.
- T1074.001prevents — A.8.3's access restriction (including dynamic techniques, auth, encryption, monitoring, and isolation of sensitive data) can stop adversaries from staging collected data in many local locations, but leaves a bounded remainder where staging uses already-authorized identities, permitted locations, or non-sensitive data that the control does not block.
- T1074.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the staging activity when it touches protected information under dynamic access management, but this is scoped only to high-value/sensitive data under the policy rather than all staging across any asset or platform.
- T1074.002prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, encryption, auth, time-bound controls, and monitoring), which can stop adversaries from staging collected data in many cases, but leaves open slices such as initial collection on already-compromised systems, use of authorized identities, or staging in unmanaged/anonymous locations.
- T1078prevents — Requiring authenticated, non-anonymous identities and enforcing per-user or per-group permissions directly prevents adversaries from leveraging stolen or default credentials to gain unauthorized access.
- T1078detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces T1078 abuse of valid (including inactive) accounts; this is only a slice because the clause's scope is set by policy and classification rather than mandating universal coverage of all account abuse vectors.
- T1078.001detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces abuse of default accounts when it occurs; this is only a slice of the technique (e.g., post-compromise activity on known defaults) rather than broad detection of credential acquisition or creation of defaults.
- T1078.001prevents — A.8.3's access restriction rules, default-deny posture for unknown/anonymous accounts, credential requirements, time-bound/dynamic controls, and isolation of sensitive assets directly stop many default-account abuses (especially unchanged factory defaults and anonymous use), but leave a remainder for post-creation dynamic defaults (e.g. vpxuser), stolen keys, and integration-created accounts that still require separate credential hygiene or removal.
- T1078.002detects — A.8.3 explicitly requires recording access, raising alerts on misuse, and operational monitoring/reporting processes, which surface domain-account abuse in flight or after the fact; partial because the clause sets policy and scope rather than mandating universal instrumentation depth across all domain-account vectors (e.g., initial credential dumping outside monitored boundaries).
- T1078.002prevents — A.8.3 directly restricts access to information/assets per policies (including via config mechanisms, identity/group controls, dynamic techniques, auth requirements, time-bound restrictions, and encryption), which stops adversaries from abusing obtained domain account credentials to gain Initial Access/Persistence/Privilege Escalation/Defense Evasion across domain resources; the bounded remainder is post-compromise local abuse or non-policy-enforced edge cases like service accounts.
- T1078.003detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces abuse of local account credentials when it occurs against protected information or systems; this is a genuine but minority slice of the technique (which also covers credential theft, dumping, persistence and lateral movement outside monitored dynamic-access scopes).
- T1078.003prevents — A.8.3 directly restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerting), which stops adversaries from obtaining/abusing local account credentials for initial access, escalation, etc. in most cases; residual exists for misconfigurations, weak creds, or unmonitored local abuse vectors.
- T1078.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces adversary use of valid cloud accounts (e.g. anomalous access patterns or privilege assumptions), but only for the subset of techniques that trigger those alerts rather than the full class (e.g. silent persistence via added credentials or pivots).
- T1078.004prevents — A.8.3 directly restricts cloud account access via policies, configuration mechanisms, identity/group controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts), and isolation — blocking the technique's initial access, privilege escalation, persistence (e.g. additional credentials), and evasion vectors in most cases, with a bounded remainder for misconfigurations, hybrid/federated edge cases, and over-privileged role assumptions explicitly called out in the technique.
- T1080detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces tainted shared content or anomalous access in monitored locations, but only for information under dynamic access management (a subset of all shared storage) and does not broadly instrument file-modification or binary-infection vectors across all platforms.
- T1080prevents — A.8.3 restricts access to shared storage (via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques including auth, time-bound access, encryption, monitoring, and alerts), which stops many forms of unauthorized tainting and lateral execution on shared content, but leaves open slices such as insider-authorized writes, supply-chain compromise of repos before sharing, and non-access-control vectors like binary infection of files already present.
- T1082prevents — A.8.3 restricts access to information and assets (including via auth, config mechanisms, dynamic controls, and isolation of sensitive data/systems), which can prevent unauthenticated or unauthorized calls to discovery APIs, CLI commands, or tools on some platforms, but leaves many authenticated/privileged execution paths and local process-based discovery intact.
- T1083detects — A.8.3 explicitly requires raising alerts on detected misuse of information (including access attempts) and recording who accesses what, which surfaces T1083 when it touches protected/sensitive assets under dynamic access management; this is only a slice of the technique because most File and Directory Discovery occurs against unprotected locations or via benign utilities before any misuse trigger.
- T1083prevents — A.8.3 restricts access to files/directories via policies, auth, ACLs, dynamic controls and encryption, which stops many (but not all) discovery techniques that rely on unauthenticated or over-permissioned enumeration.
- T1087prevents — By tying access to verified identities and groups rather than anonymous or broad permissions, the control shrinks the attack surface that account-discovery techniques rely on to map usable targets.
- T1087.001prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques like auth/encryption/monitoring), which can block many common enumeration paths such as reading /etc/passwd or running net user/id without authorization; however, it is only a slice because the technique can still succeed via permitted accounts, misconfigurations, or unmonitored vectors on the listed platforms.
- T1087.002detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface domain account enumeration when it touches protected information or triggers configured alerts; this is only a slice of the technique's possible executions (e.g. not all ldapsearch or net user /domain calls are on high-value data or trigger alerts).
- T1087.002prevents — A.8.3 restricts access to information (including via auth, dynamic controls, encryption, and monitoring) so that enumeration commands cannot retrieve domain account listings from protected stores or services; this stops the technique for many realistic targets but leaves a bounded remainder where the adversary already holds sufficient local or delegated privileges to run the commands successfully.
- T1087.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which would surface an authenticated attempt to dump a GAL or directory as anomalous behavior; partial because the clause scopes this only to high-value/sensitive information under dynamic access management rather than all email-account enumeration.
- T1087.003prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth, encryption, monitoring, and granular controls on who/what/when can read data), which stops authenticated adversaries from successfully running Get-GlobalAddressList or equivalent directory queries on email accounts in many configurations, but leaves open slices such as legitimate user sessions, misconfigured defaults, or non-sensitive directory data that the technique can still leverage.
- T1087.004prevents — A.8.3 restricts access to information and assets per policies (including dynamic techniques, authentication, encryption, and monitoring), which can block unauthenticated or unauthorized enumeration of cloud accounts via listed tools, but only for the subset of discovery that requires crossing an access boundary rather than using already-granted authenticated sessions.
- T1090.001detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which can surface anomalous internal proxying (especially when it involves sensitive data flows or unauthorized access patterns), but this is scoped only to information under dynamic access management rather than broadly detecting all internal proxy C2 techniques across any asset.
- T1090.002detects — A.8.3 requires monitoring, alerting on misuse, and recording of access/use throughout the information lifecycle, which can surface anomalous proxying of C2 traffic when it involves monitored sensitive data or systems, but the control is scoped only to information assets under dynamic access management rather than broadly detecting all external proxy usage on any platform.
- T1091detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the technique when it touches monitored sensitive information or removable media under dynamic controls, but this is scoped only to covered assets rather than broadly detecting all Autorun, firmware, or USB-borne replication.
- T1091prevents — A.8.3's access restriction (including physical/logical isolation of sensitive assets, no anonymous access to sensitive storage, dynamic controls on removable-media data, and encryption/printing/use monitoring) stops many vectors of malware propagation via removable media but leaves open user-executed autorun tricks, firmware-level media modification, and non-sensitive or unmanaged media as a genuine slice.
- T1092prevents — A.8.3's access restriction (including physical/logical controls on removable media, dynamic management, encryption, and monitoring) can stop the technique from succeeding on air-gapped systems by blocking unauthorized read/write of commands/files, but leaves a bounded remainder where the media is already inside the trusted boundary or the first system is already compromised.
- T1095detects — A.8.3 explicitly requires monitoring use of information, recording access, and raising alerts on misuse attempts, which surfaces anomalous non-application-layer protocol use (e.g. ICMP, VMCI) when it involves protected/sensitive information; this is a genuine but minority slice of the broad technique that also covers unmonitored or non-sensitive traffic.
- T1098detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces account manipulation in flight on protected assets; this is only a slice of T1098's broad scope across platforms, account creation, credential changes, and permission-group modifications where no information asset is directly involved.
- T1098prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, dynamic management, authentication, time-bound restrictions and monitoring, which directly blocks many forms of account manipulation (e.g. unauthorized permission changes, credential mods, or subverting policies on sensitive accounts); however, it is only a slice because the technique can still succeed against non-sensitive accounts, via already-compromised high-privilege sessions, or on platforms outside the dynamic management scope.
- T1098.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the addition of rogue credentials when it triggers those mechanisms, but the clause's scope is set by policies and does not mandate instrumentation that would catch every stealthy persistence action on every platform.
- T1098.001prevents — A.8.3's access restriction rules, configuration mechanisms, credential requirements, time-bound restrictions, and dynamic management based on identity/device/location can stop many (but not all) ways an adversary with initial permissions adds rogue credentials or keys.
- T1098.002detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the permission-granting action or its anomalous result in email systems; this is limited to a slice because the clause sets scope by policy and does not mandate instrumentation that would catch every stealthy or admin-level mailbox-permission change.
- T1098.002prevents — A.8.3's access restriction rules, anonymous-access ban, identity/group controls, dynamic management, authentication requirements and real-time monitoring directly stop the technique's core act of granting Default/Anonymous or extra delegate permissions on mailboxes and folders; the remainder is the slice performed through privileged admin roles or pre-existing high-privilege accounts that the clause does not itself block.
- T1098.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the addition of cloud roles when it triggers an alert or is logged as anomalous permission change; this is only a slice because the control is scoped to information assets and dynamic techniques rather than broadly mandating detection of all IAM policy/role modifications across cloud tenants.
- T1098.003prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including real-time policy enforcement, authentication requirements, time-bound access, and monitoring/alerting on misuse) directly constrain the ability to add or attach elevated IAM roles/permissions to an adversary-controlled account, but only for identities and actions falling inside the enforced policies — external tenant role additions, already-compromised high-privilege accounts, and policy-modification paths that bypass the dynamic rules remain outside its reach.
- T1098.004detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, and raise alerts on misuse attempts, which surfaces unauthorized modification of authorized_keys files when they protect high-value assets under those rules; this is only a slice of the technique's surface (not all authorized_keys edits are on monitored high-value info or trigger the dynamic layer).
- T1098.004prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) directly stop unauthorized modification of authorized_keys files and the resulting SSH logins in many scenarios, but leave gaps for privileged insiders, misconfigured baselines, or unmonitored cloud API paths that the clause does not universally close.
- T1098.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes for dynamic access management, which surfaces anomalous device registrations in MFA or Intune-like systems; partial because the clause's scope is limited to high-value sensitive information under dynamic controls rather than all device registrations or MFA enrollment events.
- T1098.005prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including auth requirements, time-bound access, and monitoring/alerting), and isolation of sensitive systems directly block unauthorized device registration and MFA/device-management enrollment that would bypass policies, but only for the subset of cases governed by the organization's policies and dynamic techniques rather than all enrollment vectors or legacy/self-enrollment paths.
- T1098.006detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces the permission-addition activity in real time or post-facto where dynamic access management or logging is scoped to cover it; partial because the clause sets requirements rather than mandating universal instrumentation depth, so coverage depends on the chosen scope and implementation (e.g., not all container orchestration systems or non-dynamic RBAC changes are guaranteed to be monitored).
- T1098.006prevents — A.8.3 directly requires restricting access via policies, configuration mechanisms, identity/group controls, least-privilege-style grants (read/write/etc.), isolation, and dynamic techniques that enforce granular, time-bound, authenticated, and monitored permissions; this stops the adversary from successfully adding roles/permissions to maintain access in the bulk of RBAC/ABAC cases, but leaves a bounded remainder where the adversary already holds sufficient initial permissions to alter the very policies or bindings the control relies on.
- T1098.007detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the group-addition action or its anomalous privilege outcome in real time or logs; this is limited to a slice because the clause's scope is set by the organization's chosen policies, classification, and monitoring requirements rather than mandating universal coverage of every local/domain group modification.
- T1098.007prevents — A.8.3 restricts access per policy (including dynamic techniques, group/identity controls, and isolation), which can stop an adversary from successfully leveraging added groups for persistence, but does not block the group-addition action itself on a compromised account.
- T1102detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces anomalous or unauthorized use of web services for C2 when those services fall inside the monitored scope or dynamic access rules.
- T1102.001detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access, and raising alerts on misuse attempts, which can surface anomalous resolver-like C2 traffic or data exfiltration to external web services; this is only a slice of the technique (real-time behavioral detection on protected assets) rather than broad discovery of dead-drop posting or redirection itself.
- T1102.002detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous bidirectional C2 traffic over web services when it involves protected assets; this is only a slice of the technique (not all C2 uses monitored sensitive data or triggers the dynamic access layer).
- T1102.002prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, encryption, monitoring, and alerts on misuse) can prevent some uses of legitimate web services for bidirectional C2 by blocking unauthorized outbound access or anomalous posting, but leaves a large remainder where the compromised host is already authorized to reach common services like Google/Twitter that blend into expected traffic.
- T1102.003detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse of protected information, which surfaces anomalous or unauthorized use of web services for one-way C2; this is a genuine but minority slice of the technique (limited to cases where the web service itself is treated as the protected asset under dynamic access management).
- T1105detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous ingress tool transfers (especially via monitored channels or dynamic access systems), but this is only a slice of the broad technique that also includes unmonitored protocols, lateral movement, and non-sensitive-file transfers.
- T1105prevents — A.8.3 restricts access to information/assets via policies, auth, encryption, dynamic controls, and isolation, which can block many ingress vectors (e.g. unauthorized downloads, C2 channels, or syncs to sensitive locations), but leaves open techniques using already-compromised credentials, allowed protocols/utilities, or non-sensitive drop points on the listed platforms.
- T1110detects — A.8.3 explicitly calls for recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface brute-force guessing in real time; this is limited to the subset of T1110 that produces observable access or alertable misuse rather than purely offline hash cracking.
- T1110prevents — A.8.3's access-restriction mechanisms (authentication requirements, dynamic policies based on identity/device/location/time, credential enforcement, and isolation) stop most brute-force guessing from succeeding, with the bounded remainder being offline attacks against already-acquired hashes that the control does not reach.
- T1110.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces password-guessing attempts in real time; this is only a slice because the clause's scope is set by topic-specific policies and classification rather than mandating universal credential-guessing detection across all services and platforms.
- T1110.001prevents — A.8.3 directly requires authentication, access controls, account lockout mechanisms via policy, and dynamic techniques that stop guessing attacks from succeeding (including on services, SSO, and external apps), closing the bulk of the technique while leaving a bounded remainder for exempted/legacy identities and pre-auth network exposures.
- T1110.002prevents — A.8.3's core access-restriction mechanisms (no anonymous access, identity/group-based read/execute controls, authentication requirements, time-bound restrictions, and dynamic policy enforcement) stop most cracked passwords from being usable for login or resource access; the bounded remainder is cracking performed entirely offline on adversary-controlled systems before any protected asset is touched.
- T1110.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces password-spraying attempts in real time or post-facto; partial because the clause sets requirements whose actual scope and instrumentation depth are left to the implementer (e.g., only selected services or logs may be covered).
- T1110.003prevents — A.8.3 mandates access restriction, authentication requirements, dynamic controls based on identity/device/location, and MFA-like mechanisms that stop a sprayed common password from successfully logging in on the bulk of covered services and accounts; the named remainder is legacy protocols, exempted identities, and non-MFA service accounts explicitly allowed by the clause.
- T1110.004detects — A.8.3 explicitly calls for recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface credential-stuffing attempts in flight or in logs; this is limited to what the organization scopes into its dynamic-access or logging mechanisms rather than a universal guarantee across all targeted services and platforms.
- T1110.004prevents — A.8.3 directly requires restricting access per policy (including no anonymous access, identity/group-based controls on read/write/etc., authentication requirements, time-bound restrictions, and dynamic techniques that block unauthorized credential use), which stops credential stuffing from succeeding in most cases even when valid-but-stolen pairs are tried; the named remainder is legacy/exempted accounts or implementations that do not enforce the dynamic rules.
- T1111detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface MFA-interception artifacts (e.g. anomalous credential use or keylogger-like behavior) when dynamic access management is applied; this is only a slice because the clause is scoped to protected sensitive information under dynamic controls rather than broadly detecting all MFA-interception vectors across platforms.
- T1111prevents — A.8.3's access restriction (including dynamic techniques, authentication requirements, encryption, monitoring, and alerts on misuse) can prevent some MFA interception vectors like unsecured out-of-band channels or predictable token replay when properly configured, but leaves residual paths such as keyloggers on the endpoint, compromised service providers, or hardware token proxying that the control does not address.
- T1112detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface Registry modification when it is treated as misuse of sensitive information or configuration assets; this is only a slice of T1112's scope (e.g., stealthy local persistence or obfuscation not tied to monitored high-value info).
- T1112prevents — A.8.3 restricts access to information/assets (including via account permissions, dynamic controls, and isolation of sensitive data/systems) which directly stops many unauthorized Registry modifications that rely on insufficient permissions or unmonitored access paths, but leaves open administrator-level, valid-account, and remote-service cases that the technique routinely exploits.
- T1113detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface screen-capture techniques when they target high-value/sensitive information under dynamic access management; this is only a slice of T1113 because the control is scoped to protected assets rather than all desktop activity.
- T1113prevents — A.8.3's access restriction, isolation of sensitive apps/data, dynamic access controls, authentication requirements, encryption, and misuse alerts can stop the technique from successfully capturing or exfiltrating sensitive screen content in many scenarios, but native utilities and post-compromise execution on non-sensitive desktops remain unaddressed.
- T1114detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface email collection in flight or after the fact; partial because the clause's scope is set by policy and classification (only selected sensitive information and dynamic-access cases), leaving routine email collection on mail servers/clients outside that boundary
- T1114prevents — A.8.3 restricts access to information (including via config mechanisms, identity/group controls, dynamic access management, encryption, time-bound restrictions, and monitoring/alerts on misuse), which can stop adversaries from collecting/forwarding email from servers or clients in many scenarios, but leaves a bounded remainder where email is collected via already-authorized client access, local exfiltration, or non-access-controlled vectors.
- T1114.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface local email collection when it triggers those mechanisms; partial because the clause's scope is set by policy and only covers what the organization classifies/monitors as sensitive, leaving unmonitored .ost/.pst files or non-alerting access outside its reach.
- T1114.001prevents — A.8.3's access restriction (including logical controls, dynamic management, encryption, authentication, and monitoring) can stop an adversary from reading or exfiltrating local .ost/.pst email files when those files are treated as sensitive information under the policy, but leaves a remainder where email data is not classified as high-value, not covered by dynamic techniques, or collected via unmonitored means before restrictions apply.
- T1114.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the technique when it triggers those controls on Exchange/Office 365 email data.
- T1114.002prevents — A.8.3 directly restricts access to information (including email) via policies, identity/group controls, dynamic rules based on identity/device/location, authentication requirements, time-bound access, and monitoring/alerting, which stops credentialed collection techniques like T1114.002 in most cases; the bounded remainder is post-compromise use of fully authorized sessions or unmonitored external SaaS paths.
- T1114.003detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes/access, and raise alerts on misuse attempts, which surfaces the creation or effect of forwarding rules on protected email; this is only a slice of the technique (e.g., not all rule creation, hidden MAPI rules, or transport rules fall inside monitored sensitive information).
- T1114.003prevents — A.8.3's access restriction requirements, configuration mechanisms, identity/group controls, dynamic access management (including rules based on identity/device/location, authentication, time-bound access, encryption, monitoring, and alerts) directly constrain the creation and use of unauthorized forwarding rules that would expose or exfiltrate sensitive email, but this is only a slice: the control depends on policy enforcement, does not reach all platforms or hidden MAPI/transport-rule abuse by admins, and leaves residual paths when credentials are already valid.
- T1115detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface clipboard collection when it involves high-value data under dynamic access management; this is only a slice of T1115's scope (any clipboard data, any platform, non-sensitive cases).
- T1115prevents — A.8.3's access restriction (including dynamic techniques, isolation, auth, encryption, and monitoring) can prevent clipboard collection in some scenarios like sensitive data isolation or real-time misuse alerts, but leaves most platform-level clipboard mechanisms (clip.exe, pbpaste, Get-Clipboard) untouched as they are not inherently tied to the information assets or policies the control governs.
- T1119detects — A.8.3 explicitly requires monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces automated collection activity when it touches protected assets; this is only a slice of T1119 because the control is scoped to information under dynamic access management rather than all internal data collection across every platform and method.
- T1119prevents — A.8.3 restricts access to information (and assets) via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques including auth, time-bound access, encryption, monitoring and alerts; this stops many automated collection paths that rely on reading/copying data the adversary should not reach, but leaves open collection that succeeds via already-authorized identities, unmonitored discovery, or post-compromise abuse of legitimate access.
- T1120detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse of protected information throughout its lifecycle, which surfaces T1120 attempts against peripherals holding or accessing that information (e.g. cameras, smart card readers, removable storage), but the control's scope is limited to information-centric dynamic access rather than general system-wide peripheral enumeration.
- T1123detects — A.8.3 explicitly requires monitoring, reporting, raising alerts on misuse, and recording access/use of protected information throughout its lifecycle; this surfaces T1123 when it targets audio classified as sensitive, but the clause's scope is limited to information the organization has already classified and wrapped with dynamic controls rather than all possible audio capture.
- T1123prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, monitoring/alerting, and isolation of sensitive apps/data) can stop unauthorized malware/scripts from reaching the microphone API or peripheral on many platforms, but leaves a bounded remainder where the capture runs under an already-authorized identity or via legitimate applications that the policy permits.
- T1125detects — A.8.3 explicitly calls for monitoring use of protected information, recording access, and raising alerts on misuse attempts, which surfaces video-capture activity when it touches assets under dynamic access management; this is only a slice of T1125 because the control is scoped to high-value/sensitive information under an organizational classification scheme rather than all peripheral-device video capture.
- T1125prevents — A.8.3's access restriction (including device/application isolation, dynamic controls, authentication, and monitoring) can block unauthorized malware/scripts from accessing camera APIs or devices on Linux/macOS/Windows, but leaves a remainder where legitimate user-authorized apps or bypassed physical/logical controls still allow the technique.
- T1127detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous use of trusted developer utilities as a misuse vector; this is a genuine but minority slice of the technique (most executions are not flagged as misuse of sensitive information).
- T1127prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block many developer-utility proxy executions when they violate policy on sensitive assets or untrusted identities, but signed trusted utilities and reputation hijacking explicitly bypass application controls and are not prevented by access rules alone.
- T1127.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface MSBuild abuse when it touches protected assets or exhibits anomalous behavior, but this is scoped only to information under dynamic access management rather than broadly detecting the technique itself.
- T1127.002detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous ClickOnce proxy execution or related file/behavior activity; this is a genuine but minority slice of the technique (e.g. does not broadly instrument the DFSVC child-process or rundll32 abuse vectors).
- T1127.002prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, dynamic management, authentication, time-bound restrictions, and monitoring/alerts), which can block some abuse vectors like unauthorized installation from web shares or startup folder placement, but does not stop all ClickOnce proxy execution paths (e.g. user-initiated from allowed shares, Rundll32 abuse of trusted dfshim.dll, or limited-permission child processes of DFSVC.EXE).
- T1127.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface JamPlus abuse when it touches protected assets or violates dynamic rules, but the clause is scoped only to information under dynamic access management rather than broadly detecting the build-tool proxy technique itself.
- T1129detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous shared-module loading when it involves protected/sensitive information or violates access rules; this is a genuine but minority slice of the technique (most T1129 executions are not tied to high-value information flows).
- T1129prevents — A.8.3's access restriction rules (identity-based, authentication, dynamic controls, isolation of sensitive apps/data) can stop unauthorized loading of malicious shared modules from arbitrary paths when those modules qualify as sensitive information or reside in protected system/application contexts, but this leaves the bulk of the technique (standard LoadLibrary/dlopen of non-sensitive DLLs/SOs by already-authorized processes) untouched.
- T1133detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces T1133 abuse of exposed remote services (especially authenticated or monitored ones) but only for the subset of cases involving protected/sensitive assets under dynamic controls, not the broad unauthenticated/exposed-service or Tor-hidden-service vectors.
- T1133prevents — A.8.3 restricts access to information/assets per policies (including auth, config mechanisms, dynamic controls, encryption, and isolation of sensitive systems), which prevents many forms of unauthenticated or unauthorized external remote service access but leaves slices like exposed unauthenticated container APIs, Tor hidden services, or post-compromise credential use untouched.
- T1134detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface token manipulation in flight or in logs; partial because the clause sets policy and scope rather than mandating specific instrumentation that reliably catches all Windows token-stealing or impersonation variants.
- T1134prevents — A.8.3's access-restriction mechanisms (including dynamic techniques, authentication requirements, encryption, monitoring, and alerts on misuse) constrain many token-manipulation paths that would otherwise bypass controls, but the control is silent on Windows token APIs, impersonation primitives, and privileged contexts that enable the technique, leaving a substantial remainder.
- T1134.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface token impersonation in flight when it triggers those alerts or logs; this is limited to a slice because the clause sets scope by policy/use-case rather than mandating universal instrumentation of token duplication or impersonation APIs.
- T1134.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including authentication, time-bound restrictions, encryption, monitoring, and alerts) constrain many avenues for token theft and impersonation to succeed, but the control is a requirement-setting clause whose actual coverage depends on implementation choices and leaves residual paths (e.g., unmonitored processes, legacy sessions, or incomplete dynamic enforcement)
- T1134.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous process-creation and token-use behaviors of T1134.002; partial because the clause sets requirements rather than mandating universal instrumentation depth or coverage of all Windows token-creation vectors.
- T1134.002prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts) and isolation directly stop many paths to creating processes under unauthorized tokens, but the control is silent on the prerequisite token acquisition/impersonation steps (T1134.001/003) and on enforcement of least-privilege process creation primitives themselves.
- T1134.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface token creation/impersonation attempts when inside the chosen scope of dynamic access management or logging.
- T1134.003prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, time-bound restrictions and dynamic policy enforcement stop many (but not all) paths to creating and using a forged token to bypass controls, especially where the token creation would require an unauthenticated or insufficiently authorized identity; the remainder is Windows-specific API abuse after credential compromise that the clause does not reach.
- T1134.005detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces SID-History injection when it triggers observable access anomalies or policy violations; partial because the control's scope is set by topic-specific policies and only catches what those policies instrument rather than all instances of the technique.
- T1134.005prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including authentication, time-bound restrictions, encryption, monitoring, and alerts), and isolation of sensitive systems directly constrain SID-History injection by limiting how SIDs grant elevated or lateral access, but only for resources under the policy's scope and not the underlying Domain Admin-level modification itself.
- T1135detects — A.8.3 explicitly requires monitoring, reporting, raising alerts on misuse, and recording access/use of protected information (including dynamic techniques), which can surface network share discovery attempts against sensitive shares; this is only a slice of the technique because most share enumeration (especially non-sensitive or pre-access reconnaissance) falls outside the control's scope.
- T1135prevents — A.8.3 restricts access to information and assets per policies (including via configuration, identity/group controls, isolation, and dynamic techniques like authentication/encryption/time-bounding), which stops many legitimate and adversary queries for shares containing sensitive data but leaves discovery of non-sensitive or misconfigured shares possible.
- T1136detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the creation or anomalous use of a new account; this is only a slice of the technique because the clause is scoped to already-sensitive information and does not mandate detection of account creation itself across all platforms or pre-creation reconnaissance.
- T1136prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, dynamic management (auth, time-bound, encryption, monitoring/alerts), which can block unauthorized account creation in many scenarios (esp. cloud/identity-provider platforms) but leaves a large remainder (local accounts, sufficient-privilege creation, non-sensitive systems, implementation-dependent enforcement).
- T1136.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface the creation or anomalous use of a local account; this is limited to a slice (post-creation activity or monitored identities) rather than reliably detecting the account-creation command itself across all platforms and vectors.
- T1136.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, and dynamic management (including real-time monitoring/alerting) constrain creation of unauthorized local accounts in many scenarios, but do not stop an adversary who already holds sufficient privileges (as the technique explicitly requires) from running net user /add, useradd, or equivalent.
- T1136.002prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, dynamic management, authentication, and encryption), which can block adversaries from gaining the sufficient level of access needed to run net user /add /domain and create the account; this is only a slice of the technique because the control does not address prerequisite compromises, local account creation, or all paths to sufficient privileges.
- T1136.003detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the creation or anomalous use of a cloud account; this is limited to a slice (post-creation detection via logs/alerts) rather than reliably detecting the account-creation act itself across all cloud platforms and service-account variants.
- T1136.003prevents — A.8.3 restricts access to information/assets via policies, configuration, identity/group controls, dynamic management, authentication, time-bound restrictions, encryption, monitoring and alerts, which can stop many (but not all) adversary-created cloud accounts from being usable for persistence or further access on IaaS/SaaS/identity platforms.
- T1137detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces Office-application startup abuse when it occurs inside the monitored scope; partial because the clause sets scope by policy rather than mandating universal instrumentation of every Office feature or macro execution path.
- T1137prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, encryption, time-bound access, monitoring/alerts), which can block some Office startup persistence vectors (e.g. unauthorized add-in/macro loading or rule creation) but leaves many others (e.g. legitimate user abuse of templates/forms or Office 365 mechanisms) untouched.
- T1137.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous macro/template activity once it executes; this is a genuine but minority slice of the technique (e.g. does not address pre-execution registry/search-order hijacks or macro-enablement without runtime misuse).
- T1137.001prevents — A.8.3's access restriction (including dynamic techniques, authentication, encryption, monitoring, and isolation of sensitive data) can block unauthorized modification of templates or macro execution on startup in many configurations, but does not stop all vectors such as registry hijacking, trusted locations, or macro policy bypasses.
- T1137.002detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface the anomalous Office Test registry addition or DLL load at runtime; this is only a slice because the clause scopes to high-value/sensitive information under dynamic access management rather than all persistence mechanisms on a host.
- T1137.002prevents — A.8.3's access restriction rules (including Registry/configuration controls, identity-based permissions, isolation of sensitive apps/data, and dynamic techniques that can block unauthorized Registry-driven DLL loading at Office start) stop the Office Test persistence technique in many configurations, but the control is scoped to information/assets and leaves open cases such as local admin abuse of the global HKLM key or non-sensitive Office contexts.
- T1137.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces the loading/execution of malicious Outlook forms when they touch monitored sensitive information or mailboxes; this is a genuine but minority slice of the technique (most executions are not information-centric and fall outside the clause's dynamic-access-management scope).
- T1137.003prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, dynamic techniques, authentication, time-bound restrictions, encryption, monitoring/alerting), which can block addition/execution of malicious Outlook forms in some configurations (e.g. no anonymous access, dynamic rules on identity/device, alerts on misuse), but leaves a large remainder where forms are added via authorized user sessions or email without violating the access rules.
- T1137.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous loading of a malicious Outlook Home Page URL; this is a genuine but minority slice of the technique (real-time alerts on misuse vs. the broader persistence mechanism itself).
- T1137.004prevents — A.8.3's access restriction rules (including dynamic techniques, authentication requirements, isolation of sensitive apps/data, and monitoring/alerting on misuse) can stop the adversary from adding or loading a malicious Outlook Home Page URL in the first place on covered systems, but this is only a slice because the control is scoped to sensitive/high-value information per policy and classification rather than all mailboxes or legacy Outlook features universally.
- T1137.005detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces the anomalous rule creation or triggered execution in a monitored mailbox; partial because the clause's scope is limited to information/assets the organization has classified as needing dynamic access management rather than all Outlook rules on all endpoints.
- T1137.005prevents — A.8.3's access-restriction mechanisms (including dynamic rules based on identity/device/location, authentication requirements, time-bound access, and monitoring/alerting) can stop an adversary from adding or triggering malicious Outlook rules on a mailbox, but this is only a slice of the technique's attack surface (e.g., post-compromise local rule manipulation by an already-authenticated user or via other Office vectors remains unaddressed).
- T1137.006detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface add-in based persistence when it triggers anomalous access or execution; this is a genuine but minority slice of the technique (most add-in loading is not misuse of high-value dynamic-protected information).
- T1137.006prevents — A.8.3's access restriction rules (including dynamic techniques, authentication, time-bound access, monitoring/alerting, and isolation of sensitive applications/data) can stop unauthorized add-in registration/execution at Office startup on Windows/Office Suite, but this is only a slice — the control is scoped to sensitive information/assets and does not broadly prohibit add-in abuse for persistence in all cases.
- T1176detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface malicious extension installation or anomalous behavior, but this is scoped only to the information/assets protected by dynamic access controls rather than broadly detecting the technique itself across all extensions and platforms.
- T1176prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts) that can block malicious extension installation/permissions on sensitive data or apps, but does not stop the core technique of loading/abusing extensions in unmonitored or non-sensitive contexts.
- T1176.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces malicious browser-extension behavior once installed and active; this is a genuine but minority slice of the technique (installation vectors, file manipulation, and pre-execution persistence are unreached).
- T1176.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, and dynamic techniques (e.g. limiting install/update paths, permissions, and execution) can stop many installation and abuse vectors for malicious browser extensions, but leave open social engineering, pre-compromise file manipulation, app-store bypasses, and user-granted permissions on unmanaged browsers.
- T1176.002detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces malicious or anomalous IDE extension behavior in flight; partial because the clause's scope is set by topic-specific policies and classification (only high-value/sensitive information triggers the full dynamic management and alerting stack, leaving non-sensitive or unclassified IDE usage as an open slice).
- T1185detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface browser-session hijacking in flight when it touches protected information; this is only a slice of the technique (e.g., limited to monitored sensitive assets and not the injection or proxy-pivoting mechanics themselves).
- T1185prevents — A.8.3's access restriction (including dynamic techniques, isolation, credential requirements, and monitoring) can stop unauthorized inheritance or assumption of browser sessions/permissions in some scenarios, but leaves open injection into the browser process itself and does not reach the technique's core exploitation of browser software vulnerabilities or inherent functionality.
- T1187detects — A.8.3 explicitly requires raising alerts on detected misuse of information and recording access/use throughout the lifecycle, which surfaces forced-authentication attempts that reach monitored sensitive resources, but the clause's scope is limited to information assets under dynamic access management rather than all credential-interception vectors such as arbitrary SMB/WebDAV coercion or .LNK/.SCF files.
- T1187prevents — A.8.3's access-restriction rules, configuration mechanisms, authentication requirements, and dynamic controls (including time-bound, identity/device-based, and encryption) can stop many forced-authentication vectors by refusing anonymous/unknown access or blocking outbound credential transmission to untrusted resources, but they leave a remainder where legitimate internal SMB/WebDAV/EFSRPC flows or misconfigured shares still allow the technique.
- T1189detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface drive-by delivery or anomalous browser behavior; this is only a slice of the full technique (e.g., does not address pre-compromise website reconnaissance or the initial visit itself).
- T1189prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound access, encryption, monitoring/alerts) that can block unauthorized delivery/execution of drive-by payloads on client systems, but leaves open vectors like unpatched browsers, user-enabled scripting/notifications, watering-hole sites without sensitive data, and non-information assets.
- T1190prevents — A.8.3 restricts access to information/assets per policies (including no anonymous/sensitive access, config mechanisms, identity/group controls, isolation, dynamic techniques with auth/encryption/time-bound rules and monitoring), which stops many misconfigurations and weak IAM paths that enable T1190 but does not address software bugs, glitches, or non-access-control flaws like those in OWASP/CWE top lists.
- T1197detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous BITS job creation/execution when those jobs touch monitored information or deviate from policy; this is only a slice of the technique (e.g. not all BITS abuse involves detectable misuse of high-value data).
- T1199detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous third-party behavior once the trusted relationship is leveraged; this is a genuine but minority slice of the technique (real-time detection of the abuse vs. the broader supply-chain trust compromise itself).
- T1199prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including identity/device/location rules, authentication, time-bound access, encryption, monitoring, and alerts) directly constrain how third-party trusted relationships are granted, limited, and used, stopping many abuse paths; however, the technique can still succeed via compromise of a valid account that was legitimately granted under policy or via relationships outside the organization's direct control.
- T1202detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface indirect command execution when it touches protected/sensitive assets or violates dynamic access rules, but this is scoped only to monitored high-value information rather than the technique in general.
- T1204detects — A.8.3's dynamic access management explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface user execution of malicious payloads or anomalous access; this is only a slice of the broad social-engineering/user-action technique (e.g., it misses non-access-linked execution or pre-execution deception).
- T1204prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, encryption, auth, time-bound controls and monitoring) which can stop a user from reaching or opening malicious files/links in some scenarios, but the technique is driven by social engineering that succeeds before any access restriction is evaluated and many vectors (e.g. manual copy-paste, browser JS, enabling RATs) sit outside its scope.
- T1204.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface a user clicking a malicious link when it involves protected assets; this is only a slice of the technique (not all malicious links target monitored sensitive info or trigger the dynamic access layer).
- T1204.001prevents — A.8.3 restricts access to information/assets via policies, auth, dynamic controls, encryption, and monitoring, which can block malicious-link payloads from executing in many cases (e.g. no anonymous access, time-bound/dynamic restrictions, or alerts on misuse), but leaves open social-engineering clicks that trigger browser/app exploits or downloads outside the restricted information set.
- T1204.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the user action of opening a malicious file (especially when masqueraded or placed in shared locations), but this is scoped only to information under dynamic access management rather than all file-execution events on Linux/macOS/Windows.
- T1204.002prevents — A.8.3's access restrictions (including dynamic techniques, authentication, encryption, time-bound access, and monitoring) can stop a user from opening a malicious file in many scenarios (e.g. unknown/anonymous sources, shared dirs, or high-value data), but this is only a slice: the technique relies on social engineering + user action on already-delivered files, and A.8.3 does not constrain all delivery vectors, all file types, or all user behaviors.
- T1204.003detects — A.8.3 explicitly requires monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces malicious or anomalous image deployment/execution in dynamic access management scenarios, but this is scoped only to protected sensitive information under policy rather than broadly detecting all backdoored public images or naming tricks across IaaS/containers.
- T1204.003prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, auth, encryption, monitoring, and isolation of sensitive data), which can stop users from pulling/running malicious public images in some scenarios, but leaves open user-driven deployment of named or trusted-looking images in IaaS/containers where access controls do not govern the execution step itself.
- T1204.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the social-engineering vector or anomalous paste/execute behavior when it touches protected information; this is a genuine but minority slice of the technique (most instances never reach monitored sensitive assets).
- T1205detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes that surface anomalous traffic-signaling packets or sequences when they match the defined rules or dynamic policies.
- T1205.001detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous port-knocking sequences used to trigger hidden C2 or persistence ports.
- T1205.002detects — A.8.3 explicitly calls for monitoring use of protected information, recording access, and raising alerts on misuse attempts, which would surface anomalous packets or filter-triggered actions when the socket filter is used against information under dynamic access management; this is only a slice of the technique because the control is scoped to sensitive/valued information under its policies rather than all raw socket or libpcap activity.
- T1207detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface rogue-DC registration or anomalous AD replication as misuse of high-value directory information, but only where dynamic access management or logging scope is implemented and the activity is observable.
- T1207prevents — A.8.3's access restriction (including dynamic techniques, authentication, time-bound controls, encryption, monitoring, and alerts) can block unauthorized registration or replication by a rogue DC in some scenarios, but the technique's core reliance on already-compromised admin/KRBTGT privileges and schema manipulation is outside the control's reach.
- T1210detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous remote service exploitation attempts or lateral movement in real time; this is a genuine but minority slice of the technique (focused on post-auth access/use rather than vuln discovery, patch gaps, or the exploit itself).
- T1210prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts), which can block many exploitation paths to remote services; however, it does not address the root programming errors/vulnerabilities (e.g. in SMB/RDP/MySQL/VMware) that the technique exploits, nor discovery of vulnerable states.
- T1212detects — A.8.3 explicitly requires monitoring, recording of access/use, raising alerts on misuse, and operational reporting processes, which can surface exploitation attempts against credentialing mechanisms (e.g. anomalous auth or replay behavior) but only for the subset of techniques that produce observable access events rather than silent exploitation of a vuln.
- T1212prevents — A.8.3's access-restriction mechanisms (authentication requirements, dynamic policy enforcement, credential protection via encryption/time-bounding, and isolation of sensitive credential stores) stop many exploitation paths that rely on weak or anonymous credential access, but do not address the root programming errors or kernel-level vulnerabilities that the technique exploits.
- T1213prevents — Enforcing per-user read/write controls and encryption on information repositories limits the data an adversary who has gained a foothold can silently collect from collaboration platforms or databases.
- T1213detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces adversary mining or external sharing in repositories; partial because scope is limited to high-value sensitive information under dynamic access management rather than all repositories or all T1213 vectors (e.g. broad unauthenticated access to non-sensitive stores).
- T1213.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces the technique when it triggers those controls on a protected Confluence instance; partial because the clause sets scope by policy and classification rather than mandating universal instrumentation of every repository or anonymous mining path.
- T1213.001prevents — A.8.3 directly restricts access to information and assets (including via policies, config mechanisms, identity/group controls, dynamic management, authentication, encryption, time-bound restrictions, monitoring/alerting) which stops adversaries from leveraging Confluence to mine the listed sensitive items; mostly because the control is scoped to the organization's own Confluence instances and does not reach public SaaS instances an adversary might target externally.
- T1213.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces the technique when it occurs inside the protected SharePoint instances; this is a genuine but minority slice because the clause's scope is set by the organization's chosen policies, classification, and dynamic-management decisions rather than mandating universal instrumentation of all SharePoint mining.
- T1213.002prevents — A.8.3 directly restricts access to information in repositories like SharePoint (via policies, config mechanisms, identity/group controls, dynamic techniques, authentication, time-bound restrictions, encryption, monitoring, and alerts), stopping the adversary from mining the listed sensitive items; mostly because anonymous/unknown-user slices and imperfect real-time enforcement leave a bounded remainder.
- T1213.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces the repository access and collection technique in flight; partial because the clause's scope is set by the organization's chosen policies, classification, and dynamic-management decisions rather than mandating universal coverage of all code-repository interactions.
- T1213.003prevents — A.8.3's core purpose, guidance on restricting access per policies, controlling identities/groups/permissions (read/write/etc.), isolating sensitive data, and dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts) directly stops adversaries from gaining the repository access needed to collect proprietary code or credentials, with the bounded remainder being post-compromise credential abuse or insider threats that bypass the access rules.
- T1213.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces the mining of CRM data once the adversary is inside and interacting with the system; this is only a slice of the technique because detection is scoped to configured dynamic-access or sensitive-data flows rather than all CRM mining.
- T1213.004prevents — A.8.3 directly restricts access to information and assets (including CRM-stored PII) via policies, configuration, identity/group controls, dynamic management, authentication, encryption, time-bound restrictions, monitoring, and alerts, stopping the adversary from mining once initial access is gained; mostly because on-premises/cloud CRM instances and dynamic techniques still leave a bounded remainder where misconfiguration or incomplete policy enforcement can allow access.
- T1213.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface adversary mining of messaging apps (especially when it triggers misuse rules or anomalous access patterns); partial because the control's scope is set by policy and use-case rules rather than mandating universal coverage of all chat platforms or exfiltration techniques.
- T1213.005prevents — A.8.3 restricts access to information (including via config mechanisms, identity/group controls, dynamic techniques, encryption, monitoring and alerts) which can stop the adversary from successfully mining data in messaging apps, but only for a slice of cases (e.g. properly classified sensitive data under dynamic controls) while leaving the bulk of routine chat mining (unclassified snippets, links, credentials in everyday Teams/Slack use) untouched.
- T1213.006detects — A.8.3 explicitly requires recording access, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface database mining in real time or after the fact; this is limited to a slice (only where dynamic access management or logging is scoped in and active) rather than broadly instrumenting all database access across on-prem/cloud/SaaS without additional controls.
- T1213.006prevents — A.8.3 directly restricts database access via policies, config mechanisms, identity/group controls, authentication, encryption, time-bound restrictions, and dynamic rules based on identity/device/location — stopping the adversary technique from succeeding in most on-prem/cloud/SaaS cases, with a bounded remainder for misconfigurations or insider abuse that still allows mining.
- T1216detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface proxy execution of malicious files via trusted scripts when those touch protected/sensitive information under dynamic access management; this is a genuine but minority slice of the technique (most T1216 abuse occurs outside monitored high-value assets or without triggering the alerts).
- T1216prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including auth, time-bound restrictions, encryption, monitoring, and alerts), and isolation of sensitive apps/data can stop many proxy-execution abuse paths that rely on unauthorized or uncontrolled script/file access, but cannot prevent all signed-trusted LOLBIN proxy cases that occur inside already-authorized sessions or via unaddressed execution policy gaps.
- T1216.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous PubPrn abuse when it touches protected assets; this is only a slice of the technique's possible executions.
- T1216.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous invocation of SyncAppvPublishingServer.vbs as a signed proxy for restricted PowerShell; this is a genuine but minority slice of the technique's full attack surface (e.g., does not instrument all possible living-off-the-land variants or non-monitored execution paths).
- T1217prevents — A.8.3 restricts access to information and assets (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic techniques, encryption, and monitoring), which can stop adversaries from reading browser-stored data in files/databases on Linux/macOS/Windows; partial because the control is scoped to sensitive/classified information per policy and does not universally block all local browser artifact access post-compromise.
- T1218detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface proxy execution of malicious content via trusted binaries when it involves sensitive information under dynamic access controls; this is only a slice of the broad technique (which is not inherently about sensitive data or monitored assets).
- T1218.001detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces anomalous CHM-based execution or payload activity when it occurs within the monitored scope.
- T1218.001prevents — A.8.3's access restriction (including dynamic techniques, authentication, time-bound limits, encryption, monitoring/alerts, and isolation of sensitive apps/data) can stop .chm abuse when the file is treated as sensitive information under policy, but leaves a large remainder for non-sensitive delivery vectors, user-triggered execution, and legacy hh.exe bypasses that the clause does not address.
- T1218.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous execution or registration of malicious .cpl items; this is a genuine but minority slice of the technique (delivery/execution paths, registry abuse, allow-list bypass) rather than broad coverage of all variants.
- T1218.002prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts); this can block some abuse vectors like unauthorized .cpl registration/execution or phishing delivery to sensitive contexts, but leaves the bulk of the technique (proxy execution via legitimate control.exe, renamed DLLs, registry abuse, and bypass of allow lists) untouched as it is not an information-access restriction.
- T1218.003detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces CMSTP abuse when it triggers those observables (e.g. anomalous execution or access patterns), but the clause's scope is limited to information assets and dynamic access management rather than all signed-binary proxy execution.
- T1218.003prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring, alerts); this can block malicious INF files or remote SCT/DLL loads in many cases but leaves a slice for signed legitimate binaries, UAC bypass via auto-elevated COM, and non-information-access vectors of the technique.
- T1218.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface InstallUtil proxy execution when it touches protected information or violates dynamic rules; this is a genuine but minority slice of the technique's possible executions (most uses are not information-centric or inside monitored dynamic-access flows).
- T1218.004prevents — A.8.3's access restriction rules (including dynamic techniques, authentication, time-bound access, encryption, monitoring, and alerts) can stop InstallUtil from being invoked against sensitive .NET binaries or from successfully proxying unauthorized code, but this is only a slice — the control does not reach unsigned binaries, non-sensitive locations, or the core signed-trusted-utility bypass mechanism itself.
- T1218.005detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous mshta.exe proxy execution when it involves protected/sensitive information or violates dynamic access rules; this is only a slice of the technique's possible uses.
- T1218.005prevents — A.8.3's access-restriction mechanisms (authentication, dynamic rules based on identity/device/location, isolation of sensitive apps/data, and configuration controls) can stop mshta.exe from executing untrusted HTA/JS/VBS payloads in many deployment scenarios, but the control is silent on application allow-listing, signed-binary behavior, or browser-context bypasses that the technique explicitly relies on.
- T1218.007detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface msiexec abuse when it touches protected/sensitive information or violates dynamic access rules; this is a genuine but minority slice of the technique (most msiexec abuse is not information-centric).
- T1218.007prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, dynamic techniques, authentication, time-bound restrictions, and monitoring) can stop msiexec abuse for payload proxying in many configurations, but leaves a bounded remainder where AlwaysInstallElevated is enabled or where the technique bypasses application control via a signed native binary.
- T1218.008detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface odbcconf.exe abuse when it touches protected assets or exhibits anomalous behavior, but this depends on scope, classification, and dynamic management configuration rather than broadly detecting the signed binary's proxy execution.
- T1218.008prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts); this can block unauthorized execution of malicious payloads via signed binaries like odbcconf.exe in some scenarios (e.g. via app isolation or dynamic restrictions), but leaves a large remainder for living-off-the-land binaries that are permitted by policy or not classified as sensitive information.
- T1218.009detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces anomalous proxy execution or unauthorized code run via signed utilities; partial because the clause's scope is set by topic-specific policies and only covers information/assets under its dynamic or configured controls, not all instances of this technique.
- T1218.010detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface Regsvr32 abuse (especially anomalous network/proxy use or unauthorized DLL/COM loading), but this is scoped only to the subset of information assets under dynamic access management rather than broadly detecting the technique itself.
- T1218.010prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts) and isolation of sensitive applications can stop many abuse paths of a signed binary like Regsvr32 (e.g. blocking unauthorized DLL/COM loads or network scriptlets under policy), but cannot prevent all legitimate Windows use or every bypass vector, leaving a genuine minority slice unaddressed.
- T1218.011detects — A.8.3 explicitly requires monitoring use of protected information, recording access, and raising alerts on misuse attempts, which surfaces some proxy-execution and anomalous rundll32 activity when it touches sensitive assets under dynamic access management, but the clause is scoped only to information-centric monitoring rather than general process or LOLBin execution.
- T1218.011prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block many unauthorized rundll32.exe proxy executions of malicious DLLs/scripts, but do not stop all variants (e.g., signed system DLL abuse, masquerading, ordinal exports, or legitimate-looking rundll32 activity that evades policy enforcement).
- T1218.012detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous proxy execution via a signed binary like verclsid.exe; partial because the clause scopes this to high-value sensitive information under dynamic access management rather than all proxy/abuse techniques on Windows.
- T1218.012prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including authentication, time-bound restrictions, encryption, monitoring, and alerts), and isolation of sensitive applications can block unauthorized proxy execution via verclsid.exe in many scenarios, but the control is a broad requirement-setting clause whose actual coverage depends on implementation choices and does not inherently address all COM/CLSID abuse paths or signed native binaries.
- T1218.013detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface mavinject.exe abuse when it triggers those rules or alerts; this is limited to the subset of executions that match configured detection criteria rather than all instances.
- T1218.013prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts); this can prevent some abuse vectors of a signed binary like mavinject.exe (e.g. via least-privilege, isolation of sensitive processes, or dynamic controls on DLLs), but leaves the bulk of the technique (abusing a legitimate signed utility for injection) untouched.
- T1218.014detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface MMC abuse (e.g. anomalous .msc execution or registry tampering) when the technique is in scope of the configured dynamic access management; it is not required to instrument all possible MMC usage vectors.
- T1218.014prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring, alerts); this stops many abuse paths of mmc.exe/.msc/CLSID but leaves a bounded remainder (e.g. already-authenticated admin contexts, unmanaged snap-ins, or non-sensitive .msc execution)
- T1218.015detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface Electron abuse (e.g. anomalous child processes or planted JS) when it involves protected assets; this is only a slice because the control is scoped to information assets under dynamic access management rather than broadly instrumenting all Electron framework behaviors.
- T1219detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces post-compromise RAT usage when it touches protected assets; this is only a slice of the technique (not all RAT activity is on high-value info or triggers the dynamic mechanisms).
- T1219prevents — A.8.3 restricts access to information/assets via policies, auth, dynamic controls, encryption, monitoring and isolation, which can block many legitimate RAT install/execution paths (especially post-compromise C2 or malware use of them); it does not stop all legitimate remote management tools or their abuse where they inherit permitted user permissions or fall outside the scoped information.
- T1219.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces IDE tunneling when it triggers those observables (especially via developer portals or anomalous remote sessions); this is only a slice because the clause's scope is limited to information assets under dynamic access management rather than all network or process anomalies from IDE extensions or auto-reconnect persistence.
- T1219.001prevents — A.8.3 restricts access to information/assets via policies, auth, config controls, dynamic rules (identity/device/location), and encryption, which can block unauthorized IDE tunneling sessions or their C2/persistence use on developer assets in many cases, but leaves a large remainder where legitimate developer workflows, extensions, or auto-reconnect are permitted.
- T1219.002detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse of protected information, which surfaces adversary use of remote desktop tools when they touch or transit sensitive assets under dynamic access management; this is a genuine but minority slice of the technique (most legitimate RMM use does not involve high-value sensitive data).
- T1219.002prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts); this can block unauthorized use of remote desktop tools for C2 on some platforms/paths but leaves legitimate-allowed RMM software, built-in modules (e.g. Chrome Remote Desktop), and non-access-control vectors as a large unaddressed slice.
- T1219.003detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces hardware-based remote access (especially dynamic/granular controls and logging of who/how), but only for information-centric or policy-scoped assets rather than all post-compromise hardware C2 channels.
- T1219.003prevents — A.8.3's access restriction (including physical/logical isolation of systems, no anonymous access, dynamic controls based on identity/device/location, and monitoring/alerting) can stop post-compromise installation/use of remote access hardware on covered assets, but leaves a bounded remainder where hardware is pre-installed, permitted by peripheral policies, or outside the dynamic management scope.
- T1220detects — A.8.3 explicitly calls for recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous XSL/script-processing behavior when it occurs within the organization's monitored scope.
- T1221detects — A.8.3 explicitly calls for dynamic access management to monitor use, record changes, raise alerts on misuse, and require authentication/credentials, which surfaces template-injection attempts that trigger remote fetches or forced auth; this is a genuine but minority slice of the technique (most delivery and concealment occurs before any monitored access event).
- T1221prevents — A.8.3's access-restriction mechanisms (authentication requirements, dynamic rules based on identity/device/location, encryption, time-bound access, monitoring/alerting on misuse) can stop the malicious template reference from being successfully fetched or executed in many deployment scenarios, but the control does not address the document-modification vector itself nor block all delivery paths (e.g. phishing) or legacy RTF binary edits.
- T1222detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces T1222 permission modifications when they occur on monitored sensitive assets; this is only a slice (dynamic management and high-value info) rather than the bulk of the technique across all files/directories.
- T1222prevents — A.8.3's access restriction rules, ACL controls, dynamic management, and encryption directly stop many permission-modification paths that would otherwise let adversaries evade or alter ACLs on files/directories, but the control is silent on elevated-privilege prerequisites, ownership changes, and platform-specific symbolic-link behaviors that still enable the technique.
- T1222.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes for dynamic access management, which surfaces adversary permission modifications when they trigger those controls; this is only a slice of the broad technique (many modifications are silent and local, outside monitored dynamic systems).
- T1222.001prevents — A.8.3 restricts access per policies, configures mechanisms to control who/what can read/write/execute, isolates sensitive data, and uses dynamic techniques (auth, time-bound, encryption, alerts) that can stop many Windows DACL modifications from succeeding or granting unauthorized access; it does not stop all adversary use of icacls/takeown/etc. on every object or pre-empt every persistence follow-on.
- T1222.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes for dynamic access management, which surfaces permission changes or anomalous access on protected Linux/macOS objects within the scoped, authenticated environment.
- T1222.002prevents — A.8.3's access restriction rules, ACL controls, dynamic management, authentication, time-bound access, and encryption directly stop many permission-modification paths that would otherwise let an adversary evade or bypass ACLs on Linux/macOS, but do not block all (e.g., an already-authenticated local actor with sufficient rights can still run chown/chmod).
- T1484detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces policy-modification attempts when they involve protected assets, but this is scoped only to high-value data under dynamic controls rather than broadly detecting all domain/tenant policy changes (e.g. GPO or trust mods outside that scope).
- T1484prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth requirements, and controls on identities/groups/permissions), which stops many unauthorized modifications to domain/tenant policies like GPOs or trusts; however, it does not address the prerequisite privilege escalation or sufficient permissions needed to perform the technique itself.
- T1484.001detects — A.8.3 explicitly requires recording who accesses information and how it is used plus raising alerts on misuse attempts, which surfaces GPO modification when the GPO files or objects fall inside the monitored scope; the remainder is that the clause sets scope by policy rather than mandating universal instrumentation of every GPO write.
- T1484.001prevents — A.8.3's access restriction rules, delegation controls, authentication requirements, and dynamic techniques directly constrain who can write or modify GPOs (and the SYSVOL files they contain), stopping the technique from succeeding in most delegated or sensitive-policy scenarios, but leave open the default read+write permissions granted to all domain users and the possibility of compromise via other vectors before restriction is applied.
- T1484.002detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface trust modifications that affect authentication/authorization properties or produce anomalous access patterns; however, the control is scoped to information assets and dynamic access decisions rather than comprehensively covering all trust-configuration changes across identity providers or domains.
- T1484.002prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, dynamic access rules (identity/device/location), authentication requirements, and encryption, which can block unauthorized trust modifications that rely on altering auth/authorization properties to gain illicit access; however, it does not address the administrative acts of adding/modifying domain trusts or federated providers themselves.
- T1485detects — A.8.3 explicitly calls for monitoring use of information, recording changes, and raising alerts on misuse attempts, which surfaces data-destruction activity once the adversary has obtained access and begins acting on files; this is a genuine but minority slice of the technique (most T1485 executions are silent overwrites or deletes that never trigger an access-control alert).
- T1485prevents — A.8.3 restricts access to information/assets (including via auth, dynamic controls, encryption, and isolation) which stops many unauthorized deletion paths, but does not block all (e.g. insider/privileged destruction, already-authenticated malware, or non-access-based wipes).
- T1485.001detects — A.8.3 explicitly requires monitoring, reporting, recording of access/use, and raising alerts on misuse attempts, which surfaces lifecycle-policy changes or anomalous deletion configurations in covered dynamic-access or monitored storage environments; however, the control's scope is limited to information under dynamic management or topic-specific policies rather than all cloud lifecycle APIs.
- T1485.001prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth, time-bound restrictions, and monitoring), which can stop unauthorized modification of lifecycle policies on cloud buckets; however, it is a policy+mechanism framework whose effectiveness depends on implementation details like correct permission granularity and coverage of all identities/devices, leaving a genuine slice of the technique (e.g., misconfigurations or insider abuse) unaddressed.
- T1486detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces ransomware encryption activity on covered assets, but only for information already under its dynamic access controls rather than the broad technique itself.
- T1486recovers — A.8.3 explicitly requires dynamic access management that includes recording access/changes, raising misuse alerts, using encryption, and (most relevantly) protecting information throughout its full life cycle including disposal; this directly supports post-ransomware recovery processes that restore availability of encrypted data via controlled decryption or backup integration, though it stops short of mandating actual backup or full state restoration mechanisms.
- T1489detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of protected information; this surfaces service-stop attempts that target such assets (especially in cloud or high-value scenarios), but the control is scoped only to information assets under dynamic management rather than all service-stop activity across platforms.
- T1490detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, and raise alerts on misuse attempts, which would surface T1490 actions (e.g. deleting shadow copies or backup policies) when performed against protected recovery assets; this is only a slice of the technique's scope rather than the bulk.
- T1490recovers — A.8.3 explicitly requires backup/recovery-oriented dynamic access controls (isolation, time-bound access, encryption, monitoring, alerts, and lifecycle protection of recovery assets), which directly enable restoration of state after T1490 has deleted or disabled recovery features; the named remainder is that it does not itself perform the restore action.
- T1491detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces defacement (a post-breach integrity violation of visual content) when it triggers those controls, but only for the subset of cases that involve monitored sensitive information under dynamic access management rather than arbitrary external/internal defacement.
- T1491prevents — A.8.3 restricts access (including write/execute) to authorized identities, controls dynamic permissions, and uses encryption/authentication to block unauthorized modification of content throughout its lifecycle, but does not stop authenticated insiders or compromised accounts from defacing visual assets they are legitimately permitted to reach.
- T1491.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface defacement (especially post-intrusion changes to websites, login messages, or wallpapers) when it triggers those alerts or logs; this is only a slice because the clause's dynamic-access focus and scope are set by policy rather than mandating broad change-detection coverage across all internal assets.
- T1491.001prevents — A.8.3 restricts access (including write/execute) to information and assets via policies, config, auth, encryption, and dynamic controls, which stops many post-intrusion defacement vectors on internal systems/websites/wallpapers; partial because it does not block all paths (e.g., already-authenticated sessions, exploited processes, or physical access on supported platforms).
- T1491.002detects — A.8.3 requires monitoring, reporting, alerts on misuse, and recording of access/use throughout the information lifecycle, which can surface defacement attempts or changes to externally-facing assets when those assets fall inside the monitored scope and classification rules.
- T1496detects — A.8.3 explicitly requires monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface resource-abuse indicators (e.g. anomalous compute, bandwidth, or messaging patterns) when the hijacked asset falls inside the monitored scope; this is a genuine but minority slice of T1496's forms and platforms.
- T1496.001detects — A.8.3 requires monitoring and raising alerts on misuse of information (including dynamic access management for high-value assets), which can surface compute hijacking when it involves unauthorized resource consumption or anomalous access patterns, but this is limited to information-centric cases rather than general compute abuse across all platforms and scenarios in the technique.
- T1496.002detects — A.8.3 requires monitoring, recording of access/use, and raising alerts on misuse of protected information, which can surface anomalous bandwidth consumption when it involves monitored sensitive data or dynamic access violations, but the control's scope is limited to information assets under access restriction rather than general network bandwidth abuse or botnet activity.
- T1496.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface SMS-pumping abuse of messaging/OTP forms; partial because the clause's scope is set by topic-specific policies and chosen use-cases rather than mandating detection of this specific fraud vector on all messaging channels.
- T1496.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface hijacking of SaaS for resource abuse (e.g. anomalous bulk sending or LLM calls); partial because the clause's scope is set by policies and use cases rather than mandating universal coverage of all SaaS hijacking vectors.
- T1496.004prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, time-bound access, monitoring/alerting, and credential enforcement) stops unauthorized SaaS enablement or abuse in many scenarios, but leaves a remainder where the adversary already holds valid compromised credentials or legitimate user sessions that satisfy the controls.
- T1498.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces anomalous high-volume network traffic as part of dynamic access management for sensitive information throughout its lifecycle.
- T1499.002detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous resource-exhausting floods against protected services when those align with the dynamic access management's scope; this is only a slice of the technique's surface (e.g., non-information-service targets or pre-auth floods remain unseen).
- T1499.003detects — A.8.3 explicitly requires monitoring use of protected information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous resource-exhausting requests against protected assets but does not broadly instrument or guarantee detection of the technique across all applications or platforms.
- T1505detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces the installation and use of a malicious server component; this is only a slice of the technique (post-install runtime detection on monitored systems, not the install act itself or components outside the access-controlled scope).
- T1505prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts), which can block unauthorized installation/abuse of malicious server components on covered platforms; however, it is scoped to information access rather than all extensible server features or developer/installer pathways, leaving a nameable remainder.
- T1505.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface malicious stored-procedure creation or invocation; this is only a slice of the technique (post-creation detection, not the initial crafting or CLR assembly loading itself).
- T1505.001prevents — A.8.3 restricts access to information/assets (including via auth, config mechanisms, dynamic rules on identity/device/location, and isolation of sensitive apps/data), which can block unauthorized crafting or invocation of malicious stored procedures in some database scenarios but leaves many vectors (e.g. privileged insiders, enabled CLR/xp_cmdshell by authorized admins, or post-compromise execution) untouched.
- T1505.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous transport-agent registration or email-triggered behavior, but this is scoped only to the dynamic-access slice of sensitive information rather than broadly detecting the persistence technique itself.
- T1505.003detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces web shell activity once present on an accessible server; this is only a slice because the clause's scope is set by policy and does not mandate instrumentation of all possible web shell indicators or deployment vectors.
- T1505.003prevents — A.8.3's access-restriction mechanisms (authentication, dynamic controls, isolation, credential requirements) can stop an adversary from placing or using a web shell on an openly accessible server, but this is only a slice: the control does not reach server misconfigurations, unpatched upload paths, or the initial code-injection vector that places the shell.
- T1505.004detects — A.8.3's dynamic access management explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface malicious IIS component installation or anomalous behavior; this is a genuine but minority slice of the technique (post-install detection only, not the installation act itself, and dependent on scope/implementation).
- T1505.004prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts); this can block unauthorized installation of malicious IIS components on some vectors (e.g. anonymous/unauth installs, sensitive data paths) but leaves the bulk of the technique (privileged admin/installer abuse on Windows IIS) unreached.
- T1505.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the DLL modification or anomalous RDP behavior after it occurs; partial because the clause's scope is set by policy and classification rather than mandating universal instrumentation of registry, file-integrity, or service loading that would catch every instance of this technique.
- T1505.005prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block unauthorized modification of termsrv.dll/ServiceDll or the resulting RDP abuse on protected systems, but this is only a slice — the control does not reach the initial code execution or privilege needed to perform the DLL replacement itself.
- T1525detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces anomalous image-implant activity in dynamic access management or registry interactions, but only for covered identities/applications and not the initial backdoor-planting act itself on unmanaged images.
- T1525prevents — A.8.3's access restriction rules (including dynamic techniques, authentication, time-bound access, encryption, monitoring, and alerts on misuse) can stop unauthorized modification of images in a registry when the adversary's action requires access to the image asset, but this is only a slice: the technique can also be realized by an already-authorized insider or via initial compromise that bypasses the restriction rules, and the control does not address image integrity checks or trusted build pipelines.
- T1526prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, auth, encryption, monitoring/alerts on misuse) which can block an authenticated adversary from successfully enumerating many cloud services/resources; it does not stop initial access, unauthenticated discovery, or all post-compromise API calls.
- T1528detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces token theft in covered scenarios but only for scoped high-value assets and chosen implementations rather than broadly across all platforms and vectors in T1528.
- T1528prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic management, authentication requirements, time-bound restrictions, encryption, monitoring, and alerts directly stop many vectors for stealing and abusing application access tokens (e.g. anonymous/unknown access, overly broad permissions, OAuth phishing grants, container/service-account exposure, IMDS token requests), but leave real gaps such as social-engineering consent flows that still require user action and post-compromise theft from already-authorized processes.
- T1529detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that surface anomalous shutdown/reboot attempts (especially those needing elevated privileges or violating dynamic rules), but this is scoped only to information-access events rather than all platform shutdown vectors (e.g. direct hypervisor, network device CLI, or post-wipe BSOD).
- T1530prevents — Granular, time-bound, and identity-based restrictions on cloud storage objects reduce the ability of compromised accounts to freely enumerate or exfiltrate data from cloud repositories.
- T1530detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse attempts, and operational/monitoring/reporting processes for dynamic access management, which surfaces the T1530 technique when it occurs against covered cloud storage; this is only a slice because the control is scoped to sensitive/high-value information under dynamic techniques rather than all cloud storage access.
- T1531detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the account manipulation in flight or shortly after; this is limited to a slice because the clause's scope is set by policy and classification rather than mandating universal account-change detection across all platforms and vectors.
- T1534detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces internal spearphishing activity (e.g. anomalous internal messages, credential prompts, or data exfil) once the trusted account is leveraged; partial because scope is limited to information assets under dynamic access controls rather than all chat/email vectors or pre-compromise device control.
- T1534prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, dynamic management, authentication, encryption, monitoring and alerts; this can stop some internal spearphishing vectors that rely on unauthorized access to sensitive data, accounts, or apps (e.g. limiting what a compromised account can reach or share), but leaves the initial account compromise, user deception via trusted channels like chat/email, and many social-engineering aspects untouched.
- T1537detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous internal transfers or sharing to adversary-controlled accounts; partial because the control is scoped to information deemed sensitive/high-value under the organization's classification scheme and dynamic access rules, leaving transfers of unclassified or unmonitored data outside its view.
- T1537prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts), and isolation of sensitive data directly block unauthorized transfers or sharing to adversary-controlled accounts within the same provider, including anonymous links and SAS URIs; the bounded remainder is post-compromise abuse of already-authorized identities or unmonitored dynamic rules.
- T1538detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the dashboard enumeration technique when it occurs; partial because the clause's scope is limited to information/assets the organization has chosen to protect with these mechanisms rather than all cloud dashboards universally.
- T1538prevents — A.8.3 directly restricts access to information/assets via policies, auth requirements, dynamic controls, and granular rules on identity/device/location, which stops stolen-credential dashboard use against sensitive cloud data (the core of T1538); mostly because it does not block all non-sensitive dashboard enumeration or credential theft itself.
- T1539detects — A.8.3 explicitly calls for dynamic access management to monitor use, record access/changes, and raise alerts on misuse attempts, which surfaces cookie theft in real-time or post-acquisition on covered systems; this is only a slice because the clause is scoped to high-value sensitive information under dynamic controls rather than broadly instrumenting all session-cookie theft vectors (e.g. local malware scraping, JS injection, or network MITM).
- T1539prevents — A.8.3's access restriction rules, configuration mechanisms, dynamic access management, authentication requirements, time-bound restrictions, encryption, and monitoring directly stop many vectors for stealing/using session cookies (e.g. anonymous access, improper config, unmonitored JS/proxy exfil, post-theft replay), but leave real gaps such as local malware theft from browser memory/disk before controls apply and certain MitM phishing flows.
- T1542.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous firmware modification attempts on protected information/assets, but this is scoped to information-centric dynamic access controls rather than broad component firmware integrity or boot-time detection.
- T1542.003prevents — A.8.3's access restriction (including physical/logical isolation of sensitive system areas, raw-access controls on boot drives, and dynamic techniques that can enforce identity/device-based rules before OS load) stops the adversary's prerequisite raw access needed to overwrite MBR/VBR/ESP in many configurations, but leaves a bounded remainder where boot firmware or early-boot vectors are not covered by the clause's mechanisms.
- T1542.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous TFTP boot configuration changes or unauthorized image loads on network devices, but this is scoped only to the dynamic-access slice rather than broadly detecting the boot-sequence manipulation itself.
- T1542.005prevents — A.8.3 restricts access to information/assets (including via config mechanisms, dynamic controls, authentication, encryption, and monitoring of use), which can stop adversaries from manipulating netboot configs or loading unauthorized TFTP images in many cases, but leaves a bounded remainder for physical/boot-time bypasses and non-information assets like firmware images on network devices.
- T1543detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access/changes, and raising alerts on misuse, which can surface anomalous service/daemon creation or modification in real time; this is limited to the dynamic-management slice rather than all T1543 vectors (e.g. offline or non-sensitive assets).
- T1543prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, physical/logical isolation of sensitive apps/data, and dynamic techniques requiring auth/credentials) stops many unauthorized creations or modifications of system processes/services but leaves a remainder on platforms, boot-time mechanisms, and admin/root escalations not fully covered by the clause's access-focused scope.
- T1543.001detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous Launch Agent creation or plist modifications in monitored contexts, but this is scoped only to high-value sensitive information under dynamic controls rather than broadly detecting the persistence technique itself.
- T1543.001prevents — A.8.3 restricts access to information/assets per policy (including file-system locations, dynamic controls, and isolation of sensitive apps/data), which can stop placement of .plist files into the listed LaunchAgents directories when those paths contain or affect sensitive information; this is a genuine but minority slice of the technique (most Launch Agent abuse is not information-access driven).
- T1543.002detects — A.8.3's dynamic access management explicitly requires monitoring use, recording changes, and raising alerts on misuse attempts, which surfaces anomalous systemd service creation/modification on Linux; this is only a slice of the full technique (e.g. does not address generators or non-access-related creation).
- T1543.002prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques like auth/encryption/monitoring), which can stop adversaries from creating or modifying root-owned systemd .service files in /etc/systemd/system (or symlinks/generators) on Linux; this is only a slice of the technique because user-level services in $HOME, privilege-escalating User= directives, and many generator paths remain reachable under the clause's own scoping.
- T1543.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous service creation/modification or hidden/masqueraded services when they touch sensitive assets or registries, but this is scoped only to information-centric monitoring rather than general service enumeration or driver loading.
- T1543.003prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic rules on identity/device/location, and authentication/credential requirements), which can stop unauthorized creation/modification of service configs in the Registry or via APIs for many but not all vectors (e.g., already-privileged SYSTEM context, BYOVD, or hidden/masqueraded services remain possible).
- T1543.004detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous Launch Daemon creation/modification events when they touch monitored sensitive assets or paths, but this is scoped only to the subset of cases involving protected information rather than the technique in general.
- T1543.004prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, isolation, and dynamic techniques like auth/encryption/time-bounds), which can stop adversaries from creating/modifying Launch Daemons in protected paths or with elevated privileges on macOS, but leaves many residual vectors such as poor configs, writeable folders, or non-information assets.
- T1543.005detects — A.8.3's dynamic access management explicitly raises alerts on misuse attempts and records access/use throughout the lifecycle, which can surface anomalous container service creation/modification on monitored hosts, but this is limited to access-related telemetry rather than broadly detecting all persistence or privilege-escalation vectors in the technique (e.g., DaemonSet deployment or systemd config changes outside dynamic access enforcement).
- T1543.005prevents — A.8.3 restricts access to information/assets via policies, auth, config controls, isolation, and dynamic techniques (including on containers), which stops many unauthorized creation/modification paths for container services but leaves open vectors such as privileged users, misconfigurations, or unmonitored runtime changes on the host.
- T1546detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces some T1546 abuse (e.g. anomalous triggers or privileged execution events) when it involves protected assets; this is only a slice because the control is scoped to information assets under dynamic access management rather than broadly instrumenting all event triggers or system mechanisms.
- T1546prevents — A.8.3 restricts access to information/assets (including via auth, dynamic controls, isolation, and monitoring of use), which stops many but not all event-trigger abuses such as local logon triggers or privilege-escalating service-account proxies that do not hinge on unauthorized information access.
- T1546.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous file-association changes or triggered executions; this is a genuine but minority slice of the technique (registry writes and persistence setup) rather than a bounded remainder.
- T1546.001prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts), which can block unauthorized Registry edits or handler changes for sensitive file types; however, it does not mandate enforcement on all systems, all users, or non-sensitive extensions, leaving a broad slice of the technique unaddressed.
- T1546.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface screensaver-based persistence when it triggers or is configured (e.g. via anomalous registry changes or execution), but this is scoped only to the subset of dynamic/authorized-access monitoring an implementer chooses rather than a broad or guaranteed detection mechanism.
- T1546.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous WMI subscriptions or their execution in covered dynamic-access scenarios, but the clause's scope is limited to high-value sensitive information under dynamic management rather than all WMI event subscriptions on Windows.
- T1546.003prevents — A.8.3's access restriction rules (identity-based, credentialed, time-bound, monitored, and dynamic) can stop unauthorized WMI subscriptions and their privilege-elevating execution in many scenarios, but the control is silent on the specific WMI event filter/consumer registration surface and on the SYSTEM-level proxy execution that bypasses many logical access controls.
- T1546.004detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes/access, and raise alerts on misuse attempts, which can surface anomalous shell-configuration modifications when they involve protected assets; this is only a slice of the technique (not all instances target monitored sensitive data or use dynamic controls).
- T1546.004prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques like auth/encryption/time-bounds), which can stop unauthorized modification of many shell config files (esp. system /etc/* requiring root); however, it does not reach user-owned dotfiles in ~/ that adversaries routinely abuse with user-level permissions, nor does it guarantee prevention of all insertion vectors.
- T1546.005detects — A.8.3 explicitly requires monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous trap-based persistence when it touches monitored sensitive information or scripts; this is a genuine but minority slice of the technique's possible use (any script, any signal, not necessarily on high-value data).
- T1546.006detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface the binary modification or anomalous dylib load on covered assets; this is only a slice because the clause is scoped to information assets under dynamic access management rather than all binaries or all persistence techniques.
- T1546.007detects — A.8.3 explicitly calls for monitoring use of protected information, recording accesses/changes, and raising alerts on misuse attempts, which surfaces anomalous netsh helper DLL registration or execution when the technique touches monitored sensitive assets or registry paths, but this is scoped only to information under dynamic access management rather than broadly detecting the persistence mechanism itself.
- T1546.007prevents — A.8.3's access restriction (including registry/config controls, dynamic techniques, authentication, and isolation of sensitive apps/data) can stop unauthorized registration or loading of a malicious Netsh Helper DLL, but leaves open paths such as privileged admin abuse, unmonitored legitimate netsh.exe execution, or non-access-control vectors like supply-chain compromise of a helper.
- T1546.008detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts; this surfaces the technique when it touches monitored sensitive information or triggers dynamic access controls, but the bulk of the technique (binary/registry replacement of accessibility features at login) sits outside information-centric monitoring and is not required by the clause.
- T1546.008prevents — A.8.3's access-restriction rules (authentication, least-privilege controls on identities/groups, physical/logical isolation, and dynamic techniques that can block unauthorized binaries or registry changes) stop many but not all vectors for replacing accessibility binaries or hijacking their launch at the logon screen; the control's scope is logical/information-centric and leaves a named remainder of physical console attacks, WFP-bypassing methods, and pre-boot or non-Windows vectors.
- T1546.009detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts; this surfaces anomalous DLL loading or registry-driven behavior when the information (or process context) is in scope, but the control is scoped to information assets rather than all system processes or registry changes, leaving most of the technique outside its view.
- T1546.009prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, isolation of sensitive apps/data, and registry-adjacent controls via policy/config) can stop unauthorized DLL registration and loading in many Windows process-creation scenarios, but leaves a bounded remainder where the technique is realized through already-elevated processes, non-sensitive contexts, or implementation gaps in dynamic management.
- T1546.010detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous DLL loading or registry abuse in sensitive contexts, but the clause is scoped to information assets under dynamic access management rather than broadly instrumenting the AppInit mechanism itself.
- T1546.010prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, isolation of sensitive applications/data, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can prevent unauthorized Registry writes or DLL loading in many scenarios, but the control is silent on the specific AppInit_DLLs Registry values, secure boot enforcement, and the near-universal loading into processes via user32.dll, leaving a substantial remainder.
- T1546.011detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording changes/access, raising alerts on misuse, and operational monitoring/reporting processes, which can surface shim abuse (e.g. unauthorized installs or anomalous hooking) when it touches protected assets; this is a genuine but minority slice of the technique's full attack surface (persistence, privilege escalation, defense evasion across any process).
- T1546.011prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques like auth/encryption/monitoring), which can block unauthorized shim installation or use in some cases (e.g. non-admin or sensitive contexts), but does not address the core technique of leveraging built-in Windows shimming for persistence/privilege escalation in arbitrary programs.
- T1546.012detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces IFEO Registry abuse when it touches monitored sensitive assets or triggers alerts, but the control's scope is limited to information assets under dynamic access management rather than all IFEO technique executions on Windows.
- T1546.012prevents — A.8.3's access restriction rules (registry, identity, credential, and dynamic controls) can stop unauthorized modification of IFEO Debugger values and block the resulting malicious execution in many cases, but the control is silent on the specific Windows registry locations, silent-exit monitoring, accessibility-feature abuse paths, and the full set of privilege-escalation vectors described, leaving a substantial remainder.
- T1546.013detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous profile modification or execution; partial because the clause's scope is set by policy and classification (only sensitive/high-value info), leaving ordinary PowerShell profiles outside that boundary
- T1546.013prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, dynamic management, and isolation of sensitive apps/data), which can prevent unauthorized modification of profile.ps1 files in many cases, but leaves a bounded remainder where profiles are writable by the user context that loads them or via other unaddressed vectors.
- T1546.015detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts; this surfaces anomalous COM hijacking that touches monitored sensitive information or registry-stored references, but the clause's scope is limited to information assets under dynamic access management rather than all COM objects or registry changes.
- T1546.015prevents — A.8.3's access restriction (including Registry-mediated COM references, dynamic controls, authentication, and isolation of sensitive system components) can stop unauthorized Registry changes and hijack execution for covered identities/objects, but leaves a large remainder: many COM hijacks use admin-privileged or system-level objects outside user-access policies, and the technique's stealthy, low-impact choice of frequently-used non-breaking objects evades the control's scope.
- T1546.016detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous installer-script behavior during execution or post-install phases on protected assets; this is limited to the slice of cases involving monitored sensitive data rather than the technique in general.
- T1546.016prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, dynamic techniques, authentication, time-bound restrictions, and monitoring/alerts), which can stop adversaries from delivering or triggering malicious installer scripts on sensitive systems, but leaves open vectors like social engineering users to run unmodified legitimate installers or abusing permitted local admin rights during installation.
- T1546.017detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts; this surfaces udev rule abuse when it touches monitored information or triggers detectable events, but the clause's scope is limited to information-centric dynamic access management rather than kernel device rules or general persistence.
- T1546.017prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts), which can prevent unauthorized root-level modification of udev rules or their triggered malicious execution in some configurations, but leaves a large remainder (e.g., initial privileged compromise, non-information assets, or incomplete dynamic enforcement on kernel device events).
- T1546.018detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface the anomalous file placement or execution that realises T1546.018; the remainder is that the control's scope is set by organisational policy and does not mandate instrumentation of Python interpreter startup or .pth/module loading itself.
- T1547detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous autostart configurations or executions when they touch monitored sensitive information or systems; this is a genuine but minority slice of the broad technique (most T1547 instances are not tied to high-value info or fall outside the dynamic-access scope).
- T1547prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, isolation, and dynamic techniques like auth/encryption/time-bounds), which can block adversaries from configuring or modifying many autostart mechanisms (e.g. registry keys, directories, or kernel features) but leaves a remainder for techniques outside its access-restriction scope such as certain kernel extensions or pre-existing privileged autostart entries.
- T1547.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts; this surfaces anomalous registry-run or startup-folder persistence when it involves protected assets, but the clause is scoped only to high-value/sensitive information under dynamic access management rather than all persistence techniques on Windows.
- T1547.001prevents — A.8.3 restricts access to information/assets per policies (including via config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques like auth/encryption/time-bound access), which can stop unauthorized modification of many run-key/startup-folder locations; however, it does not reach all (e.g., system-wide HKLM keys, BootExecute, or policy-driven entries that require separate privilege enforcement).
- T1547.002detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous LSA/registry activity tied to this persistence technique when dynamic access management or logging is scoped to cover it; however the control's scope is set by policy and applies primarily to information assets rather than all system-level autostart abuse.
- T1547.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording accesses/changes, raising alerts on misuse, and operational monitoring/reporting processes; these surface the anomalous registry change or DLL load at boot for a time-provider persistence implant, but only where the information or system is already in scope for dynamic access management or topic-specific policies.
- T1547.003prevents — A.8.3 restricts access to information/assets per policies (including registry/config controls, identity-based rules, dynamic management, and monitoring/alerting on misuse), which can block unauthorized admin-level registry changes or DLL loading for some instances of this persistence technique but leaves many vectors (e.g., privileged insiders, unmonitored paths, or non-sensitive config) unaddressed.
- T1547.004detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous Winlogon helper modifications or executions on Windows systems; however, this is scoped only to information/assets deemed sensitive by policy rather than broadly to all persistence technique artifacts.
- T1547.004prevents — A.8.3 restricts access to information/assets per policy (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic techniques, and authentication/encryption), which can block unauthorized registry modifications or DLL loading for some but not all vectors of this persistence technique.
- T1547.005detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface anomalous SSP Registry modifications or LSA loading events when those fall inside the defined scope; the remainder is that the clause sets scope by policy rather than mandating instrumentation of every Registry or boot-time artifact, so only a chosen slice is guaranteed to be detected.
- T1547.005prevents — A.8.3's access restriction (including registry/config controls, identity-based rules, dynamic management, and isolation of sensitive system components) can stop unauthorized SSP registry modification and DLL loading at boot on Windows, but leaves a remainder where the technique is performed by an already-authorized local admin or via physical/boot-time vectors outside the clause's logical focus.
- T1547.006detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, and raise alerts on misuse attempts, which can surface anomalous kernel-module loading activity when it touches protected assets; this is only a slice of the technique (not all LKM/kext use is detectable via information-access telemetry, and the control does not mandate kernel-level monitoring).
- T1547.006prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation of sensitive systems, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block unauthorized loading of malicious LKMs/kexts on Linux/macOS in many scenarios, but the kernel's Ring-0 nature, SIP bypasses, and legitimate module-loading paths leave a substantial unaddressed slice of the technique.
- T1547.007prevents — A.8.3's access restriction (including config mechanisms, identity/group controls on read/write/execute, dynamic management, and isolation of sensitive apps/data) can stop unauthorized plist modification for persistence on macOS, but leaves a bounded remainder for non-sensitive apps, user-approved reopen flows, and cases where the malicious path is added by an already-authorized process.
- T1547.008detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface anomalous LSASS driver activity (e.g. via dynamic access management or logging), but this is scoped to information assets rather than the full technique of adding/replacing drivers for persistence.
- T1547.008prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, physical/logical isolation of sensitive apps/data, and dynamic techniques with auth/encryption/monitoring) can block unauthorized addition/replacement of LSASS drivers on Windows, but leaves a real remainder for already-privileged local administrators or kernel-level bypasses that the clause does not reach.
- T1547.009detects — A.8.3 explicitly requires recording who accesses information and how it is used plus raising alerts on misuse attempts, which surfaces shortcut creation/modification in sensitive locations or by unauthorized identities; this is a genuine but minority slice of the technique (most instances are not tied to high-value information or monitored dynamic access).
- T1547.009prevents — A.8.3's access restriction rules (including on identities, groups, dynamic management, authentication, time-bound access, and monitoring) can stop unauthorized creation or modification of shortcuts in startup locations or sensitive paths, but this is only a slice of the technique's attack surface (e.g., does not block all masquerading, LNK abuse in browsers, or post-compromise edits where access is already obtained).
- T1547.010detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the anomalous boot-time DLL load or registry writes associated with this technique when they match configured rules or misuse patterns; partial because the clause sets scope by policy/use-case rather than mandating universal instrumentation of every boot or registry change.
- T1547.010prevents — A.8.3's access restriction (including config mechanisms, identity/group controls on read/write/execute, physical/logical isolation, and dynamic techniques requiring auth/credentials) directly constrains the registry writes and DLL loading that enable the technique, but leaves a remainder where the attacker already holds the necessary privileges or identities to perform the AddMonitor/registry change.
- T1547.012detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous print-processor registration or spooler activity when tied to high-value assets; this is a genuine but minority slice of the technique's full attack surface (privilege escalation, boot persistence, and registry/driver abuse on any Windows system).
- T1547.012prevents — A.8.3's access restriction (including config mechanisms, identity/group controls on read/write/execute, physical/logical isolation of sensitive apps/data, and dynamic techniques requiring auth/credentials) can stop unauthorized addition of print processors or loading of malicious DLLs via the spooler, but leaves a bounded remainder where the technique uses already-authorized admin/SeLoadDriverPrivilege paths or unmonitored registry changes.
- T1547.013detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous autostart modifications or executions on sensitive assets; this is a genuine but minority slice of the technique (only where the autostart artifact or binary touches monitored high-value information).
- T1547.013prevents — A.8.3 restricts access to information/assets per policies (including config mechanisms, identity/group controls on read/write/execute, isolation of sensitive apps/data, and dynamic techniques that can block unauthorized Exec in autostart files), but does not stop an adversary from writing a malicious .desktop file to ~/.config/autostart or /etc/xdg/autostart when they already have the necessary privileges.
- T1547.014detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous Active Setup Registry modifications or executions under user context; however this is scoped only to information assets under dynamic access management rather than all persistence techniques on Windows.
- T1547.014prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts); this can block unauthorized creation or modification of the HKLM Active Setup key (a sensitive registry location) in many cases, but leaves a bounded remainder where the adversary already has the necessary user-level write permissions or uses masquerading.
- T1547.015detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, and raise alerts on misuse attempts, which can surface anomalous login-item additions that affect persistence-related assets; this is a genuine but minority slice of the technique (only where high-value info or dynamic rules are in scope, not the bulk of login-item creation via AppleScript or SMLoginItemSetEnabled).
- T1547.015prevents — A.8.3's access restriction rules (authentication, credential requirements, dynamic policy on identity/device/location, isolation of sensitive apps/data, and monitoring/alerting on misuse) can stop unauthorized addition or execution of malicious login items at login time on macOS, but this is only a slice — the control is silent on the specific persistence vector, shared-file-list manipulation via AppleScript/Native API, launchd integration, and non-sensitive login items that adversaries routinely abuse.
- T1548detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface abuse of elevation mechanisms in real time or after the fact; partial because the clause's scope is set by topic-specific policies and chosen use cases rather than mandating universal coverage of all T1548 vectors across all platforms and life-cycle stages.
- T1548prevents — A.8.3 directly restricts access to information/assets per policies, controls identities/groups/permissions (read/write/etc.), mandates authentication/credentials, and uses dynamic techniques to enforce granular/time-bound/isolated elevation — closing the bulk of native elevation-control bypasses on the platforms, with a bounded remainder in implementation-specific or physical slices.
- T1548.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface setuid/setgid abuse when it occurs within the monitored scope, but the clause does not mandate instrumentation that would catch all discovery or chmod-based setting of the bits.
- T1548.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring) directly constrain the ability to set/abuse setuid/setgid bits or execute in the elevated context, but only for a slice of the technique (e.g. runtime enforcement and some configuration); the core weakness of vulnerable binaries already having the bits set (discoverable via find/chmod) and many local abuse paths remain outside its direct preventive reach.
- T1548.002detects — A.8.3 explicitly calls for dynamic access management to monitor use, record changes, raise alerts on misuse attempts, and establish monitoring/reporting processes, which can surface UAC bypass attempts in real-time or via logs; this is limited to the subset of bypasses that trigger detectable misuse signals rather than all methods (e.g., silent COM elevation or lateral movement).
- T1548.002prevents — A.8.3 requires access restriction mechanisms (including dynamic ones, authentication, time-bound controls, and isolation of sensitive data) that can stop many UAC-bypass methods from succeeding when they rely on unauthorized privilege elevation or improper access to protected resources, but leaves a bounded remainder of bypasses that abuse misconfigurations, auto-elevation paths, or lateral movement with valid admin credentials.
- T1548.003detects — A.8.3 explicitly lists dynamic access management that raises alerts on misuse attempts and records access/use throughout the lifecycle, which surfaces sudo/sudoers abuse in real time; this is only a slice of the technique (configuration changes and timestamp monitoring can occur without triggering the listed alerts).
- T1548.003prevents — A.8.3's core purpose, guidance on restricting access per policies, controlling identities/groups/permissions (read/write/etc.), least-privilege configuration of sudoers, and mechanisms like authentication, time-bound access, and monitoring directly block abuse of sudo caching, NOPASSWD entries, tty_tickets disabling, and unauthorized elevation on Linux/macOS; dynamic techniques add further coverage, with only edge-case misconfigurations as bounded remainder.
- T1548.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse detection, and operational monitoring/reporting processes, which can surface the technique when it triggers a credential prompt or attempts unauthorized elevated execution, but only for implementations that instrument those dynamic controls (most macOS environments do not).
- T1548.004prevents — A.8.3 restricts access to information/assets per policies (including via auth, credentials, isolation, dynamic controls and monitoring), which can block some abuse vectors of the API (e.g. anonymous/unauth calls, world-writable files, or post-prompt data access), but leaves the core macOS API prompt-and-escalate mechanism for signed/masqueraded apps untouched.
- T1548.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces abuse of temporary elevation paths when they involve monitored high-value assets; this is only a slice of the technique (not all temporary elevation is on high-value data under dynamic controls, and the control is silent on general permission-misconfiguration detection).
- T1548.005prevents — A.8.3 directly requires restricting access per policies, granular controls on identities/roles/permissions (read/write/etc.), dynamic access management with time-bound rules, authentication, and monitoring/alerting on misuse — all of which close the misconfiguration paths that enable just-in-time elevation, impersonation, and role-passing abuses described in T1548.005; partial because the control is a requirement-setting clause whose coverage depends on implementation rigor and does not itself enforce the specific cloud-native mechanisms that would stop every variant.
- T1548.006detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces TCC database manipulation or anomalous permission grants after the fact; this is only a slice of the full technique because the clause's dynamic-access mechanisms are scoped to high-value information under organizational policy rather than mandating universal TCC monitoring.
- T1548.006prevents — A.8.3 directly requires access restriction mechanisms (configuration controls, identity/group-based read/write/execute rights, authentication, time-bound restrictions, encryption, monitoring/alerting on misuse) that close the majority of TCC database manipulation paths when SIP is enabled and policies are enforced; the bounded remainder is the SIP-disabled case explicitly called out in the technique where TCC itself is disabled.
- T1550detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces T1550's use (or theft) of alternate auth material in covered dynamic-access scenarios; this is only a slice because the clause's scope is limited to high-value sensitive information under dynamic management rather than all alternate-auth usage across the enterprise.
- T1550prevents — A.8.3's access restriction rules, configuration mechanisms, dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts), and isolation directly stop many uses of stolen alternate auth material from succeeding, but leave a bounded remainder where material is stolen and used before restrictions apply, in exempted legacy paths, or against unmonitored systems.
- T1550.001detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface stolen-token abuse when it occurs; this is limited to a chosen slice of dynamic-access or logging scope rather than a bounded remainder of all token use.
- T1550.001prevents — A.8.3's access-restriction rules, configuration mechanisms, identity/group controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts) and isolation of sensitive assets directly stop many token-theft paths and limit what a stolen token can achieve, but the control is silent on token issuance hygiene, refresh-token lifetime, and the specific misconfigurations that let an adversary mint or request a token for another account.
- T1550.002detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces PtH lateral movement when it occurs within the monitored scope; partial because the clause sets scope by policy/use-case rather than mandating universal instrumentation of all PtH vectors (e.g. non-sensitive systems or unmonitored legacy auth).
- T1550.002prevents — A.8.3's access-restriction rules, credential requirements, dynamic controls based on identity/device/location, and isolation of sensitive systems directly stop many PtH uses that rely on weak or bypassed normal access controls, but the technique's reliance on already-stolen hashes (Credential Access) and Kerberos ticket creation leaves a substantial unaddressed slice.
- T1550.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface PtT activity when it triggers those mechanisms, but the control is scoped to information assets and dynamic access rather than broadly detecting credential abuse or lateral movement techniques.
- T1550.003prevents — A.8.3's access restriction rules, credential requirements, dynamic controls, and encryption directly stop many PtT vectors that rely on stolen or forged tickets being usable for lateral movement; partial because the control is silent on the upstream credential dumping that supplies the tickets and on certain golden-ticket forgery paths that live outside its named mechanisms.
- T1550.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the anomalous use of a stolen session cookie; this is only a slice because the clause's scope is set by policy and classification rather than mandating universal instrumentation of all session-cookie events across every platform and lifecycle stage.
- T1550.004prevents — A.8.3's access restriction rules, configuration mechanisms, dynamic access controls (time-bound, identity/device-based, encryption, monitoring, alerts on misuse), and credential requirements directly stop many stolen-cookie replay scenarios by limiting session validity, enforcing re-authentication, and blocking unauthorized use; however, it leaves a genuine slice (e.g., immediate post-theft use before dynamic rules trigger, or implementations that do not apply these to all web sessions) unreached.
- T1552detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the search or presence of unsecured credentials in flight or post-compromise; this is only a slice because the clause is scoped to high-value/sensitive information under dynamic access management rather than all credential locations on every platform.
- T1552prevents — A.8.3's access restriction rules, configuration mechanisms, credential requirements, encryption, isolation of sensitive data, and dynamic controls directly stop adversaries from obtaining many classes of unsecured credentials (e.g. plaintext files, registry entries, private keys) by enforcing least-privilege access and protecting them throughout the lifecycle; the bounded remainder is credentials stored in locations or forms outside the policy's enforced scope (e.g. certain legacy or unclassified artifacts).
- T1552.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the technique of searching for credential files when it triggers those controls; this is only a slice because the clause is scoped to sensitive/high-value information under dynamic access management rather than all credential-bearing files.
- T1552.001prevents — A.8.3 restricts access to files containing credentials (via policy-driven config, identity/group controls, dynamic techniques, encryption, and monitoring), stopping many searches from succeeding, but leaves a bounded remainder where credentials are still written to files that authorized identities or misconfigurations can reach.
- T1552.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface Registry queries for credentials when they match defined misuse patterns or dynamic access rules; this is limited to monitored/credentialed access slices rather than all adversary searches on compromised systems.
- T1552.002prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, dynamic techniques, authentication requirements, encryption, and monitoring) can stop the adversary query from succeeding when credentials are protected by those means, but leaves a remainder where credentials are stored insecurely yet still reachable via Registry search before or outside such enforcement.
- T1552.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface an adversary searching history files for credentials when those files contain or lead to sensitive data; this is only a slice of the technique because the control is scoped to high-value/sensitive information under dynamic management rather than broadly detecting all history-file access on every platform.
- T1552.003prevents — A.8.3's access restriction (including dynamic techniques, encryption, monitoring, and isolation of sensitive data) can stop adversaries from reaching or reading credential-containing history files, but leaves a remainder where history files are created before restrictions apply, in unmonitored locations, or via non-access methods like direct file reads post-compromise.
- T1552.004detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces the search/export activity described in T1552.004; this is only a slice of the technique (post-compromise discovery on monitored assets) rather than the bulk of credential hunting.
- T1552.004prevents — A.8.3's access restriction rules, configuration mechanisms, physical/logical isolation, dynamic access controls, authentication requirements, time-bound restrictions, and encryption directly stop many discovery and export paths for insecurely stored private keys, but the control is silent on secure key generation/storage locations, keyfile permissions at creation, and passphrase protection against offline brute-force, leaving a genuine minority slice of the technique unaddressed.
- T1552.005detects — A.8.3 explicitly calls for monitoring use of protected information, recording access, and raising alerts on misuse attempts, which surfaces adversary queries to the Instance Metadata API when it is treated as sensitive information under dynamic access management; this is only a slice of the technique (e.g. does not address SSRF from external proxies or non-monitored instances).
- T1552.005prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, encryption, monitoring/alerting, and isolation of sensitive data) can stop direct queries or SSRF-based access to the metadata API when the instance or proxy falls under its configured policies, but leaves a bounded remainder where the technique succeeds via unmonitored paths, misconfigured defaults, or pre-existing presence on the instance before restrictions apply.
- T1552.006detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which would surface the enumeration and decryption activity against GPP XML files in SYSVOL when those files contain sensitive credentials.
- T1552.006prevents — A.8.3's access-restriction rules (no anonymous access to sensitive data, identity/group-based controls on read/write, dynamic techniques that require auth/credentials/encryption and can restrict by identity/device/location) directly stop domain users from viewing/decrypting GPP XMLs in SYSVOL when those contain sensitive credentials, but the control is silent on the administrative act of embedding credentials in the first place and on the public AES key that makes decryption trivial once the file is obtained.
- T1552.007detects — A.8.3 explicitly requires monitoring, reporting, recording of access/use, and raising alerts on misuse attempts, which surfaces credential-gathering via container APIs when those events fall inside the configured scope.
- T1552.007prevents — A.8.3 directly mandates access restriction mechanisms (configuration controls, identity/group permissions, authentication requirements, dynamic/granular enforcement, and isolation of sensitive data) that stop adversaries from reaching the container APIs or the credentials they expose; this covers the technique's core access vector but leaves a remainder for misconfigurations, anonymous exposure, or insufficiently scoped dynamic rules that still allow the API call.
- T1552.008detects — A.8.3 explicitly calls for dynamic access management to monitor use, record access/changes, and raise alerts on misuse attempts, which surfaces credential exposure in chat services when those techniques are applied to the relevant data flows.
- T1552.008prevents — A.8.3's access restriction rules, dynamic management, authentication requirements, encryption, and monitoring directly stop many collection paths (e.g. anonymous/unauthorized access to chat services, time-bound or policy-driven credential exposure in SaaS/Office Suite channels) but leave open vectors like compromised admin portals, integration tools, or insider sharing that still allow the technique.
- T1553.001prevents — A.8.3's access restriction (including dynamic techniques, authentication, time-bound controls, encryption, monitoring, and alerts) can prevent some Gatekeeper bypass vectors on macOS by enforcing identity/device-based rules, isolating sensitive apps, and blocking unauthorized execution paths, but leaves a bounded remainder for non-quarantined files (USB, curl, drive-by), logic errors, and first-launch bypasses that the control does not address.
- T1553.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the acquisition, use or anomalous deployment of stolen/rogue code-signing materials; this is a genuine but minority slice of the technique (focused on post-use monitoring rather than the creation/acquisition itself).
- T1553.003detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces hijacking attempts that tamper with trust/validation components when those components handle sensitive/signed assets under dynamic access management; this is a genuine but minority slice of the technique (most hijacks target non-sensitive binaries or occur outside monitored dynamic flows).
- T1553.003prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block many hijack vectors that rely on unauthorized registry changes, DLL loading, or tampering with sensitive system components, but do not address all cases such as in-memory DLL search-order hijacking or already-privileged insider abuse of legitimate configuration paths.
- T1553.004detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational monitoring/reporting processes that surface anomalous certificate-related activity on the system.
- T1553.004prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic management, authentication requirements, encryption, and monitoring/alerts on misuse), which can block unauthorized installation of root certificates on many but not all platforms/vectors (e.g., supply-chain pre-installs, cloned certs for code signing, or post-compromise admin-level installs remain possible).
- T1553.005detects — A.8.3 explicitly requires monitoring, reporting, raising alerts on misuse attempts, and recording access/use throughout the information lifecycle, which surfaces MOTW-bypass attempts when they involve monitored sensitive information or anomalous access; this is only a slice of the technique because the control is scoped to organization-defined sensitive/high-value assets rather than all container-file extractions or local-file executions.
- T1553.006detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, and raise alerts on misuse attempts, which would surface policy-modification activity when it touches protected assets or triggers those alerts; this is a genuine but minority slice of the technique (most policy changes are local admin/kernel-level and outside dynamic information-centric monitoring).
- T1553.006prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, dynamic management, authentication/credential requirements, and isolation of sensitive apps/data) directly stops many policy-modification vectors that rely on unauthorized elevated access or runtime changes, but leaves a bounded remainder where the adversary already holds the elevated permissions the technique explicitly requires (e.g. kernel memory writes, debug-mode reboots, or developer-allowed policy toggles).
- T1554detects — A.8.3's dynamic access management explicitly requires recording access/use, raising alerts on misuse, and operational monitoring processes, which can surface binary modification or anomalous execution of a tampered binary; this is only a slice of the technique (post-modification detection on protected/sensitive binaries) rather than the bulk of pre-execution patching or replacement across arbitrary host software.
- T1554prevents — A.8.3's access restriction rules (including dynamic techniques, authentication, time-bound access, encryption, monitoring, and alerts on misuse) can block many post-modification uses of a compromised binary (e.g. credential theft, unauthorized execution, or exfiltration), but do not stop the initial binary modification or patching itself.
- T1555detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface credential theft from stores when it involves monitored sensitive data or dynamic access enforcement; this is a genuine but minority slice of the broad technique that also covers unmonitored local password files, non-sensitive locations, and pre-access searches.
- T1555prevents — A.8.3's core access-restriction rules (no anonymous access to sensitive stores, configuration mechanisms, identity/group controls, isolation, authentication requirements, encryption, time-bound access, monitoring/alerting) directly stop adversaries from reaching or extracting credentials from common password stores and vaults.
- T1555.001detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces Keychain credential theft attempts on macOS where dynamic access management or monitoring is applied; partial because the control is scoped to organization-chosen sensitive information and use cases rather than mandating universal Keychain monitoring.
- T1555.001prevents — A.8.3 restricts access to sensitive information (including via authentication, encryption, dynamic controls, and isolation of credential stores) which can stop an adversary from reaching or dumping the Keychain without proper authorization, but leaves a bounded remainder where the technique succeeds after the user has already authenticated to the host (the default Keychain password equals the login password).
- T1555.002detects — A.8.3 explicitly lists raising alerts on detected misuse of protected information plus operational monitoring/reporting processes, which can surface the in-memory read of securityd by a privileged process; this is only a slice of the technique because the clause's scope is limited to high-value sensitive information under dynamic access management rather than all credential-gathering from memory.
- T1555.002prevents — A.8.3's access restriction (including dynamic techniques, isolation of sensitive data, credential requirements, encryption, and monitoring) can prevent root-level memory reads of securityd by enforcing least-privilege access, isolating credentials, and using dynamic controls that limit exposure throughout the credential lifecycle, but this is only a slice as the technique targets in-memory caching of already-authenticated sessions on macOS where full prevention depends on unmentioned platform mitigations like El Capitan changes.
- T1555.003detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces browser-credential theft when it touches managed sensitive data or dynamic-access stores; this is only a slice of the technique (file/memory reads of common browsers outside scoped high-value info remain unseen).
- T1555.003prevents — A.8.3 restricts access to information/assets per policies, including no anonymous access to sensitive data, config mechanisms for access control, identity/group-based permissions (read/write/etc.), physical/logical isolation of sensitive apps/data, and dynamic techniques (auth, time-bound access, encryption, monitoring, alerts) that can block file/memory reads of browser credential stores when those stores are treated as sensitive.
- T1555.004detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record access/changes, and raise alerts on misuse attempts, which surfaces Credential Manager abuse in flight when the information is classified as high-value and covered by those processes.
- T1555.004prevents — A.8.3's access restriction rules, configuration mechanisms, credential requirements, encryption, isolation of sensitive data, and dynamic controls (including monitoring/alerting) directly constrain the enumeration, direct file reads, API abuse, and backup extraction used by T1555.004; partial because the control is a set of policy+mechanism requirements whose actual coverage depends on implementation choices and does not reach every possible Credential Manager access vector or pre-existing credential store.
- T1555.005detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces adversary activity against a password manager (e.g. brute-force or memory extraction) when it falls inside the configured scope of dynamic access management.
- T1555.005prevents — A.8.3's access restriction (including dynamic techniques, encryption, authentication, time-bound access, and monitoring) can stop extraction of unlocked credentials or brute-force of the master password in many configurations, but leaves residual paths such as in-memory extraction after legitimate unlock, exploitation of the password manager itself, or non-enforcement on unmanaged third-party tools.
- T1555.006detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which surfaces the API-based secret retrieval when it occurs; this is only a slice because the clause's scope is set by the organization's chosen policies and use cases rather than mandating universal coverage of all secrets-manager access.
- T1555.006prevents — A.8.3's access restriction rules, dynamic access management, authentication/credential requirements, time-bound restrictions, monitoring, and alerts directly constrain the privilege escalation and API calls needed to request secrets from cloud stores, but only for secrets protected under the implemented policies and not for all privilege paths or legacy configurations.
- T1556detects — A.8.3 explicitly calls for monitoring use, recording access/changes, and raising alerts on misuse of protected information, which surfaces T1556 activity once the modified auth process is exercised against that information; this is a genuine but minority slice of the technique (most variants target low-level mechanisms like LSASS/PAM/SAM with no necessary tie to monitored high-value data).
- T1556prevents — A.8.3's access-restriction mechanisms (including dynamic techniques that require authentication/credentials, enforce time-bound or identity-based rules, and isolate sensitive data) stop many T1556 variants from succeeding in gaining unwarranted access, but do not address the core modification of the authentication process itself (e.g., LSASS, PAM, or plugin tampering) which can occur prior to or outside those controls.
- T1556.001detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces the anomalous authentication behavior or patching of LSASS on a domain controller once it occurs.
- T1556.002detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which would surface anomalous password-filter registration or credential-harvesting behavior in dynamic access management; this is a genuine but minority slice of the technique (only the misuse/alerting surface, not the initial malicious DLL registration itself).
- T1556.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous PAM modifications or credential-harvesting in flight; this is only a slice of the full technique because the clause's scope is limited to high-value/sensitive information under dynamic access management rather than all PAM activity.
- T1556.003prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, and dynamic techniques (including isolation and credential enforcement) stop many unauthorized modifications or backdoors to PAM that would enable unwarranted access, but do not address the initial code-level modification of PAM components themselves or all credential-harvesting vectors in the technique.
- T1556.005detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information; this surfaces the technique when an adversary sets or exploits the reversible-encryption property on protected assets, but only for the subset of cases falling inside the organization's chosen dynamic-access scope rather than all instances of the technique.
- T1556.005prevents — A.8.3 explicitly requires restricting access to sensitive information (including credentials) via configuration mechanisms, identity/group controls, dynamic access management, authentication requirements, encryption, monitoring, and alerts; this directly counters the adversary's technique of enabling reversible encryption to expose plaintext credentials, but only partially as the control is a set of requirements whose actual coverage depends on implementation rigor and does not guarantee the property stays disabled everywhere (e.g., sanctioned legacy exceptions).
- T1556.006detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces adversary MFA tampering when it triggers those alerts or logs; this is a genuine but minority slice of the broad technique (only where dynamic/encrypted/high-value info is involved and the alert fires before or during the modification).
- T1556.006prevents — A.8.3's access restriction rules, configuration mechanisms, dynamic access management, authentication requirements, time-bound restrictions, and monitoring/alerting directly stop many ways of disabling or bypassing MFA (e.g. via policy exclusions, registration of weak methods, or unauthorized changes), but the technique can still succeed against accounts already compromised without MFA, via patching of MFA programs, or in fail-open configurations that the control does not universally close.
- T1556.007detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational/monitoring processes for dynamic access management, which surfaces anomalous authentication behavior tied to hybrid identities; this is a genuine but minority slice of the technique (on-prem DLL injection or config edits can occur without touching monitored information flows).
- T1556.007prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, time-bound restrictions, encryption, monitoring, and alerts directly close the authentication bypass vector in many hybrid setups (e.g. by enforcing proper credential validation and blocking anonymous/unauthorized modifications), but the technique's on-premises compromise and DLL/config injection steps sit outside the clause's reach, leaving a genuine minority slice prevented.
- T1556.008detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous credential-capture behavior from a malicious network provider DLL; this is only a slice of the technique's full surface (installation via Registry, targeting of DCs, etc.) rather than a bounded remainder.
- T1556.008prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, dynamic techniques, authentication requirements, and isolation) can stop malicious network provider DLL registration and credential capture in many cases, but leaves a bounded remainder around physical/logical isolation gaps, unmanaged registry changes, and non-sensitive credential paths not covered by dynamic management.
- T1556.009detects — A.8.3 explicitly requires monitoring, reporting, recording of access/use, and raising alerts on misuse attempts, which surfaces modification of conditional access policies when those actions are observable within the configured dynamic access management scope.
- T1556.009prevents — A.8.3 explicitly requires restricting access per policies, configuration mechanisms, identity/group controls, dynamic access management based on identity/device/location/time/risk, MFA/credential requirements, and real-time monitoring/alerting — all of which directly stop the adversary technique of disabling or modifying conditional access policies to enable persistent access.
- T1557detects — A.8.3 explicitly calls for dynamic access management to monitor use, record access/changes, and raise alerts on misuse attempts, which can surface some AiTM positioning or anomalous traffic patterns in real time; this is only a slice because the clause is scoped to sensitive/high-value information under dynamic controls rather than broadly detecting all network-protocol abuses (ARP/DNS/LLMNR manipulation, downgrades) across any asset.
- T1557prevents — A.8.3's access restriction, configuration mechanisms, authentication requirements, encryption mandates, and dynamic controls (including isolation and monitoring) can stop many AiTM positioning vectors that rely on unauthenticated traffic, weak protocols, or unauthorized interception, but not all protocol-abuse or downgrade cases on every platform.
- T1557.001detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces name-resolution poisoning and relay attempts when they trigger authentication or data flows under dynamic access controls, but this is scoped only to monitored sensitive information rather than broadly detecting the network-level spoofing itself.
- T1557.001prevents — A.8.3's access restriction (including no anonymous access to sensitive info, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques with auth/encryption/monitoring) can block unauthenticated name-resolution responses and NTLM hash relay on sensitive resources, but leaves residual exposure on non-sensitive traffic, legacy protocols, and non-dynamic environments where poisoning still succeeds.
- T1557.002detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface ARP poisoning when it enables observable network anomalies or unauthorized data access/relaying; this is limited to a slice (post-positioning effects on monitored sensitive info) rather than broadly detecting the ARP cache manipulation itself.
- T1557.003detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces rogue DHCP responses and anomalous configurations in monitored environments, but only for the slice of the technique that affects protected/sensitive information under dynamic access management rather than all DHCP spoofing on the network.
- T1557.004detects — A.8.3 explicitly requires monitoring use of information, recording access, and raising alerts on misuse attempts, which can surface an evil twin once a victim has connected and traffic is flowing; this is a genuine but minority slice of the technique (the setup/probe-response phase itself is invisible to these controls).
- T1557.004prevents — A.8.3's access restriction rules, configuration mechanisms, authentication requirements, encryption, dynamic controls, and isolation of sensitive systems can stop many (but not all) evil twin connection and follow-on behaviors when applied to Wi-Fi networks and client devices.
- T1558detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which would surface Kerberos ticket theft or anomalous use in covered systems; partial because scope is limited to information deemed sensitive/high-value under the organization's classification and dynamic access rules, not all Kerberos activity or platforms.
- T1558prevents — A.8.3's access restriction rules, authentication requirements, dynamic controls, encryption, and monitoring directly stop many vectors for stealing or forging Kerberos tickets (e.g. anonymous access, weak credential use, uncontrolled distribution), but leave a bounded remainder such as attacks on the KDC itself, memory scraping of valid tickets from authorized sessions, or Kerberos implementation flaws that the control does not address.
- T1558.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces golden ticket misuse in monitored environments but only for a chosen slice of assets and does not broadly instrument KDC/DC forgery itself.
- T1558.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, time-bound restrictions, and dynamic management based on identity/device/location directly constrain the use of a forged golden ticket to obtain TGS tickets and access resources, but do not stop the prerequisite KRBTGT hash theft via credential dumping on a domain controller.
- T1558.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface silver ticket usage in real time or in logs; this is limited to the slice of dynamic access management implementations rather than a universal or bulk mechanism against the technique.
- T1558.002prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, time-bound restrictions, and dynamic management based on identity/device/location directly stop forged silver tickets from being usable to access the target resource or system in many configurations, but do not stop hash theft via Kerberoasting/OS dumping or the offline forgery step itself.
- T1558.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface Kerberoasting (TGS requests for SPNs, anomalous service-account ticket patterns) when those indicators fall inside the chosen scope; it is not required to instrument the specific Kerberos DC behavior or network sniffing that realizes the technique.
- T1558.003prevents — A.8.3's access restriction, configuration mechanisms, identity/group controls, dynamic access management, authentication requirements, encryption, and monitoring directly constrain Kerberoasting vectors (e.g. limiting anonymous/SPN access, enforcing stronger encryption beyond RC4, time-bound/dynamic controls, and misuse alerts), but these are requirements rather than universal mechanisms and leave residual exposure on service accounts, legacy Kerberos configs, and sniffed TGS tickets in many Windows environments.
- T1558.004detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface AS-REP roasting activity (e.g. anomalous AS-REQ patterns or credential-cracking indicators) when the technique touches monitored assets; this is only a slice because the clause scopes to organization-defined sensitive information and dynamic-access cases rather than broadly instrumenting all Kerberos pre-auth enumeration or offline cracking.
- T1558.004prevents — A.8.3's access restriction, authentication requirements, dynamic controls, and encryption guidance can enforce pre-authentication and stronger algorithms on Kerberos exchanges, blocking the unauthenticated AS-REP that enables offline cracking, but this is a minority slice of the technique whose dominant vector is accounts already configured without pre-authentication.
- T1558.005detects — A.8.3 explicitly lists raising alerts on detected misuse of protected information plus recording access/usage as part of dynamic access management, which surfaces the theft or anomalous use of ccache Kerberos tickets; this is only a slice of the technique (real-time monitoring of high-value info, not general filesystem or memory scraping of /tmp or in-memory ccache on Linux/macOS).
- T1558.005prevents — A.8.3's access-restriction mechanisms (authentication, credential requirements, dynamic controls based on identity/device/location, isolation of sensitive data, and encryption) can stop adversaries from reading or extracting ccache files on Linux/macOS when those files hold sensitive Kerberos tickets, but the control is silent on memory-resident ccache, default /tmp permissions, and the post-authentication collection step itself, leaving a substantial slice of the technique reachable.
- T1559detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous IPC abuse when it involves sensitive data under dynamic access management; this is only a slice of the broad technique (any IPC for code execution, not limited to monitored sensitive assets).
- T1559prevents — A.8.3's access restriction rules (identity/group controls, dynamic management based on identity/device/location, authentication requirements, and isolation of sensitive apps/data) can stop many IPC abuse paths that rely on unauthorized cross-process access or untrusted identities, but leave a bounded remainder for same-privilege local IPC mechanisms, pipes/sockets used by already-authorized processes, and non-access-control aspects of the technique.
- T1559.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface COM abuse when it touches protected assets; this is only a slice of the technique (not all COM execution involves monitored sensitive info or triggers the dynamic access layer).
- T1559.001prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, dynamic controls, encryption and isolation, which can block some COM abuse vectors (e.g. unauthorized client calls to exposed interfaces or sensitive objects), but leaves the bulk of the technique (local IPC, language-specific abuse of standard COM objects for execution/persistence) untouched as it is not primarily an information-access issue.
- T1559.002detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, and raise alerts on misuse attempts, which can surface DDE-based command execution when it involves protected data or anomalous access patterns, but this is scoped only to high-value/sensitive information under dynamic controls rather than broadly detecting all DDE technique instances.
- T1559.002prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, encryption, monitoring/alerting on misuse, and isolation of sensitive apps/data) can stop DDE command execution in Office/CSV documents by blocking unauthorized access or poisoning at creation/processing/transmission, but leaves a large remainder where DDE is enabled by default, used in benign IPC, or invoked post-compromise via registry/remote services without violating the access rules.
- T1559.003detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface XPC abuse (especially via dynamic access management on macOS assets); this is a genuine but minority slice of the technique's surface (client validation, input sanitization, and privilege-escalation vectors are not covered).
- T1559.003prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, and dynamic techniques (including input-handling slices via sanitization and client validation) can stop malicious XPC content from reaching the root daemon on macOS, but this is only a minority slice of the technique whose dominant vectors live in improper protocol definitions, poor sanitization inside the app's XPC handler, and privilege-escalation paths that the control does not govern.
- T1560detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse of protected information throughout its lifecycle (including storage/transmission), which surfaces adversary compression/encryption of collected data when it touches monitored sensitive assets, but only for information under dynamic access management rather than all collected data an adversary might target.
- T1560.002detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface the anomalous use of archival libraries (or their output) when the activity is treated as misuse of sensitive information; this is a genuine but minority slice because the control is scoped to information assets under dynamic access management rather than broadly instrumenting all library-linked compression/encryption in adversary tooling.
- T1560.003detects — A.8.3's dynamic access management explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface custom archival behavior on sensitive data in monitored environments, but this is limited to cases where the technique touches protected information under dynamic controls rather than arbitrary post-collection compression anywhere.
- T1561prevents — A.8.3 restricts access (including write/execute) to information and assets via policies, auth, config mechanisms, dynamic controls, and encryption, which can block the direct write access required for disk wiping on covered systems; however, it does not address all vectors such as network device CLI erase commands, worm-like propagation via other techniques, or complete wipes after initial access is obtained.
- T1561.001detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface disk-wipe activity when it touches monitored sensitive assets or uses monitored access paths, but this is scoped only to information under dynamic access management rather than arbitrary disk content across the enterprise.
- T1561.001prevents — A.8.3 restricts access (including physical/logical isolation, dynamic controls, authentication, and encryption) to storage and sensitive data, which can block the direct disk access needed for arbitrary overwrites on many platforms, but leaves residual paths via privileged accounts, third-party drivers, or already-compromised sessions that the control does not itself close.
- T1561.001recovers — A.8.3 explicitly requires backup/recovery mechanisms via dynamic access management that protects information throughout its life cycle including disposal, plus recording changes for investigation and restoring availability after destructive wipe events.
- T1561.002prevents — A.8.3's access restriction (including physical/logical isolation of sensitive systems, dynamic access controls based on identity/device/location, and authentication requirements) can block the credentialed or privileged access needed to overwrite MBR/partition structures on many platforms, but leaves a bounded remainder on network devices, unauthenticated local attacks, and post-compromise execution that does not rely on broad information-access grants.
- T1561.002recovers — A.8.3's dynamic access management explicitly protects information throughout its life cycle including disposal, and its backup/restore-enabling mechanisms (encryption, access controls, monitoring, alerts) allow recovery of wiped structures from protected copies or snapshots when the technique has already run.
- T1563detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces session hijacking in flight when it touches protected information or violates dynamic rules; this is a genuine but minority slice because the clause's scope is limited to high-value/sensitive information under dynamic access management rather than all remote sessions (SSH/RDP/telnet) across the enterprise.
- T1563prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (time-bound, credentialed, monitored), and session-aware protections (authentication, encryption, alerts on misuse) stop many hijacking vectors on existing remote sessions, but leave a slice where an already-authenticated session is commandeered post-establishment without violating the access rules themselves.
- T1563.001detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces SSH session hijacking in flight when dynamic access management or logging is active; partial because scope is limited to information under dynamic controls rather than all SSH sessions or agent compromises.
- T1563.001prevents — A.8.3's access-restriction rules (no anonymous access, identity/group controls, dynamic techniques requiring auth/credentials, time-bound access, monitoring/alerting on misuse) stop many SSH-agent/socket hijacks that rely on weak or overly-broad trust relationships, but cannot prevent root-level compromise of an already-authenticated session or agent on the local host.
- T1563.002detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces RDP hijacking in flight when it touches monitored sessions or data; this is only a slice because the clause scopes to high-value/sensitive information under dynamic access management rather than all RDP sessions.
- T1563.002prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, isolation, and dynamic techniques (auth, time-bound access, encryption, monitoring/alerts); this stops many hijacking vectors (esp. unauthorized session access/stealing without creds), but leaves a genuine remainder for local System-privileged abuse of native tools like tscon.exe on already-authenticated sessions.
- T1564detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access/changes, and raising alerts on misuse attempts, which surfaces many hiding techniques (e.g. unauthorized file/directory/account changes) in real time; this is only a slice because the control is scoped to sensitive/high-value information under policy, leaving ordinary artifacts, isolated regions (virtualization), and non-access-related hiding outside its view.
- T1564prevents — A.8.3's access restriction rules, isolation controls, dynamic management, authentication, time-bound restrictions and monitoring directly block many hiding techniques that rely on unauthorized access, improper permissions or non-isolated regions, but leave untouched legitimate OS hiding features abused after authorized access and virtualization-based isolation outside the clause's scope.
- T1564.002detects — A.8.3 explicitly requires recording who accesses information, monitoring its use, raising alerts on misuse attempts, and establishing operational/monitoring/reporting processes for dynamic access management, which surfaces hidden-user anomalies as part of unauthorized access detection; this is a genuine but minority slice of the technique (primarily configuration changes rather than runtime access events).
- T1564.002prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, and dynamic techniques (authentication, time-bound access, monitoring, alerts) can stop adversaries from successfully creating or using hidden users to conceal accounts, but the control does not address the specific configuration changes (plist, registry, gsettings, attributes) that realize the hiding on each platform.
- T1564.004detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces NTFS attribute abuse when it occurs within the monitored scope, but the clause sets scope by policy rather than mandating coverage of all file-system metadata techniques.
- T1564.005detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface hidden file system artifacts when they interact with monitored sensitive data or violate dynamic rules, but this is limited to scoped/known information rather than broadly detecting the technique's creation or presence on disk.
- T1564.006detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access/changes, and raising alerts on misuse, which can surface anomalous virtualization activity (e.g. rogue VM creation, unexpected shared folders, or hidden ESXi VMs) when it interacts with protected information or systems; this is only a slice of the technique's full scope (creation/execution inside isolated instances that evade monitoring).
- T1564.008detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface the creation or effects of malicious email-hiding rules as anomalous behavior; this is limited to a slice because the clause's scope is set by the organization's chosen policies and does not mandate instrumentation that would catch every possible rule-creation vector or stealthy transport-rule abuse.
- T1564.009detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface resource-fork abuse when the fork carries or reveals sensitive information under dynamic access management; this is only a slice of the technique (not all resource-fork use involves protected data or triggers the alerts).
- T1564.009prevents — A.8.3's access restriction rules, configuration mechanisms, dynamic management, authentication requirements, encryption, and monitoring can stop resource-fork hiding and execution on macOS in many configurations, but the control is scoped to information/assets rather than all file-system abuse vectors and does not mandate the specific macOS mechanisms that close every resource-fork technique.
- T1564.010detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that surface anomalous or unauthorized behavior, which can detect PEB manipulation when it triggers those alerts or logs; this is only a slice because the control is scoped to information assets and authorized access rather than general process-memory evasion on Windows.
- T1564.012detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces the placement or presence of hidden artifacts inside exclusions when those locations fall inside the monitored scope; it does not guarantee coverage of all possible exclusion paths or discovery of the exclusions themselves.
- T1564.012prevents — A.8.3's access restriction mechanisms (including dynamic techniques, authentication, encryption, monitoring, and isolation of sensitive data) can stop adversaries from successfully hiding file artifacts in excluded paths by enforcing granular controls that limit unauthorized placement and detect misuse, but this is only a slice as the control does not mandate or enforce specific AV/exclusion configurations or removal of default trusted paths that adversaries abuse.
- T1564.014detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface xattr abuse when it involves monitored identities, dynamic rules, or detectable access patterns; however this is scoped only to the subset of xattr use that triggers those alerts rather than broadly detecting the hiding technique itself.
- T1564.014prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can stop adversaries from writing to or reading from xattrs used for hiding payloads, but only for the subset of xattrs governed by access control or dynamic management; many xattrs (e.g. user. namespace, com.apple.*) remain writable by the file owner or processes without triggering these restrictions, leaving a genuine slice of the technique unaddressed.
- T1565detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces data manipulation attempts in covered dynamic-access scenarios; this is only a slice of T1565 (e.g., post-compromise manipulation of non-sensitive or non-DAM data is unreached).
- T1565prevents — A.8.3 restricts access (including to sensitive/high-value data via dynamic techniques, auth, encryption, monitoring, and rules on identity/device/location) which stops many unauthorized manipulation paths, but leaves open slices such as authorized users, insider threats, or post-access manipulation that the control does not address.
- T1565.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface stored data manipulation in flight or after the fact; partial because the clause's scope is limited to information covered by its dynamic access management rules and topic-specific policies rather than all stored data universally.
- T1565.001prevents — A.8.3 restricts access to stored information (via policies, config mechanisms, identity/group controls, physical/logical isolation, dynamic rules based on identity/device/location, authentication, time-bound access, encryption, and monitoring/alerting), directly stopping most unauthorized insert/delete/manipulation of data at rest on the listed platforms; the bounded remainder is post-access manipulation by already-authorized identities or via unmonitored vectors.
- T1565.002detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces T1565.002 activity when it involves protected data but only for the subset of transmissions covered by dynamic access management rather than all in-transit manipulation.
- T1565.002prevents — A.8.3's access restriction, configuration mechanisms, dynamic access management, authentication, encryption, and integrity-oriented controls (preventing unauthorized changes) stop many in-transit manipulation opportunities by enforcing who/what can touch data during transmission; however, it does not address all interception vectors, specialized expertise needs, or non-access-control manipulation methods for all transmission mechanisms.
- T1565.003detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces runtime data manipulation when it triggers those observables; this is only a slice because the clause's scope is limited to information assets under dynamic access management rather than all binaries, applications or system modifications that could produce the technique.
- T1565.003prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, encryption, auth, monitoring, and isolation of sensitive data/apps), which can stop many runtime manipulation vectors that rely on gaining unauthorized access to alter binaries, associations, or data flows, but leaves open expert post-access modifications, physical/logical gaps, and non-access-based techniques like masquerading.
- T1566detects — A.8.3's dynamic access management explicitly raises alerts on detected misuse of protected information and records access/use throughout the lifecycle, which surfaces some phishing delivery (e.g. malicious links/attachments to sensitive assets) but does not broadly instrument for phishing messages themselves.
- T1566.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface spearphishing attachment delivery or opening in real time or post-execution; this is limited to a slice (e.g., monitored systems or dynamic DRM-wrapped attachments) rather than broadly detecting the social-engineering email vector itself.
- T1566.001prevents — A.8.3's access restriction (including dynamic techniques, authentication, encryption, monitoring, and isolation of sensitive data) can stop the malicious attachment from being opened or executed on authorized systems, but does not stop the email from being delivered or the user from being socially engineered into opening it.
- T1566.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface spearphishing link delivery or resulting anomalous access/token grants; partial because the clause's scope is limited to protected information/assets rather than all email vectors or link clicks themselves.
- T1566.002prevents — A.8.3 restricts access to information/assets via policies, dynamic controls, authentication, encryption, and monitoring, which can block some post-click outcomes like unauthorized token grants or data exfiltration but does not stop the social-engineering delivery of the malicious link itself or user execution of it.
- T1566.003detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on detected misuse; this surfaces spearphishing attempts delivered via monitored services or when the malicious payload reaches protected assets, but the control's scope is limited to information under organizational management and does not broadly instrument third-party social/webmail channels where most of the technique occurs.
- T1566.004detects — A.8.3 explicitly calls for dynamic access management to raise alerts on misuse attempts and to record/monitor access and use of protected information, which can surface vishing-driven credential theft or unauthorized access once it occurs, but this is limited to post-compromise monitoring of the resulting access rather than detecting the voice call or social engineering itself.
- T1567detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface exfiltration-over-web-service activity when it involves protected data; this is only a slice of the technique (not all exfil uses monitored sensitive info or triggers the dynamic access layer).
- T1567prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, encryption, monitoring/alerting, and lifecycle controls on sensitive data) can stop unauthorized exfiltration of that data over web services in the scenarios it targets, but leaves the bulk of T1567 (non-sensitive data, non-dynamic cases, already-permitted legitimate channels, and post-auth adversary actions) untouched.
- T1567.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface exfiltration to a code repo API when it occurs inside the monitored scope.
- T1567.001prevents — A.8.3's access restriction rules, dynamic management, authentication/credential requirements, encryption, monitoring, and alerts can stop unauthorized exfiltration of sensitive data to a code repo API in many covered scenarios, but this is only a slice: the control depends on prior classification, policy, and correct implementation, leaves non-sensitive data and unmonitored paths untouched, and does not block an already-authenticated insider or compromised credential from using a permitted repo channel.
- T1567.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface exfiltration to cloud storage when it triggers those alerts or logs; this is only a slice because the clause's scope is limited to information the organization has already classified and wrapped in dynamic access management rather than all possible exfil targets or unauthenticated flows.
- T1567.002prevents — A.8.3's access restriction rules, dynamic management, authentication, encryption, monitoring and alerts can stop data from reaching unauthorized cloud storage when those controls govern the sensitive information and its egress paths, but the clause is silent on outbound network controls, DLP-style blocking of cloud service APIs, or cases where the adversary already has valid credentials to an allowed cloud storage service.
- T1567.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface exfiltration to text storage sites when it triggers those alerts or logs; this is limited to a slice because the control's scope is set by organizational policies and does not mandate universal coverage of all exfil channels or platforms.
- T1567.003prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, encryption, auth, time-bound controls, and monitoring/alerts on misuse), which can stop adversaries from successfully exfiltrating to public text storage sites in many configurations, but leaves open cases such as insider-authorized exfil, misconfigured public shares, or post-compromise use of stolen credentials.
- T1567.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface webhook exfiltration when it triggers those alerts or logs (especially in SaaS/collaboration services), but this is scoped only to the subset of cases involving monitored sensitive information under dynamic access management rather than the technique in general.
- T1567.004prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, encryption, auth, monitoring/alerts on misuse), which can stop adversaries from staging/posting data to webhook endpoints or linking SaaS for exfil in covered scenarios, but leaves gaps for unmonitored/unauthenticated paths, non-sensitive data, and blending with normal traffic.
- T1568.003detects — A.8.3's dynamic access management explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface anomalous DNS-based C2 port/IP calculations when they trigger access or data-distribution rules; this is a genuine but minority slice of the technique's full scope across platforms and non-access behaviors.
- T1569detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces abuse of system services when those services interact with or expose the monitored sensitive information or assets; this is a genuine but minority slice of T1569 (most service abuse, especially for one-time execution or persistence via unrelated services, sits outside any information-access monitoring scope).
- T1569prevents — A.8.3's access restriction (including config mechanisms, identity/group controls on execute, physical/logical isolation of sensitive apps/systems, and dynamic techniques requiring auth/credentials) stops many abuse paths for creating or interacting with services to run malicious content, but leaves a bounded remainder where services run under already-authorized identities or via boot-time mechanisms outside the restriction scope.
- T1569.001prevents — A.8.3's access restriction (including dynamic techniques, authentication, time-bound controls, and isolation of sensitive apps/data) can stop unauthorized launchctl abuse on macOS services in covered identities/locations/periods, but leaves a large remainder where the technique runs under authorized sessions or on unmanaged systems.
- T1569.002detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces anomalous service-control-manager activity when it touches protected/sensitive information or assets; this is a genuine but minority slice of the technique (most service execution is not information-centric and falls outside the clause's scope).
- T1569.002prevents — A.8.3 restricts access to information/assets via policies, identity/group controls, dynamic access management, authentication, time-bound restrictions, and monitoring, which can block unauthorized abuse of the service control manager for execution on Windows (especially remote or sensitive-service cases), but leaves a large remainder for local admin/service-account abuse, misconfigurations, and non-information-focused privilege-escalation paths the control does not reach.
- T1569.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface systemctl abuse when it triggers those rules or alerts; this is only a slice because the clause's scope is set by the organization's chosen policies, classification, and dynamic-access use cases rather than mandating universal detection of all service-management abuse on Linux.
- T1569.003prevents — A.8.3's access restriction (including config mechanisms, identity/group controls on execute, physical/logical isolation of services, and dynamic techniques requiring auth/credentials) can stop unauthorized systemctl abuse for service execution on Linux, but leaves a bounded remainder where the actor already holds legitimate elevated access or the service itself is permitted.
- T1570detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface anomalous file transfers (e.g. via SMB, RDP, scp) involving sensitive information, but this is scoped only to high-value assets under dynamic access management rather than all lateral tool movement.
- T1570prevents — A.8.3 restricts access to information/assets (including via config mechanisms, identity/group controls, physical/logical isolation, dynamic rules on identity/device/location, authentication requirements, time-bound access, and encryption), which stops many file-transfer vectors for tools (e.g. unauthorized shares, unauthenticated RDP/SMB, open services); it leaves open transfers that use already-authorized sessions, native tools under permitted accounts, or insider-abused legitimate channels, so the slice prevented is genuine but not the bulk.
- T1571detects — A.8.3's dynamic access management explicitly requires monitoring, recording of access/use, and raising alerts on misuse, which can surface non-standard port usage when it triggers policy violations on sensitive information flows; this is only a slice of the technique (e.g., not all non-standard port abuse involves monitored sensitive data or dynamic controls).
- T1572detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse attempts, which surfaces tunneling when it triggers dynamic access controls or anomalous use of protocols/encryption; this is only a slice because the clause is scoped to sensitive information assets rather than all network traffic or protocol anomalies.
- T1572prevents — A.8.3's access restriction, configuration mechanisms, physical/logical isolation, dynamic access rules (identity/device/location), authentication requirements, encryption mandates, and misuse alerts can stop many tunneling vectors that rely on unauthorized access, unauthenticated encapsulation, or policy-violating routing, but cannot prevent all (e.g., authorized user performing allowed SSH/DoH tunneling or insider abuse of permitted protocols).
- T1573detects — A.8.3 explicitly requires monitoring, recording access/use, and raising alerts on misuse of protected information, which surfaces anomalous encrypted C2 channels when they touch organization-controlled assets or data flows, but this is scoped only to the organization's own sensitive information rather than broadly detecting adversary C2 encryption in general.
- T1574detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces some hijack-execution techniques (especially those involving sensitive data or dynamic access) but does not broadly instrument for all execution-flow hijacks such as library search-order poisoning or registry manipulation on non-sensitive binaries.
- T1574prevents — A.8.3's access restriction mechanisms (including isolation of sensitive apps/data, dynamic controls, authentication, encryption, and monitoring) can stop some hijack vectors that rely on unauthorized access to or poisoning of execution-related resources, but many classic T1574 techniques (DLL search-order hijacking, path interception, registry poisoning for non-sensitive locations) remain outside its scope.
- T1574.001detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which surfaces some DLL-abuse behaviors (especially those involving sensitive data or anomalous access), but the clause is scoped only to information assets under dynamic access management rather than broadly detecting all DLL sideloading, search-order hijacking, or phantom substitution across the enterprise.
- T1574.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can block many DLL planting, search-order, and substitution vectors when they involve unauthorized access to sensitive locations or files, but this is only a slice — the technique's core (hijacking legitimate program load paths, phantom references, remote shares, or in-process execution under trusted context) is not directly addressed by information-access policy or dynamic management.
- T1574.004detects — A.8.3 explicitly calls for monitoring use of protected information, recording access, and raising alerts on misuse attempts, which surfaces dylib hijacking when it involves sensitive assets under dynamic access management; this is only a slice of the technique because the clause is scoped to information assets rather than all dylib loads or path searches.
- T1574.004prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, isolation of sensitive apps/data, dynamic techniques with auth/encryption/monitoring) can stop malicious dylib placement or loading in protected paths or apps, but leaves a large remainder for unprotected binaries, weak linking, unmonitored search paths, and non-sensitive apps on macOS.
- T1574.005detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface installer permission weaknesses or the resulting anomalous execution in covered sensitive assets, but only a minority slice of the technique (not general installer behavior or non-sensitive paths).
- T1574.005prevents — A.8.3 directly requires restricting access to files/directories (via config mechanisms, identity/group controls on read/write/execute, and isolation of sensitive apps/data), which stops the improper permissions that let user-level writes replace installer binaries; dynamic techniques further tighten this, but the control is a requirement-setting clause whose actual coverage depends on implementation scope and does not reach every installer or TEMP subdirectory by default.
- T1574.006detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces anomalous linker hijacking when it touches protected assets; this is a genuine but minority slice of the technique (most hijacks target non-sensitive processes or evade the monitoring scope).
- T1574.006prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, physical/logical isolation, dynamic techniques, authentication, time-bound restrictions, and monitoring) can stop many environment-variable or library-loading paths that lead to unauthorized hijacking, but leaves real residual cases such as developer/debug use of LD_PRELOAD, unmonitored processes, or pre-auth injection vectors that the clause does not universally close.
- T1574.007detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous PATH modifications or hijack executions when they involve monitored sensitive assets or identities, but this is scoped only to the subset of cases inside the dynamic access management slice rather than broadly detecting the technique itself.
- T1574.007prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (authentication, time-bound access, encryption, monitoring, alerts) can stop unauthorized placement or execution via PATH hijacking in many cases, but leave real gaps on direct $PATH/$HOME modification, shell config changes, and non-sensitive or unmanaged directories.
- T1574.008detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which can surface search-order hijacking artifacts (e.g. anomalous file placement or execution in program directories) when those fall inside the monitored scope, but the clause sets scope by policy rather than mandating detection of this specific technique.
- T1574.008prevents — A.8.3's access restriction rules (including physical/logical isolation of apps/data, dynamic techniques, authentication, time-bound access, and monitoring) can stop an adversary from placing or executing a malicious file in the vulnerable directory for many cases, but this is only a slice because the control is scoped to information/assets and authorized identities rather than mandating full-path resolution or removing the underlying search-order vulnerability in all Windows program loading.
- T1574.009detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface anomalous executable launches or path-resolution behaviors involving protected assets; this is limited to the subset of path-interception cases that touch monitored high-value information rather than the technique's full scope (any unquoted path).
- T1574.009prevents — A.8.3's access restriction rules (including configuration mechanisms, identity/group controls on read/write/execute, physical/logical isolation of sensitive apps/data, and dynamic techniques that enforce authentication/credentials/encryption/time-bound access) directly stop the unquoted-path hijack from succeeding when the vulnerable reference is to a protected resource, but this is only a slice: the control does not mandate quoting all paths, fix all unquoted service/shortcut/registry entries, or reach every possible interception vector on Windows.
- T1574.010detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces the anomalous binary replacement or permission abuse when it occurs; partial because the clause's scope is set by topic-specific policies and dynamic management of high-value/sensitive information rather than mandating broad detection of all Windows service binary hijacks.
- T1574.010prevents — A.8.3 directly requires restricting access to binaries/directories per policies (including via config mechanisms, identity/group controls on read/write/execute, and isolation), which stops the improper permissions that enable binary hijacking and replacement.
- T1574.011detects — A.8.3 explicitly lists dynamic access management that raises alerts on misuse attempts and records access/use of information, which can surface Registry permission abuse or anomalous service Registry changes in monitored sensitive assets, but this is scoped only to high-value information under dynamic controls rather than broadly detecting the technique across all services Registry keys.
- T1574.011prevents — A.8.3 directly requires restricting access to Registry keys (via ACLs, identity/group controls, configuration mechanisms, and isolation) per policies, which stops the permission flaws that enable this hijacking technique; mostly because the control is a requirement-setting clause whose actual coverage depends on implementation rigor and leaves a bounded remainder for edge cases like dynamic/legacy services or incomplete enforcement.
- T1574.012detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces COR_PROFILER abuse when it touches monitored sensitive .NET processes or registry settings, but the clause's scope is limited to organization-defined sensitive information rather than all .NET CLR loading events.
- T1574.012prevents — A.8.3 restricts access to information/assets via policies, identity/group controls, dynamic management, authentication, and encryption; this can block unauthorized setting/leveraging of COR_PROFILER (a registry/env var that influences .NET process execution) in many but not all cases (e.g., in-memory process-scope abuse or privileged contexts remain possible).
- T1574.013detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the information lifecycle, which surfaces the hijack when it touches monitored sensitive data or triggers anomalous access; this is a genuine but minority slice because the technique is a low-level in-process execution-flow attack that can complete without touching organizationally-classified sensitive information at all.
- T1574.014detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces AppDomainManager hijacking when it touches monitored sensitive .NET-managed assets; this is only a slice of the technique's possible executions (e.g. non-sensitive processes or pre-access tampering of .config/env vars).
- T1574.014prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, isolation of sensitive apps/data, dynamic rules based on identity/device/location, and authentication/credential requirements) can stop unauthorized hijacking of .NET AppDomainManager loading in many scenarios, but leaves a bounded remainder for tampering with .config files, environment variables, or unmonitored processes outside the enforced policies.
- T1578detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording changes, raising alerts on misuse, and operational/monitoring processes for dynamic access management, which surfaces T1578 modifications that affect access, permissions or evidence in IaaS but only for the subset of cases involving monitored sensitive information rather than all infrastructure changes.
- T1578prevents — A.8.3's access restriction mechanisms (including dynamic ones with auth, time-bound rules, encryption, monitoring and alerts) can stop an adversary from gaining the permissions needed to modify cloud compute infrastructure, but this is only a slice: the control is scoped to information/assets and does not reach all IaaS modification vectors such as direct API abuse of unmanaged components.
- T1578.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the creation of snapshots (or the subsequent mounting/policy changes) when performed by unauthorized or anomalous identities; this is limited to a slice because the control is scoped by topic-specific policies and does not mandate universal cloud IaaS telemetry or detection of all permission-leveraging snapshot events.
- T1578.002detects — A.8.3 explicitly requires monitoring, reporting, raising alerts on misuse, and recording access/use throughout the information lifecycle, which surfaces anomalous cloud-instance creation in monitored environments, but only where that creation touches protected information under the dynamic or access-control rules (a bounded slice of the IaaS technique).
- T1578.002prevents — A.8.3's access restriction rules (including dynamic techniques, auth requirements, time-bound access, encryption, monitoring/alerting, and policy-driven controls on identities/devices/locations) can stop an adversary from successfully creating and using a new cloud instance with lax permissions to bypass existing defenses or access data, but this is only a slice — the control does not govern cloud compute provisioning, snapshot mounting, or the underlying IaaS permission model that actually enables the technique.
- T1578.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface deletion of high-value instances as anomalous, but this is scoped only to protected sensitive information under dynamic access management rather than all cloud instances or general forensic evidence removal.
- T1578.004detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the revert action or its anomalous snapshot/restore use in IaaS; this is only a slice because the clause's scope is set by access policies and does not mandate instrumentation of every cloud management API or ephemeral storage reset.
- T1578.005detects — A.8.3 explicitly calls for monitoring use of information, recording changes, raising alerts on misuse, and operational/monitoring processes for dynamic access management, which can surface unauthorized configuration modifications involving sensitive compute-related information or policies; this is a genuine but minority slice of the technique (focused on monitored high-value info rather than all quota/region/policy changes).
- T1580detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface T1580-style discovery (especially anomalous enumeration via compromised keys or APIs), but only for the subset of activity that triggers the configured alerts or monitoring scope rather than all discovery.
- T1580prevents — A.8.3 restricts access to information/assets per policies (including via auth, dynamic controls, encryption, and isolation of sensitive data), which stops unauthenticated or unauthorized calls to discovery APIs like DescribeInstances/ListBuckets that rely on compromised credentials or public exposure; it does not stop authenticated discovery by a user who already holds legitimate read rights to the resources.
- T1586prevents — A.8.3 restricts access to information/assets via policies, auth, dynamic controls, encryption, and monitoring, which can block some credential compromise vectors (e.g. brute force, unauthorized access to credential stores) but leaves social engineering, phishing, purchasing, or insider sales untouched.
- T1586.003prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts), which directly blocks many post-compromise uses of cloud accounts (e.g. unauthorized exfil, tool upload, infrastructure acquisition, messaging abuse) but does not stop the pre-compromise methods (phishing, password spraying, token theft, reconnaissance) that enable the account takeover itself.
- T1589prevents — A.8.3 restricts access to sensitive identity/credential data (no anonymous access, dynamic controls, encryption, monitoring, MFA requirements) which stops some pre-attack gathering vectors (leaks, exposed datasets, auth probing) but leaves open social media, phishing elicitation, and public web search that do not rely on protected organizational stores.
- T1589.001prevents — A.8.3 restricts access to information (including credentials) via policies, auth requirements, dynamic controls, encryption, monitoring and alerts, which stops some gathering vectors (e.g. anonymous leaks, unauthorized repository access, or real-time misuse of stored creds) but leaves most of the described collection methods (phishing, site compromise, dark-web purchase, breach dumps, infostealer logs) untouched.
- T1595.003prevents — A.8.3 restricts access to discovered sensitive information/assets (via auth, dynamic controls, encryption, monitoring, and isolation of sensitive storage), which stops the post-discovery exploitation path in the technique, but does not stop the reconnaissance/probing itself on non-sensitive or public infrastructure.
- T1597.001prevents — A.8.3 restricts access to sensitive information (including via dynamic techniques, authentication, encryption, monitoring, and alerts on misuse) which can prevent adversaries from successfully searching/retrieving private threat intel vendor data that qualifies as sensitive; it does not prevent the reconnaissance search itself when the data is legitimately accessible to authorized subscribers.
- T1599detects — A.8.3 explicitly requires monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts; this surfaces anomalous boundary-device activity or unauthorized reconfiguration when it involves sensitive information flows, but only for the subset of T1599 activity that touches monitored high-value data rather than all network-boundary compromises.
- T1599.001detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface anomalous NAT modifications on boundary devices when they affect protected information flows; this is a genuine but minority slice of the technique (most NAT traversal is about routing bypass or obfuscation rather than information misuse).
- T1601detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces live in-memory or storage modifications to the monolithic OS image on monitored network devices; partial because the clause's scope is set by topic-specific policies and only covers what the organization classifies/monitors as sensitive information or assets, leaving unmonitored devices or non-sensitive changes as a slice.
- T1601.001prevents — A.8.3's access restriction rules (authentication, credentialed access, time-bound restrictions, physical/logical isolation of sensitive systems, and dynamic controls on who/what/when can modify assets) stop many standard operator procedures and debug/boot-loader paths that require unauthorized or elevated access to patch the image, but leave open vectors such as already-compromised administrative sessions, boot-loader implants (ROMMONkit), and insider-authorized changes that the control does not itself block.
- T1602detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces adversary collection from a configuration repository when it involves monitored sensitive data or triggers alerts, but this depends on the repository data being classified as sensitive and covered by the dynamic access management scope rather than applying universally to all config repositories or discovery-oriented collection.
- T1602prevents — A.8.3 directly restricts access to configuration repositories and the sensitive administration data they hold via policy-driven logical/physical controls, identity/group permissions, authentication, encryption, dynamic rules, and monitoring/alerting, stopping the adversary collection technique in most cases (network devices under management).
- T1602.001detects — A.8.3 explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces SNMP MIB queries when they target sensitive assets under dynamic access management; this is only a slice of the technique because the clause's scope is limited to high-value information under its own policies rather than all SNMP traffic or devices.
- T1602.001prevents — A.8.3 restricts access to information/assets per policies (including via auth, config mechanisms, dynamic controls, encryption, and monitoring), which can block unauthorized SNMP queries to MIB on managed devices, but leaves a large remainder for SNMP community strings, misconfigurations, or legacy devices outside the dynamic/access-control scope.
- T1602.002detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces the adversary action of querying/exporting the config via management protocols; this is only a slice because the clause's dynamic-access scope is limited to high-value/sensitive information chosen by the organization rather than all network device configs.
- T1602.002prevents — A.8.3 directly restricts access to information and assets (including via config mechanisms, identity/group controls, physical/logical isolation, authentication, time-bound restrictions, encryption, and dynamic rules based on identity/device/location), which stops adversaries from using management tools like SNMP/SMI to access or export network device configuration files.
- T1606prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, dynamic access rules (identity/device/location), authentication requirements, time-bound restrictions, and encryption — which stops many forgery paths (e.g. anonymous/unauth generation, misuse of stolen seeds, or post-forgery use) but leaves real gaps such as legitimate credential compromise, insider abuse of AssumeRole/GetFederationToken, or forging from already-authorized but misused secrets.
- T1606.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface forged-cookie access in dynamic systems; this is a genuine but minority slice of the technique (forging itself is rarely caught, and detection depends on whether the forged cookie triggers an alertable event inside the scoped monitoring).
- T1606.001prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, authentication requirements, time-bound restrictions, and dynamic management based on identity/device/location directly stop forged-cookie generation and use in many web/SaaS scenarios, but leave a bounded remainder where secret material (keys, seeds) is already compromised or where the forged cookie is presented through an unmonitored vector.
- T1606.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces forged SAML token activity when it occurs within the scoped, protected assets.
- T1606.002prevents — A.8.3's access restriction rules, dynamic techniques, authentication/credential requirements, time-bound access, encryption, monitoring, and alerts directly constrain or block many vectors for forging and using SAML tokens (e.g. via identity/device rules, lifetime limits, misuse detection), but not the core signing-certificate compromise or new federation trust creation steps that enable the forgery itself.
- T1609detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface abuse of container admin services (e.g. anomalous kubectl/docker exec or unauthorized entrypoints) when those touch monitored sensitive information or assets.
- T1609prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, identity/group controls, isolation, and dynamic techniques (including real-time auth/credential enforcement and monitoring), which can block unauthorized container admin commands on some paths but leaves gaps such as misconfigured defaults, physical access, or insufficiently scoped dynamic rules that do not cover all container orchestration entrypoints.
- T1610detects — A.8.3 requires monitoring, reporting, alerts on misuse, and recording of access/use throughout the information lifecycle, which can surface anomalous container deployments (especially those touching sensitive data or using dynamic access controls), but this is scoped only to information-centric use cases rather than general container deployment activity.
- T1610prevents — A.8.3's access restriction (including config mechanisms, identity/group controls, isolation of sensitive apps/data, and dynamic techniques like auth/encryption/time-bound access) can stop unauthorized container deployment that bypasses defenses or uses weak configs, but leaves many deployment vectors (e.g., via privileged images, malicious benign images at runtime, or API/dashboard methods under authorized identities) unaddressed.
- T1611detects — A.8.3 explicitly requires monitoring, reporting, raising alerts on misuse, and recording access/use throughout the information lifecycle, which surfaces some escape-to-host behaviors (e.g. anomalous privileged container use, bind-mount activity, or socket abuse) when they touch protected information or violate dynamic rules, but leaves the bulk of technique variants (kernel-module loads, unshare/keyctl syscalls, hypervisor exploits, or non-information-access escapes) outside its scope.
- T1611prevents — A.8.3's access restriction (esp. isolation of sensitive apps/data via physical/logical controls, config mechanisms, dynamic techniques, and credential/encryption requirements) directly counters several escape vectors that rely on overly permissive mounts, privileged containers, or uncontrolled host access, but leaves residual paths such as kernel exploits, unshare/keyctl abuse, and hypervisor vulnerabilities untouched.
- T1612detects — A.8.3 explicitly requires monitoring use of information, recording access/changes, raising alerts on misuse, and operational monitoring processes; these surface anomalous build activity involving sensitive container images or data, but the control is scoped to information assets rather than all container build API calls or non-sensitive base images.
- T1613detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which would surface anomalous container/resource discovery attempts against protected assets; this is only a slice of the technique because the control is scoped to information assets under dynamic access management rather than all container platform API, log, or dashboard queries.
- T1613prevents — A.8.3 restricts access to information and assets (including via dynamic techniques, auth, encryption, logging, and alerts), which can block unauthenticated or unauthorized queries to container APIs, dashboards, or logs that would otherwise enable T1613 discovery; this covers a genuine but minority slice of the technique (e.g. anonymous access or misconfigured exposure) while leaving many authenticated or insider discovery vectors untouched.
- T1615detects — A.8.3's dynamic access management explicitly requires monitoring use, recording access/changes, and raising alerts on misuse attempts, which can surface Group Policy discovery activity when it touches protected information or violates access rules; this is only a slice of the technique's full scope (e.g., passive reconnaissance of SYSVOL paths or non-sensitive GPO enumeration).
- T1619detects — A.8.3 explicitly requires recording access, monitoring use, raising alerts on misuse, and operational/monitoring processes for dynamic access management, which surfaces the enumeration technique when it triggers those controls on protected objects; this is only a slice because the clause is scoped to sensitive/high-value information under topic-specific policies rather than all cloud storage objects.
- T1619prevents — A.8.3 directly mandates access restriction mechanisms (including authentication, dynamic/granular controls, encryption, and isolation of sensitive storage) that stop unauthorized enumeration of cloud objects via APIs when those objects contain sensitive information, with the bounded remainder being non-sensitive/public buckets that the clause explicitly permits to be discoverable.
- T1620detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, and raising alerts on misuse attempts, which can surface reflective loading when it touches protected assets or exhibits anomalous behavior; however the control is scoped to information assets under dynamic access management rather than broadly detecting in-process memory execution across all processes.
- T1620prevents — A.8.3's access restriction, isolation of sensitive applications/data via logical controls, dynamic access management (authentication, time-bound restrictions, encryption, monitoring, alerts on misuse) and rules based on identity/device/location can block many in-memory reflective loads of malicious payloads, but leaves a genuine slice (e.g. reflective loading of benign-looking code inside already-authorized processes or interpreters) unreached.
- T1621detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface MFA request generation or fatigue patterns as anomalous behavior; partial because the clause sets scope by policy/use-case rather than mandating universal instrumentation of all MFA flows or login-bombardment vectors.
- T1621prevents — A.8.3 requires restricting access per policies including authentication/credentials, dynamic controls based on identity/device/location, time-bound access, monitoring/alerting on misuse, and protecting info throughout its lifecycle, which constrains MFA request generation and fatigue attacks in many (but not all) configurations and platforms.
- T1647prevents — A.8.3 restricts access to information/assets (including via config mechanisms, dynamic management, encryption, and monitoring) which can stop unauthorized plist modification on macOS in covered cases, but leaves many vectors (e.g. local authenticated processes, unmonitored files, or non-sensitive plists) untouched.
- T1648detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface serverless abuse (e.g. anomalous invocations or privilege escalations) when those functions fall inside the scoped monitoring; it is not required to instrument all serverless resources or event triggers, leaving a large implementation-chosen remainder.
- T1648prevents — A.8.3 restricts access to information/assets via policies, auth, dynamic controls, encryption, and monitoring, which can block unauthorized creation/invocation of serverless functions or their abuse for persistence/exfil in some cloud scenarios, but leaves many creation/privilege paths (e.g., IAM PassRole, event triggers) and non-sensitive resources unaddressed.
- T1649detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of certificates and sensitive information, which surfaces the technique when it triggers those controls, but this is scoped only to the dynamic-management slice rather than the bulk of certificate theft/forgery (e.g. direct store extraction, enrollment abuse, or root-CA golden-certificate forgery).
- T1649prevents — A.8.3's access-restriction rules, configuration mechanisms, dynamic access management, authentication requirements, time-bound restrictions, encryption, and monitoring directly stop many certificate theft vectors and limit forgery/abuse by unauthorized identities, but do not address enrollment-rights abuse, root-CA key compromise, or all misconfigurations that enable forging.
- T1651detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface abuse of cloud admin command services when it triggers those mechanisms; partial because the clause sets policy and scope rather than mandating instrumentation depth or coverage of all cloud management service abuse vectors.
- T1651prevents — A.8.3 restricts access to information/assets via policies, config mechanisms, identity/group controls, physical/logical isolation, and dynamic techniques (auth, time-bound, encryption, monitoring/alerts), which can block unauthorized admin-level abuse of cloud management services on a slice of cases (esp. non-admin entry or dynamic enforcement), but leaves the dominant admin-compromise path (and many IaaS platform defaults) unreached.
- T1654detects — A.8.3 explicitly calls for monitoring use of sensitive information, recording access/changes, raising alerts on misuse, and operational monitoring/reporting processes, which can surface log-enumeration activity when it touches protected logs or SIEMs; this is only a slice because the clause is scoped to high-value/sensitive information rather than all system/service logs on every platform.
- T1654prevents — A.8.3 restricts access to information (including logs as associated assets) via policies, auth, config mechanisms, dynamic controls, encryption and monitoring/alerting on misuse, which stops many forms of log enumeration before they can run; it is only partial because the control is scoped to sensitive information per classification and does not reach all system/service logs an adversary may target for discovery.
- T1657detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which surfaces financial-theft techniques (esp. unauthorized transfers, account compromise, or ransomware extortion) when they touch protected information; partial because the clause's scope is limited to information assets under dynamic or configured access controls rather than all monetary-theft vectors (e.g., pure social-engineering BEC or external crypto exploits).
- T1657prevents — A.8.3 restricts access to information/assets (including via dynamic techniques, encryption, auth, monitoring, and isolation of sensitive data) which directly stops many technical-theft and some social-engineering paths to monetary resources, but leaves untouched pure social-engineering deception, extortion demands after exfiltration/encryption, and non-access-based fraud vectors.
- T1659detects — A.8.3 explicitly requires monitoring use of information, recording access/changes, and raising alerts on detected misuse, which surfaces content injection attempts or anomalous traffic in the monitored channels and data flows; partial because the control's scope is set by topic-specific policies on information assets rather than mandating universal network traffic inspection for upstream ISP-level or man-on-the-side injection.
- T1666detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface hierarchy-modification attempts (e.g. CreateAccount/LeaveOrganization calls or anomalous group changes) when they involve protected information or violate dynamic rules, but this is scoped only to the information-access slice rather than the full technique of hierarchy manipulation for evasion.
- T1666prevents — A.8.3 restricts access to information/assets per policies (including dynamic techniques, auth, encryption, monitoring/alerts on misuse), which can block unauthorized hierarchy modifications in IaaS that rely on improper access/permissions, but leaves gaps for privileged insiders or misconfigurations outside its access-restriction scope.
- T1667detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record accesses/changes, and raise alerts on misuse attempts; this surfaces anomalous email volume or signup patterns when the inbox or mail system is treated as sensitive information under the control's scope, but the clause is scoped to access-restricted/sensitive assets rather than general email bombing of any inbox.
- T1669detects — A.8.3 explicitly calls for monitoring use of information, recording access, and raising alerts on misuse attempts, which surfaces unauthorized Wi-Fi connection attempts when they involve protected assets or violate dynamic access rules, but this is scoped only to the information-access slice of the technique rather than all wireless connection events.
- T1669prevents — A.8.3 restricts access to information/assets via policies, auth, encryption, dynamic controls, and physical/logical isolation of sensitive systems; this directly stops open Wi-Fi exploitation and credentialed access to secured networks (the core of T1669), but leaves physical proximity attacks, dual-homed bridging from already-compromised devices, and post-connection sniffing/MitM outside its reach.
- T1671detects — A.8.3 explicitly calls for monitoring use of information, recording access/changes, and raising alerts on misuse attempts, which surfaces malicious OAuth integrations and their exfiltration/persistence activity when they touch monitored sensitive data; this is only a slice because the control is scoped to information assets under dynamic access management rather than broadly detecting all application creation, consent grants, or service-principal abuse at the identity layer.
- T1671prevents — A.8.3's access restriction rules, configuration mechanisms, identity/group controls, dynamic access management (including authentication, time-bound restrictions, encryption, monitoring, and alerts), and isolation of sensitive apps/data directly constrain or block many of the consent-granting, token-based persistence, MFA-bypass, and exfiltration paths described in T1671, but leave open slices such as initial high-privileged consent from a compromised account, co-opting of existing legitimate integrations, and creation of service principals that still require separate upstream identity or role controls.
- T1673detects — A.8.3 requires monitoring, recording of access/use, and raising alerts on misuse attempts, which can surface VM enumeration activity when it triggers those mechanisms, but the clause's scope is limited to information assets and dynamic access controls rather than general hypervisor/VM discovery.
- T1675prevents — A.8.3 restricts access to information/assets via policies, auth, config mechanisms, dynamic controls, and isolation of sensitive systems/applications, which can block unauthorized abuse of ESXi admin services/APIs on the hypervisor or guest VMs for a slice of cases (e.g. credentialed access or sensitive data flows) but does not prevent the technique outright on ESXi platforms.
- T1677detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes for dynamic access management of sensitive information, which surfaces some poisoning attempts (e.g. anomalous PRs or credential exfil) but only for covered assets and not the bulk of CI/CD pipeline injection vectors.
- T1677prevents — A.8.3 restricts access to information/assets (including CI config files, referenced scripts, build artifacts, and credentials) via policies, auth, RBAC, isolation, and dynamic controls that can block unauthorized modification or leakage in Direct/Indirect/Public scenarios, but leaves residual paths such as trusted inputs, self-hosted runners, and misconfigured triggers that the control does not itself close.
- T1679detects — A.8.3's dynamic access management explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes that can surface selective-exclusion behavior as anomalous during ransomware execution.
- T1684.001detects — A.8.3's dynamic access management explicitly requires raising alerts on detected misuse of protected information and recording access/use throughout the lifecycle, which surfaces impersonation attempts that reach sensitive assets, but this is limited to monitored high-value data flows rather than the social-engineering vector itself.
- T1684.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and operational monitoring/reporting processes, which can surface spoofed emails that reach inboxes or trigger dynamic access violations; this is only a slice of the technique because core spoofing (header forgery before delivery, weak DMARC p=none) is not inherently surfaced by access controls.
- T1684.002prevents — A.8.3's access restriction (including authentication, credentials, dynamic controls, and policy-driven isolation of sensitive information) directly supports DMARC/SPF/DKIM enforcement that blocks spoofed headers from reaching inboxes, but leaves residual paths such as internal Direct Send, weak p=none policies, and non-email vectors unaddressed.
- T1685detects — A.8.3's dynamic access management explicitly requires authentication, monitoring of use, recording of access/changes, and raising alerts on misuse attempts, which can surface tampering with security tools or telemetry when those actions involve protected information or violate access rules; this is only a slice of the broad technique (e.g., direct process kills or non-access-related config changes remain unseen).
- T1685.001detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse attempts, and establishing monitoring/reporting processes for dynamic access management of sensitive information; this surfaces tampering with the EventLog service or audit policy when it affects protected assets, but the clause's scope is limited to information under dynamic access management rather than all Windows Event Log activity.
- T1685.002detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface the tampering actions (e.g. disabling CloudTrail or audit bypass) when they occur within the protected information's lifecycle or monitored scope.
- T1685.002prevents — A.8.3's access restriction (including dynamic techniques, auth requirements, monitoring, alerts on misuse, and controls on who/what/when can access or modify) stops an adversary from reaching the permissions needed to disable/modify logging in many cases, but leaves a remainder where sufficient privileges were already granted or obtained through other means.
- T1685.004detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes, raise alerts on misuse, and establish operational/monitoring/reporting processes, which can surface attempts to disable or modify auditd (a high-value logging asset) in real time; this is a genuine but minority slice of the technique's full surface (kernel hooks, direct config edits, service kills).
- T1685.005detects — A.8.3 explicitly requires monitoring, recording of access/use, and raising alerts on misuse attempts, which surfaces clearing of Windows Event Logs when performed against protected information assets under dynamic access management; this is only a slice of the technique (tied to monitored sensitive info rather than all event log clearing).
- T1686detects — A.8.3 explicitly calls for monitoring use of protected information, recording access/changes, and raising alerts on misuse attempts, which surfaces firewall-tampering activity when it touches monitored sensitive assets or triggers dynamic access controls, but this is scoped only to the information/assets under dynamic management rather than broadly detecting all firewall modifications across the enterprise.
- T1686.001detects — A.8.3 explicitly requires monitoring, reporting, recording of access/use, and raising alerts on misuse attempts, which surfaces adversarial firewall modifications that enable unauthorized access in cloud environments, but only for the subset of activity falling inside the organization's chosen dynamic access management scope and monitoring processes.
- T1686.001prevents — A.8.3's access restriction (including configuration mechanisms, identity/group controls, logical isolation, dynamic rules based on identity/device/location, and real-time enforcement) directly constrains the adversary permissions and rule modifications that enable T1686.001, but leaves a remainder for privileged insiders or unmonitored dynamic changes that can still bypass.
- T1686.002detects — A.8.3 explicitly requires monitoring, reporting, raising alerts on misuse, and recording access/use throughout the information lifecycle, which surfaces attempts to disable or modify network device firewall rules when those actions target protected information or violate dynamic access policies.
- T1686.002prevents — A.8.3's access restriction rules, ACL-like controls, dynamic policy enforcement, authentication requirements and encryption directly stop many forms of unauthorized firewall/ACL modification on the device or its rules, but the control is silent on the initial privileged access or exploit that lets the adversary reach the management interface, leaving a named remainder.
- T1686.003detects — A.8.3 explicitly requires recording access/use, raising alerts on misuse, and operational monitoring/reporting processes, which can surface firewall tampering as anomalous behavior or unauthorized change; this is a genuine but minority slice of the technique (only the detection surface, not the bulk of modification vectors or pre-modification activity).
- T1690detects — A.8.3 explicitly calls for dynamic access management to monitor use of sensitive information, record changes/access, and raise alerts on misuse attempts, which surfaces the technique when it touches protected assets or triggers configured alerts; this is only a slice of T1690 (e.g., not all command-history tampering involves high-value data under dynamic controls or produces detectable misuse alerts).
Prevented OWASP Web Top 10 (2025) risks (19)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01blocks — A.8.3 directly mandates access restriction mechanisms (config, identity/group controls, dynamic techniques, auth, encryption, monitoring) that squarely address the authorization-decision slice of A01 (missing checks, IDOR, improper enforcement), but leaves path traversal, CSRF, and several other listed members untouched.
- A02blocks — A.8.3 directly mandates configuration mechanisms, access controls, least-privilege rules on identities/groups/operations, isolation, and dynamic techniques that close the bulk of weak-default and incomplete-hardening misconfigurations; residual attack surface from misconfigurations outside the access-restriction slice (e.g. error handling, header settings) keeps it from full.
- A04blocks — A.8.3 explicitly lists using encryption (and dynamic access techniques that require credentials/certificates) to restrict access to sensitive information throughout its lifecycle, which directly prevents the absent/weak/misused cryptography that exposes data in the A04 class; however this is only a slice of the target (e.g. it does not address algorithm selection, key management, or non-access-control misuses).
- A05blocks — A.8.3's access restriction, configuration mechanisms, dynamic techniques, authentication, encryption and isolation directly prevent several injection shapes (XSS via output controls, SSRF via dynamic rules on location/app, command/LDAP via restricted identities and monitoring) but leave the dominant SQL-injection and many template-injection cases untouched.
- A06blocks — A.8.3 directly mandates access restriction mechanisms (configuration controls, identity/group permissions, isolation, dynamic techniques with auth/encryption/time-bound rules) that close many design-level gaps in access enforcement and data protection, but leaves untouched other insecure-design members such as flawed business logic, missing rate limiting, or unsafe workflows that do not hinge on access restriction.
- A07blocks — A.8.3 directly mandates restricting access to information via configuration, identity/group controls, authentication requirements, dynamic rules based on identity/device/location, and isolation of sensitive data — squarely addressing the dominant authentication-failure mechanisms (bypassing, brute-force, hijacking, weak reset, session mistakes) that enable unauthorized access; the bounded remainder is pure credential-stuffing against external leaked passwords, which lives one layer upstream in A.8.5 rather than here.
- A10blocks — A.8.3's access restriction (including dynamic techniques, auth requirements, encryption, and isolation) directly blocks many error-path leaks and fail-open states that expose or mishandle sensitive information, but leaves untouched the inconsistent-state and logic-flaw slices of the category.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.