Cyber Resilience

← ISO 27001 Annex A

A.8.8 Technological

Management of technical vulnerabilities

AttributesPreventive C·I·A Identify Protect Threat and vulnerability management Governance and Ecosystem Protection Defence

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (15)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CA-8←P CM-8←M →P RA-5←F →M SA-11→P SI-2←F →M SI-5←M SR-3←P →P

Why these map — AI rationale (under review)

RA-5mostlyaligns with — Both controls establish systematic processes for discovering, analyzing, and responding to technical vulnerabilities across organizational assets.
SI-2mostlyaligns with — Both controls require timely remediation of identified flaws through patching and configuration updates supported by testing and documentation.
SI-2mostlycovers — A.8.8's processes for identifying, assessing and remediating technical vulnerabilities (including timely patching) account for the bulk of SI-2's flaw-remediation requirements; residual exists around explicit pre-install testing, side-effect analysis, and mandatory integration into configuration management that sit outside A.8.8's stated scope.
CA-8partialaligns with — Both controls authorize the use of penetration testing and vulnerability assessments by competent personnel to uncover security weaknesses.
CM-8partialaligns with — Both controls rely on an accurate, up-to-date system component inventory as the foundation for effective vulnerability identification and tracking.
SA-11partialaligns with — Both controls require suppliers and developers to identify, report, and remediate vulnerabilities in delivered products and components.
SR-3partialaligns with — Both controls embed vulnerability disclosure and handling requirements into supplier relationships and contractual obligations.
CA-8covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (22)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

ID.AM-02←M DE.CM-09gov GV.SC-05gov ID.RA-01gov ID.RA-02gov ID.RA-05gov ID.RA-06gov ID.RA-08gov PR.PS-02gov

Why these map — AI rationale (under review)

ID.RA-01mostlyaligns with — The ISO control's requirement to maintain an asset inventory and use scanning plus penetration testing to discover and record vulnerabilities directly supports the CSF outcome of identifying, validating, and recording asset vulnerabilities.
ID.RA-08mostlyaligns with — Establishing a public disclosure point, vulnerability reporting procedures, and participation in threat-intelligence forums fulfills the CSF outcome of having defined processes for receiving, analyzing, and responding to vulnerability disclosures.
ID.RA-02partialaligns with — The ISO control's use of external information resources, threat intelligence, and information-sharing forums to stay aware of vulnerabilities aligns with the CSF outcome of receiving cyber threat intelligence from external sources.
ID.RA-05partialaligns with — Evaluating identified vulnerabilities to determine associated risks and required actions mirrors the CSF outcome of using threats, vulnerabilities, likelihoods, and impacts to understand inherent risk and prioritize responses.
ID.RA-06partialaligns with — The ISO control's guidance to select and implement remediation actions such as patching or other controls corresponds to the CSF outcome of choosing, prioritizing, planning, tracking, and communicating risk responses.
PR.PS-02partialaligns with — Implementing a software-update management process to install approved patches and updates aligns with the CSF outcome of maintaining, replacing, or removing software commensurate with risk.
ID.RA-01implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.RA-02implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.RA-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.RA-06implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.RA-08implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-02implements — A.8.8's operational process for identifying, assessing and remediating technical vulnerabilities (including patching and replacement) directly gives effect to the PR.PS-02 outcome of maintaining/replacing/removing software in line with risk; the link is within the shared 'vulnerability and maintenance' domain but PR.PS-02 does not name vulnerability management explicitly.

Related OWASP ASVS 5.0 requirements (10)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V15.1.1←M →P V15.1.2←M →M V15.1.4←P V15.2.1←M →P V15.2.4←P →P V15.2.5→P

Why these map — AI rationale (under review)

V15.1.2mostlyaligns with — Maintaining an accurate asset inventory that records software vendors, names, versions, and deployment state directly supports the requirement to keep an up-to-date inventory catalog of all third-party libraries and their versions.
V15.1.1partialaligns with — Defining roles, responsibilities, and procedures for vulnerability monitoring, risk assessment, and remediation establishes the risk-based remediation time frames for vulnerable third-party component versions.
V15.2.1partialaligns with — Requiring timely patching and remediation of identified vulnerabilities ensures that components do not remain in breach of the documented update and remediation time frames.
V15.2.4partialaligns with — Tracking third-party libraries and source code for vulnerabilities and verifying that components come from expected repositories aligns with the need to ensure third-party components and transitive dependencies are obtained from trusted sources.
V15.2.5partialaligns with — Using vulnerability scanning, penetration testing, and bug-bounty programs to identify and remediate issues provides additional protections around parts of the application that contain risky or vulnerable components.

Related weaknesses / CWE (16)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-1104→M CWE-1310←P CWE-1329←P →P CWE-1342←P →M CWE-1357→M CWE-284→P CWE-502→P CWE-611→M CWE-643→P CWE-652→M CWE-69←P →P

Why these map — AI rationale (under review)

CWE-1310nonedetects — Vulnerability management explicitly requires timely patching of firmware/ROM, directly addressing the inability to patch ROM code.
CWE-509nonemitigates — Vulnerability management indirectly lowers exploit paths used by replicating malware.
CWE-1104finds — A maintained asset inventory plus scheduled scanning and patching directly reduces the window during which known vulnerable third-party components remain exploitable.
CWE-1329finds — Vulnerability-management processes can detect and drive replacement of non-updateable components, but cannot retroactively make them patchable.
CWE-1342finds — Vulnerability management includes tracking and applying microcode/firmware fixes that mitigate transient-execution side-channels.
CWE-1357finds — Vulnerability management can detect issues stemming from insufficiently trusted components.
CWE-284finds — Vulnerability scans and penetration tests routinely detect missing or misconfigured access-control mechanisms, prompting timely remediation.
CWE-502finds — Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.
CWE-611finds — Vulnerability management identifies and patches XML libraries with unsafe default entity settings.
CWE-643finds — Vulnerability management processes identify and remediate XPath injection flaws discovered post-deployment.
CWE-652finds — Vulnerability management processes identify and remediate XQuery injection flaws in production.
CWE-69finds — Vulnerability-management processes can identify and patch OS or application weaknesses that permit ADS abuse, but do not directly address improper ADS handling in custom code.

Mitigated MITRE ATT&CK techniques (931)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M →P T1001.001←M T1001.002←M →P T1001.003←M →P T1003→P T1003.001→M T1003.002→M T1003.003→M T1003.004→M T1003.005→M T1003.006→P T1003.007→M T1003.008→P T1006←M →P T1007→P T1008→P T1012→P T1014←M →P T1016.001→P T1020→P T1020.001→P T1021→P T1021.001→P T1021.002→P T1021.003→P T1021.004→P T1021.005→P T1021.006→P T1021.007→P T1021.008→P T1027→M T1027.001←M →P T1027.002←M →P T1027.003→P T1027.004←P →P T1027.005←M →P T1027.006←M →P T1027.007←M →P T1027.008←M →P T1027.009←M →P T1027.010←M →P T1027.011←M →P T1027.012→P T1027.013←M →P T1027.014←M →P T1027.015→P T1027.016←M →P T1027.017←M →P T1027.018←M →P T1030←M T1036←M →P T1036.001→M T1036.002←M →P T1036.003←M →P T1036.004→P T1036.005←M →P T1036.006→P T1036.007←M T1036.008←M →P T1036.009←M →M T1036.010→P T1036.011←M →P T1036.012←M →P T1037→M T1037.001→P T1037.002→P T1037.003→P T1037.004→P T1037.005→P T1040→P T1041→P T1046→M T1047→M T1048→P T1048.001→P T1048.002→P T1048.003→P T1049→P T1053→P T1053.002→P T1053.003→P T1053.005←M →P T1053.006→P T1053.007→P T1055←M →P T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M →P T1055.005←M →M T1055.008←M →P T1055.009←M →P T1055.011←M →P T1055.012←M →P T1055.013←M →P T1055.014←M →P T1055.015←M →P T1056→P T1056.001→P T1056.002→P T1056.003→P T1056.004→M T1057→P T1059→P T1059.001→P T1059.002→P T1059.003→P T1059.004→P T1059.005→P T1059.006→P T1059.007→M T1059.008←M →P T1059.009→P T1059.010→P T1059.011→P T1059.012→P T1059.013→P T1068→M T1069→P T1069.003→P T1070←M →P T1070.003→P T1070.004→P T1070.006←M →P T1070.007→P T1070.008→P T1070.009→P T1070.010←M →P T1071←M →P T1071.001←M →P T1071.002→P T1071.003←M →P T1071.004←M →M T1071.005←M →P T1072←P →M T1074→M T1074.001→P T1074.002→P T1078←P →P T1078.001←M →P T1078.002→M T1078.003→P T1078.004←M →P T1080→P T1082→P T1087.002→P T1087.003→P T1090←M →P T1090.001←M →P T1090.002←P →P T1090.003←M →P T1090.004←M T1091→P T1095←M →P T1098→P T1098.001←M →M T1098.002→P T1098.003→P T1098.004→P T1098.005←M →M T1098.006→P T1098.007→P T1102←M →P T1102.001←M →P T1102.002←M →P T1102.003←M →P T1104←P →P T1105→P T1106→M T1110→P T1110.001→M T1110.002→M T1110.003→M T1110.004→P T1111←M →P T1112←P →P T1114.001→P T1114.002→P T1114.003→P T1119→P T1123→P T1125→P T1127←M →M T1127.001←M →M T1127.002←P →M T1127.003→P T1129→P T1132.001←P →P T1132.002←M →P T1133←M →P T1134←M →P T1134.001→P T1134.002→P T1134.003→P T1134.004←P →P T1134.005→P T1136→P T1136.001→P T1136.002→P T1136.003→P T1137→P T1137.001→P T1137.002→P T1137.003→P T1137.004→M T1137.005→P T1137.006→P T1140→P T1176←M →M T1176.001←P →M T1176.002→P T1185←M →P T1187→P T1189←P →P T1190←M →P T1195←P →P T1195.001→P T1195.002←P →P T1195.003→P T1197→P T1199←P →P T1202←M →P T1203→P T1204.001→P T1204.002→P T1204.003←P →P T1204.004←M →P T1204.005←M →P T1205←M →P T1205.001←P →P T1205.002←P →P T1207←M →P T1210→P T1211←M →P T1212←P →M T1213→P T1213.001→P T1213.002→P T1213.003→P T1213.004→P T1213.005→P T1213.006→P T1216←M →P T1216.001←M →P T1216.002←P →P T1218←M →P T1218.001←P →P T1218.002→P T1218.003←M →P T1218.004←M →P T1218.005←M →M T1218.007←M →P T1218.008←M →P T1218.009←P →P T1218.010←M →M T1218.011←P →P T1218.012←M →P T1218.013←M →M T1218.014→M T1218.015→P T1219→P T1219.001→P T1219.002→M T1219.003←M T1220←M →P T1221←M →P T1222←P →P T1222.001←P →P T1222.002←P →P T1480←P T1480.001←M T1480.002→P T1484←P →P T1484.001→P T1484.002←P →P T1485→M T1485.001→P T1486→M T1489←P →P T1490←M →M T1491→P T1491.001→P T1491.002→P T1495→P T1496→M T1496.001→P T1496.002→P T1496.003→P T1496.004→P T1497←M T1497.001←P T1497.002←M T1498→P T1498.001→P T1498.002→P T1499→P T1499.001→P T1499.002→P T1499.003→P T1499.004→P T1505→M T1505.001→M T1505.002→M T1505.003→P T1505.004→P T1505.005→P T1505.006←M →M T1518→M T1518.001→P T1518.002→P T1525←M →P T1526→P T1528→M T1530→P T1531→P T1535←M →P T1537←M →P T1538→P T1539←M →M T1542←M →P T1542.001→P T1542.002←M →P T1542.003←M →P T1542.004←M →P T1542.005→P T1543→M T1543.001→P T1543.002→M T1543.003←P →M T1543.004→P T1543.005→M T1546→P T1546.001→M T1546.002→P T1546.003→M T1546.004→M T1546.005→P T1546.006→P T1546.007→P T1546.008→P T1546.009→P T1546.010→M T1546.011←M →M T1546.012←P →M T1546.013→P T1546.014→P T1546.015→M T1546.016→P T1546.017→P T1546.018→P T1547→M T1547.001→M T1547.002→M T1547.003→M T1547.004→M T1547.005→M T1547.006→P T1547.007→P T1547.008→P T1547.009→M T1547.010→M T1547.012→M T1547.013→P T1547.014→P T1547.015→P T1548←M →P T1548.001←P →P T1548.002←P →P T1548.003←P →M T1548.004→P T1548.005→P T1548.006←M →P T1550←M →M T1550.001←F →P T1550.002←F →P T1550.003←M →P T1550.004←F →P T1552→P T1552.001→M T1552.002→P T1552.003→P T1552.004→M T1552.005←P →P T1552.006→M T1552.007→M T1552.008→M T1553←P →P T1553.001←M →P T1553.002←P →P T1553.003←M →P T1553.004←P →P T1553.005←M →P T1553.006←M →P T1554←P →P T1555→M T1555.001→P T1555.002→P T1555.003→M T1555.004→M T1555.005→P T1555.006→P T1556←P →M T1556.001←M →P T1556.002←P →P T1556.003←M →M T1556.004←M →P T1556.005←P →M T1556.006←M →M T1556.007←M →P T1556.008→M T1556.009←M →P T1557→P T1557.001→M T1557.002→P T1557.003→P T1557.004→P T1558→P T1558.001→P T1558.002→P T1558.003→M T1558.004→P T1558.005→P T1559→P T1559.001→P T1559.002→P T1559.003→P T1560.001→P T1560.002→P T1560.003→P T1561→M T1561.001→P T1561.002→P T1563→P T1563.001→P T1563.002→P T1564→P T1564.001→P T1564.002→P T1564.003→P T1564.004←P →P T1564.005→P T1564.006→P T1564.007→M T1564.008→P T1564.009→P T1564.010→P T1564.011→P T1564.012→P T1564.014→P T1565→P T1565.001→M T1565.002→P T1565.003→M T1566→P T1566.001→P T1566.002→P T1566.003→P T1566.004→P T1567→P T1567.001→P T1567.002→P T1567.003→P T1567.004→P T1568←P →P T1568.001→P T1568.002←M →P T1568.003→P T1569→M T1569.001→P T1569.002→P T1569.003→P T1571←M →P T1572←M →P T1573→P T1573.001→P T1573.002→P T1574←P →M T1574.001←M →P T1574.004←M →M T1574.005←M →P T1574.006←P →M T1574.007→P T1574.008←P →M T1574.009←P →P T1574.010←P →P T1574.011→M T1574.012←P →P T1574.013←P →P T1574.014→P T1578←M →P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005←M →P T1583.008←P T1584→P T1584.002→P T1584.003→P T1584.004→P T1584.005→P T1584.007←P →P T1584.008←M →P T1587.001←P T1588.001←P T1588.002→P T1588.003→P T1588.005←P →P T1588.006→P T1592.002→P T1595→P T1595.001→P T1595.002→P T1595.003→P T1598.003→P T1599←M →P T1599.001←P →P T1600←P →P T1600.001←P →P T1600.002←P →P T1601←M →P T1601.001←M →P T1601.002←M →P T1602→P T1602.001→M T1602.002→P T1606←M T1606.001←M →P T1606.002→P T1608.003→P T1608.004←P →P T1608.005→P T1609→P T1610←P →P T1611←P →P T1612←M →M T1613→P T1615→P T1619→P T1620←M →M T1621←P →P T1622←M T1647←P →P T1648→P T1649→P T1651→P T1653←P →P T1654→P T1657→P T1659→P T1665←M →P T1666←P →P T1667→P T1668←M T1671→P T1674→P T1675→P T1677←P →P T1678←P T1679→P T1680→P T1684.002→P T1685←M →P T1685.001←M →M T1685.002←M →P T1685.003←M →P T1685.004←M →M T1685.005←M →P T1685.006←M T1686←M →M T1686.001←M →P T1686.002←M →P T1686.003←M →M T1687←P →M T1688←M →P T1689←M →P T1690←P →P

Why these map — AI rationale (under review)

T1001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which surfaces some T1001 implementations (e.g. anomalous protocol traffic or steganography artifacts) but only as a minority slice dependent on scope and tooling, not the dominant obfuscation methods.
T1001.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface steganography-based C2 as anomalous traffic or hidden payloads in files; this is a genuine but minority slice of the technique (most stego is not vulnerability-driven and may evade unless specifically instrumented).
T1001.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and procedures to detect the existence of vulnerabilities (including in third-party components), which surfaces protocol-impersonation C2 when it leverages or exposes a known exploitable flaw in legitimate protocols/services.
T1003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, increased monitoring of vulnerable systems, and alignment with incident management to surface technical weaknesses that enable T1003 (e.g. unpatched credential-dumping vectors in OS caches/memory); this discovers the enabling conditions before or during use, with the bounded remainder being novel/undisclosed credential-dumping techniques that evade known-vuln detection.
T1003.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring to detect actual attacks, all of which surface LSASS-related credential-dumping techniques or the vulnerable configurations enabling them.
T1003.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and increased monitoring to detect actual attacks, which surfaces in-memory or registry-based SAM dumping tools and techniques post-exploitation.
T1003.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, all of which surface the presence or successful use of T1003.003 techniques (e.g. Volume Shadow Copy, ntdsutil.exe) when they expose or exploit known NTDS-related weaknesses.
T1003.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, logging of all steps, and alignment with incident management to surface technical vulnerabilities and related events, which would detect the use of tools like Mimikatz or Reg for dumping LSA secrets as a realized vulnerability exploitation on Windows assets.
T1003.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party components, and procedures to detect vulnerabilities in products/services (including external components), which surfaces the presence of weak cached-credential storage implementations or unpatched software enabling T1003.005; the remainder is that it does not detect the adversary technique in flight.
T1003.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party), and increased monitoring as a compensating control when patches are unavailable; these surface the API abuse, privilege, or unpatched replication vector enabling DCSync (a known, published technique) after it is present in the environment.
T1003.007detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for actual attacks, and procedures to detect the existence of vulnerabilities (including in products/services and external components), which surfaces credential-gathering activity from /proc as anomalous behavior or a realized vulnerability.
T1003.008detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for attacks exploiting known vulnerabilities, and increased monitoring when no patch exists; these surface the technique (or its precursor vuln) when it runs against inventoried assets, with the bounded remainder being unmonitored/unknown systems or zero-day variants outside the vulnerability-management scope.
T1006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and alignment with incident management to surface technical vulnerabilities and related activity; this can detect some T1006 usage (e.g. via anomalous volume access patterns or known vulnerable tools like NinjaCopy/vssadmin) but does not broadly instrument for the bypass technique itself.
T1007detects — A.8.8 requires monitoring for anomalous behaviour, increased monitoring to detect actual attacks exploiting known vulnerabilities, and alignment with incident management; this surfaces some post-compromise discovery activity when it matches known-vuln patterns or triggers anomaly rules, but the technique itself is not a technical vulnerability and most instances (benign-looking enumeration) fall outside the clause's scoped detection
T1008detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when mitigations are applied; these surface fallback-channel C2 when the alternate channel or its traffic pattern is already known or produces detectable anomalies, but do not guarantee detection of novel or obfuscated fallback implementations.
T1012detects — A.8.8 requires monitoring, scanning, vulnerability assessments, and increased monitoring for actual attacks once a vulnerability is known; this can surface anomalous registry-query behavior tied to known vulnerable software/configurations, but the control is scoped to technical vulnerabilities and does not broadly instrument or detect the discovery technique itself.
T1014detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and tracking third-party components, all of which can surface rootkit indicators or the vulnerabilities rootkits typically exploit; however, rootkits are designed to actively hide their presence from standard detection mechanisms, leaving a large portion of stealthy or firmware/bootkit variants outside routine vulnerability management.
T1016.001detects — A.8.8 requires monitoring, scanning, vulnerability assessments, and increased monitoring for attacks tied to known vulnerabilities; this can surface anomalous discovery activity (e.g. unexpected pings/tracert/GETs) when it matches a tracked vuln or triggers heightened monitoring, but the clause's scope is vulnerability-centric rather than general behavioral anomaly detection for this technique.
T1020detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in assets/third-party components, and increased monitoring as a compensating control, which surfaces automated exfiltration (often leveraging vulnerable unpatched software or misconfigurations) in flight or post-compromise.
T1020.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces misconfigurations or modifications enabling traffic mirroring (especially in IaaS/cloud), but only as a vulnerability rather than reliably catching the live technique in flight, leaving most in-band execution undetected.
T1021detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring when no patch exists; this can surface anomalous remote-service logons or post-exploitation activity tied to known vulnerable remote-service software, but the control's scope is vulnerability discovery rather than general detection of the T1021 technique itself, leaving most legitimate or unpatched-account-based usage unseen.
T1021.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known technical vulnerabilities; RDP usage (especially anomalous or post-compromise) can be surfaced when it triggers such detection mechanisms, but the control is scoped to technical vulnerabilities rather than all RDP logons or credential abuse.
T1021.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface anomalous SMB admin-share access (especially post-exploit or when tied to known vulnerable configs like unpatched SMBv1), but the clause's scope is vulnerability-centric rather than broadly covering all lateral-movement indicators, leaving most technique executions undetected.
T1021.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating measure, which can surface DCOM-related insecure methods or vulnerable COM objects after they exist; this is a genuine but minority slice of the technique (which is primarily an abuse of valid accounts and ACLs rather than a published vulnerability).
T1021.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and increased monitoring as compensating controls, which can surface SSH-related vulnerabilities (e.g. weak keys, unpatched servers, or anomalous SSH usage) but does not broadly detect the live T1021.004 technique itself.
T1021.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control, which surfaces VNC-specific vulnerabilities, misconfigurations, or exploitation attempts (e.g. brute-force on VNC libs) after they exist in the environment.
T1021.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; WinRM abuse via valid accounts can be surfaced as anomalous remote access or post-exploitation behavior when it triggers detectable indicators, but this is scoped only to monitored/vulnerable systems and does not broadly detect the technique itself.
T1021.007detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists, which can surface anomalous cloud logins or access as indicators of exploitation of a related vulnerability; however, the control is scoped to technical vulnerability identification and response rather than broadly mandating detection of this specific valid-account cloud service access technique.
T1021.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; T1021.008 can be surfaced post-exploitation or via anomalous cloud console access if those mechanisms cover IaaS assets, but the control is scoped to technical vulnerabilities rather than the account-abuse or living-off-the-land nature of the technique itself.
T1027detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces many obfuscation techniques that rely on known vulnerable libraries, tools, or encoded payloads once they are present on assets.
T1027.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, and monitoring for vulnerabilities (including in third-party components and libraries), which can surface the presence of padded binaries when they match known malware signatures, checksum anomalies, or oversized-file indicators in threat intel, but this is limited to post-deployment scanning of known patterns rather than reliably catching novel padding at build or runtime.
T1027.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and monitoring for vulnerabilities (including in acquired software and components), which surfaces packed malware when it is catalogued as a known-vulnerable or suspicious artifact; the named remainder is custom/unknown packing techniques that leave no detectable signature or CVE.
T1027.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; steganography (T1027.003) is detectable as anomalous hidden data or via scanning for known stego tools/libraries once they are catalogued as vulnerabilities, but this is only a slice because most stego use is not tied to a known vulnerable component and falls outside routine vuln scanning scope
T1027.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking of third-party libraries/source code, which can surface the presence of delivered uncompiled source or the post-compilation artifacts, but does not instrument or guarantee detection of the delivery or compilation step itself across all platforms and delivery vectors.
T1027.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, which surfaces the modified tool once it is recognized as a known indicator or vulnerability in the organization's asset inventory or threat intel.
T1027.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and alignment with incident detection to surface technical vulnerabilities; HTML smuggling is a delivery/obfuscation technique that can be surfaced by those activities when the resulting payload or exploit is a known vulnerability, but the control does not broadly instrument or detect the smuggling act itself across all instances.
T1027.007detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, and monitoring for vulnerabilities in products/services (including external components), which surfaces dynamic API resolution when it appears in known malware, libraries, or assessed code; mostly because it depends on the vulnerability being catalogued and within the scanned inventory/scope rather than catching every custom implementation at runtime.
T1027.008detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as compensating controls, which can surface stripped payloads when they match known vulnerable patterns, exhibit anomalous behavior, or are tied to disclosed vulnerabilities, but this is limited to post-compromise or known-signature cases and does not broadly detect the stripping technique itself across all platforms and implementations.
T1027.009detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and monitoring for vulnerabilities in products/services (including external components); these can surface embedded-payload techniques when they appear in known-vulnerable files, libraries, or binaries, but miss novel/undisclosed embedding methods that do not match published vulnerabilities.
T1027.010detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on vulnerable components; this surfaces some command-obfuscation TTPs when they target or exploit known-vulnerable software, but does not broadly instrument or detect obfuscation itself across all command execution.
T1027.011detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and evaluation of systems against known vulnerability information, which can surface fileless storage artifacts (e.g. anomalous Registry/WMI entries or shared-memory usage) when they match known malicious patterns; this is limited to a slice because the control is scoped to known technical vulnerabilities rather than arbitrary or novel fileless concealment behaviors.
T1027.012detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces LNK-based smuggling techniques when they rely on known vulnerable LNK parsers, libraries, or post-compromise execution artifacts.
T1027.013detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, and increased monitoring as a compensating control, which can surface encoded/encrypted malicious files when they match known vulnerable patterns, signatures, or IOCs; however, it is scoped only to technical vulnerabilities (not arbitrary adversary obfuscation) and many T1027.013 instances have no associated CVE or detectable vulnerability.
T1027.014detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting vulnerabilities; polymorphic code is a known technique that can be surfaced by these when the resulting artifacts or behaviors match known indicators, but the clause's scope is limited to technical vulnerabilities in assets/inventory and does not broadly instrument for in-execution mutation or all signature-evasion variants.
T1027.015detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces some post-compromise uses of compression (e.g. when the resulting artifact or behavior matches a known vulnerable component or observable), but does not address the pre-execution obfuscation technique itself or unknown variants.
T1027.016detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, and monitoring for vulnerabilities (including in third-party libraries/source code), which can surface the presence of junk-code obfuscation once it is catalogued as a known technique or appears in a known malicious sample, but does not broadly detect novel or custom junk-code insertions at scale.
T1027.017detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface SVG smuggling when it is treated as (or exposes) a detectable vulnerability or anomalous payload in scanned/analyzed files or libraries; this is a genuine but minority slice of the technique (most instances are delivery/obfuscation rather than a published vuln in a component).
T1027.018detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, and monitoring for vulnerabilities in products/services (including third-party components and libraries), which can surface the use of invisible Unicode as an obfuscation technique when it appears in known malicious samples, reports, or code; however, it does not mandate detection of the novel or custom Unicode hiding itself and stops at discovery without protective effect.
T1036detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking of third-party components/libraries, which can surface masquerading artifacts (e.g. suspicious file metadata, renamed binaries, or anomalous process names) when they match known vulnerable or suspicious patterns, but this is limited to post-deployment scanning of inventory rather than real-time detection of the technique itself across all platforms and forms.
T1036.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface T1036.001 artifacts (invalid signatures on malicious binaries or components) after they exist; the named remainder is detections that fall outside scanned inventory or unmonitored platforms.
T1036.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which can surface malicious files or registry entries abusing RTLO as a known technique when they are catalogued as vulnerabilities or found during scans/tests; this is limited to a slice because the control is scoped to technical vulnerabilities (not all adversarial naming tricks or defender-tool display issues) and does not mandate universal detection of the Unicode character itself.
T1036.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as compensating controls, which can surface renamed/masqueraded utilities when they match known-vulnerable patterns, appear in threat intel, or trigger behavioral anomalies; this is a genuine but minority slice of the technique (most renaming evades static name-based detection and is not itself a 'technical vulnerability').
T1036.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities, which would detect masquerading when the anomalous name/description is catalogued as a known or suspicious indicator in threat intel or scan results
T1036.005detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface T1036.005 artifacts (e.g. unexpected binaries in trusted paths or anomalous container resources) once present, but only as a minority slice dependent on whether the masquerading is already catalogued as a known vulnerability or produces detectable anomalies.
T1036.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, and monitoring for vulnerabilities (including in third-party components and libraries), which can surface this technique when it appears as part of a known exploitable flaw or anomalous file behavior, but does not broadly detect the technique in arbitrary unpatched or custom files.
T1036.008detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces masquerading techniques that embed or disguise malicious payloads as legitimate file types when those result in exploitable vulnerabilities.
T1036.009detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect actual attacks exploiting known vulnerabilities; T1036.009 is a post-exploitation evasion technique (PPID spoofing via fork/daemon) that is surfaced by these mechanisms once it is catalogued as a detectable indicator in endpoint or process telemetry.
T1036.010detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities, which can detect masquerading accounts created as part of exploiting a vulnerable component or misconfiguration, but this is only a slice of the technique's possible executions (e.g., purely manual account creation without a linked vuln).
T1036.011detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; while this surfaces some in-memory argument-overwrite artifacts when they match a known exploited vuln or anomalous process behavior, the technique itself is a living-off-the-land stealth method with no guaranteed vulnerability signature, leaving most instances outside the clause's scope.
T1036.012detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and increased monitoring of known vulnerabilities; this can surface anomalous browser fingerprinting/spoofing when it matches known exploit patterns or triggers anomaly detection, but the control is scoped to technical vulnerabilities rather than generic adversary TTPs and does not mandate detection of this specific evasion technique.
T1037detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, all of which surface T1037 persistence scripts (or the vulnerable misconfigurations enabling them) after they are present.
T1037.001detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and receiving reports to surface technical weaknesses; this can discover vulnerable logon-script configurations or the presence of malicious scripts after they are deployed, but does not instrument runtime execution of the persistence technique itself and leaves many deployment vectors (e.g., custom scripts without known CVEs) unseen.
T1037.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface anomalous login-hook persistence when it is treated as (or triggers) a detectable vulnerability or anomaly; this is a genuine but minority slice of the technique (most instances are not catalogued vulnerabilities and fall outside routine vuln scanning).
T1037.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control, which can surface the anomalous execution or persistence artifact of a network logon script (especially if tied to a known vulnerable component or misconfiguration), but does not mandate broad behavioral detection of the technique itself and leaves many legitimate or stealthy uses undetected.
T1037.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; RC script modification is a known persistence vector that would surface in scans or monitoring of startup files/config changes on covered assets, but only a slice (known vulns in inventoried systems) rather than the full technique surface including zero-days or unmonitored embedded/IoT platforms.
T1037.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface the anomalous presence or execution of a deprecated StartupItem as a suspicious boot-time artifact or misconfiguration.
T1040detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces the presence of sniffable cleartext traffic or vulnerable services/configurations (e.g. unencrypted protocols, promiscuous mode exposure) that enable T1040, but does not broadly detect the passive technique in flight across all platforms or traffic.
T1041detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which surfaces C2-based exfiltration when it is recognized as anomalous behavior tied to a known exploitable vulnerability or its indicators.
T1046detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface network service discovery activity (especially vulnerability/port scans) or the vulnerable services it targets.
T1047detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface abuse of WMI (a built-in Windows component often flagged via anomalous behavior, known vulnerable WMI usage patterns, or post-exploitation artifacts).
T1048detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when patches are unavailable; these surface anomalous exfiltration (including over alternate protocols) in some but not all cases, as the clause's scope is vulnerability-centric rather than exhaustive network/behavioral coverage of all TTPs.
T1048.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface the anomalous use of symmetric-encryption exfiltration (or the vulnerable components enabling it) when the activity is observable within the scoped inventory and monitoring rules, but the clause does not mandate detection of the exfiltration technique itself and leaves many implementations without relevant coverage.
T1048.002detects — A.8.8 requires monitoring for vulnerabilities, increased monitoring as a compensating control, and alignment with incident management to surface data on vulnerabilities, which can detect anomalous exfiltration over asymmetric encrypted protocols (e.g. via traffic anomalies or logs) but only as a slice — the control's core focus is vulnerability identification/evaluation/remediation in assets/components, not broad detection of this post-compromise exfiltration technique.
T1048.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating measure, which surfaces the use of unencrypted exfiltration-capable protocols or vulnerable software enabling T1048.003; mostly because it is scoped to known technical vulnerabilities rather than all possible exfiltration activity.
T1049detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface the execution of discovery commands/utilities (e.g. netstat, lsof) as anomalous behavior or indicators of compromise on monitored assets.
T1053detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface scheduled-task abuse when it introduces or exposes a known vulnerability or anomalous behavior.
T1053.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the presence or use of the at utility (a known-vulnerable or abused component) in the environment.
T1053.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface anomalous or malicious cron jobs created via known vulnerable scheduling mechanisms or unpatched cron-related flaws; this is only a slice of the technique (e.g., post-exploitation detection of suspicious entries) rather than broad detection of all cron abuse.
T1053.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface scheduled-task abuse when it introduces or exploits a known vulnerable component, scheduled-task-related CVE, or anomalous behavior tied to a tracked vulnerability; this is only a slice of the technique (most scheduled-task abuse is not vulnerability-driven)
T1053.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface systemd timer-based persistence when it introduces or exposes a known vulnerable component/service; this is a genuine but minority slice of the technique (most timer abuse uses custom benign-looking .timer/.service pairs that are not pre-known vulnerabilities).
T1053.007detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for anomalies, and procedures to detect vulnerabilities in products/services (including third-party components), which surfaces malicious container orchestration jobs or their artifacts when they introduce or exploit known vulnerabilities in the cluster.
T1055detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, increased monitoring for attacks exploiting known vulnerabilities, and alignment with incident detection, which surfaces in-flight process injection when it matches a known vulnerable component or observable pattern; this is only a slice because the clause is scoped to known technical vulnerabilities in an asset inventory rather than arbitrary or novel injection techniques.
T1055responds — A.8.8's incident-response tie-in and 'increasing monitoring'/'incident management alignment' let it contain/eradicate an in-flight injection once detected, but most of the clause is about pre- and post-event vulnerability handling rather than active response to a live T1055 event.
T1055.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface anomalous behaviors tied to DLL injection (e.g., via known vulnerable libraries or post-exploitation artifacts), but this is scoped to vulnerability-focused detection rather than reliably catching all live technique variants like reflective injection or module stomping in arbitrary processes.
T1055.001responds — A.8.8 requires aligning vulnerability management with incident response (including communicating vulnerabilities and providing technical procedures for incidents) and using incident response procedures for urgent cases, which can contain/eradicate an in-flight DLL injection once detected; this is only a slice of the technique's full scope (e.g., not all injections surface as tracked vulnerabilities, and most of the clause is about pre/post identification rather than active response).
T1055.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, increased monitoring for attacks exploiting known vulnerabilities, and alignment with incident detection, which surfaces in-process PE injection when it matches a known exploitable flaw; this is only a slice because the control is scoped to known/published technical vulnerabilities and does not broadly instrument for novel or undetected injection techniques.
T1055.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring as a compensating control, all of which surface in-process injection techniques like thread execution hijacking (a known post-exploitation method observable via anomalous thread behavior, memory changes, or process anomalies).
T1055.003responds — A.8.8 requires aligning vulnerability management with incident response (5.26), using incident procedures for urgent cases, increasing monitoring, and raising awareness once a vulnerability enabling T1055.003 is known, but does not itself contain/eradicate an in-flight hijacking event.
T1055.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and increased monitoring to detect actual attacks exploiting known vulnerabilities; this surfaces some APC-injection techniques (especially those using known vulnerable components or observable post-exploitation artifacts) but does not broadly instrument for novel or in-process APC behavior itself.
T1055.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces TLS callback injection (a known technique abusing PE/TLS structures) when it appears in scanned components, libraries, or as anomalous process behavior, with the bounded remainder being novel/undisclosed variants or injection into unmonitored processes.
T1055.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; this surfaces some ptrace-based injection attempts that match known vulnerable code patterns or anomalous debugger attachment, but does not broadly detect novel or zero-day ptrace injection techniques that evade signature-based or vulnerability-centric detection.
T1055.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces proc-memory injection once a related CVE is known and the technique is observable in monitored telemetry, but the control does not mandate host-level process-injection instrumentation and the technique can be crafted to evade detection until after the fact.
T1055.011detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, all of which can surface EWM injection as a realized technique (via anomalous behavior, known vulnerable code paths, or post-exploitation artifacts); this is a genuine but minority slice because the clause centers on known technical vulnerabilities rather than live behavioral detection of novel or in-memory injection.
T1055.011responds — A.8.8 requires incident-response alignment, increased monitoring on known vulns, and use of incident response procedures for urgent cases; this surfaces and contains EWM injection once underway as an in-process technique, but only for the subset tied to a known/patched vulnerability rather than the technique in general.
T1055.012detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; process hollowing (a post-exploitation technique using known injection APIs) can be surfaced by those mechanisms when tied to a catalogued vulnerable component or observable anomalous behavior, but the clause's scope is set by asset inventory and known vulns rather than universal coverage of in-process hollowing.
T1055.013detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; process doppelgänging is a known technique (public since 2017) that can be surfaced by competent scanning/monitoring of process/memory anomalies, but the control's scope is set by asset inventory and chosen tools, leaving many in-process or unpatched-system instances outside its guaranteed reach.
T1055.014detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; VDSO hijacking is a known technique that would surface in such scans/tests if the underlying vulnerable component/library is catalogued, but the control does not instrument runtime process injection or syscall hijacking itself and many implementations limit scope to known CVEs rather than novel or unpatched technique variants.
T1055.015detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; ListPlanting is a known process-injection technique that would surface in such scans/tests once catalogued as a CVE or in threat intel, but the clause does not mandate runtime behavioral detection of the live technique itself and many ListPlanting variants remain stealthy.
T1056detects — A.8.8 requires monitoring for vulnerabilities, vulnerability scanning, penetration testing, increased monitoring on known-vulnerable systems, and alignment with incident response to surface technical vulnerabilities and related events; this can detect some post-compromise input-capture artifacts (e.g. via anomalous behavior, known vulnerable hooking libraries, or scanning for indicators) but has no coverage of the technique's core stealthy mechanisms such as API hooking, keylogging, or form-grabbing on unpatched or unknown-vulnerable systems.
T1056.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for attacks exploiting known vulnerabilities, and increased monitoring when no patch exists; these surface keylogging (a known technique with published indicators) once present on monitored assets, with the bounded remainder being novel/undisclosed keyloggers or assets outside the inventory/monitoring scope.
T1056.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface GUI input capture malware or its indicators after deployment; this is limited to post-compromise discovery of the technique's artifacts rather than real-time detection of the prompt itself, and does not cover all platforms or pre-execution cases.
T1056.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on vulnerable systems; this surfaces the post-compromise web portal modification (a technical vulnerability) in many but not all cases, as the clause's scope is set by asset inventory and chosen monitoring depth rather than guaranteeing detection of every credential-capturing implant.
T1056.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for attacks, and procedures to detect vulnerabilities in products/services (including external components), which surfaces the presence of hooking mechanisms or vulnerable libraries enabling T1056.004; the bounded remainder is in-memory hooking that leaves no persistent artifact for scanning.
T1057detects — A.8.8 requires increased monitoring to detect actual attacks exploiting a known vulnerability and mandates vulnerability scanning/penetration testing plus audit logging of the process, which can surface anomalous process-discovery commands or behaviors tied to known vulnerable software; this is only a slice of T1057 because the control is scoped to known technical vulnerabilities rather than broadly detecting all process-enumeration activity.
T1059detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks on known vulnerabilities, and increased monitoring as a compensating control, which surfaces some abuse of interpreters once a related vulnerability is known; this is only a slice of the broad technique (most interpreter abuse is not vulnerability-driven and lives outside scanned inventory or known-vuln detection).
T1059.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface PowerShell-based tools or anomalous PowerShell usage tied to known vulnerable implementations, but does not broadly instrument or detect the technique's runtime abuse across all execution paths.
T1059.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface AppleScript abuse when it triggers known vulnerable macOS components, libraries, or configurations, but does not broadly instrument or detect the technique's execution behaviors themselves.
T1059.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface anomalous or malicious use of cmd.exe (including post-exploitation activity) when it is tied to a known vulnerable component or pattern, but this is scoped only to vulnerability-centric discovery rather than general behavioral detection of the technique itself.
T1059.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and increased monitoring as compensating measures, which can surface Unix shell abuse when it triggers known-vulnerable conditions or anomalous behavior, but does not mandate general behavioral detection of shell command execution itself.
T1059.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface VB-based execution techniques (especially VBA/VBScript macros and scripts) when they match known vulnerable patterns or anomalous behavior.
T1059.006detects — A.8.8 requires monitoring for vulnerabilities, vulnerability scanning, penetration testing, and increased monitoring as a compensating control, which can surface Python-based execution anomalies or known vulnerable Python libraries/components after the fact; this is a genuine but minority slice of the technique (most in-flight Python abuse leaves no pre-existing vulnerable component to scan for).
T1059.007detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces the presence of JavaScript interpreters, vulnerable JS libraries, or related misconfigurations that enable T1059.007; the remainder is in-memory or obfuscated runtime abuse without a detectable vulnerable component.
T1059.008detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and procedures to detect the existence of vulnerabilities (including in third-party components), which surfaces T1059.008 abuse of network device CLI once known vulnerable interpreters or misconfigurations are catalogued; the named remainder is zero-day or custom CLI abuse without published indicators.
T1059.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces some abuse of exposed cloud APIs (e.g. via anomalous calls or known vulnerable SDKs/components) but does not broadly detect novel or permission-based API abuse that is not tied to a catalogued technical vulnerability.
T1059.010detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, and increased monitoring as a compensating control, which can surface the presence or use of these automation tools when they are known-vulnerable, outdated, or exhibit anomalous behavior; however this is limited to post-deployment discovery of known issues rather than reliably detecting novel or custom malicious AHK/AutoIT usage in real time.
T1059.011detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and monitoring for vulnerabilities (including in products/services and external components), which surfaces the presence or use of Lua interpreters/scripts as a potential attack vector or unpatched weakness in the environment.
T1059.012detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and alignment with incident management to surface technical vulnerabilities and related anomalous activity; this can detect post-exploitation abuse of hypervisor CLIs (e.g. via anomalous commands or resulting impact) but does not broadly instrument or guarantee detection of the technique itself on ESXi platforms.
T1059.013detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces misconfigurations or vulnerable container images/tools enabling T1059.013; it does not directly detect the adversary technique in flight.
T1068detects — Systematic identification and remediation of software flaws limits the pool of unpatched vulnerabilities that can be abused to escalate privileges on a compromised host.
T1068prevents — A.8.8's core process (inventory, scanning, assessment, timely patching/remediation of known vulnerabilities, and compensating controls like virtual patching or increased monitoring) directly stops most exploitation paths for privilege-escalation vulnerabilities before the adversary can trigger them; the bounded remainder is zero-day or undisclosed vulnerabilities that cannot be prevented until disclosed and patched.
T1069detects — A.8.8 requires monitoring, scanning, vulnerability assessments, penetration tests, increased monitoring for attacks, and alignment with incident management to surface technical vulnerabilities and related anomalous activity; this can detect some instances of permission groups discovery (e.g. via scanning for misconfigurations or monitoring for reconnaissance), but only a minority slice of the broad technique across all platforms and methods, with most executions (especially non-vuln-triggering ones) outside its scope.
T1069.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect the existence of vulnerabilities (including in cloud services via agreements), which can surface anomalous permission-enumeration activity as part of broader technical vulnerability or threat monitoring; however, it is scoped to vulnerabilities rather than directly to permission-discovery techniques, leaving most of T1069.003's post-auth enumeration methods outside its primary focus.
T1070detects — A.8.8 requires monitoring for vulnerabilities, receiving reports, scanning, penetration testing, and increased monitoring as a compensating control when no patch exists; this surfaces some post-removal anomalies or indicators of the T1070 technique (especially via heightened logging or anomaly detection), but the clause's core focus is vulnerability discovery rather than artifact-removal detection and many T1070 variants (e.g. in-memory or selective log edits on unmonitored platforms) remain unseen.
T1070.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface anomalous command-history clearing as suspicious activity or a sign of compromise; this is only a slice of the technique's surface (e.g., not all platforms or stealthy deletions are guaranteed to be caught).
T1070.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface file-deletion activity performed by adversaries as part of post-intrusion cleanup.
T1070.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; timestomping (an anti-forensic technique) can be surfaced post-facto as anomalous file metadata behavior when it matches a known-vulnerable tool or component, but this is only a minority slice of the technique's realizations rather than its dominant execution paths.
T1070.007detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface post-attack artifacts like cleared logs or modified configs when they are treated as indicators of compromise or misconfigurations, but this is not its core purpose and leaves the bulk of T1070.007 execution (deletion of RDP history, firewall changes, etc.) undetected.
T1070.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces some T1070.008 instances that leave detectable mailbox/mail-log anomalies or exploit a known vulnerable mail component, but does not broadly detect the technique itself when performed without a vulnerability.
T1070.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting vulnerabilities, which surfaces some post-persistence cleanup artifacts when they leave detectable traces (e.g. via logs or scanning); this is only a slice of T1070.009's stealthy, non-vulnerability-based cleanup methods.
T1070.010detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface relocated malware artifacts or related indicators after the technique has run; this is a genuine but minority slice of the technique's evasion scope (e.g., does not broadly detect all relocation for persistence or timestamp evasion on all platforms).
T1071detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; this surfaces some T1071 usage when it triggers detectable indicators in monitored assets, but the control is scoped to technical vulnerabilities (not general anomalous C2 traffic or protocol abuse without a CVE), leaving most stealthy application-layer blending outside its view.
T1071.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known, which can surface web-protocol C2 blending in with legitimate traffic as anomalous behavior or via known vulnerable components, but this is scoped to vulnerability-focused activities rather than general detection of the technique itself.
T1071.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface anomalous use of file-transfer protocols (or the vulnerabilities that enable their abuse) when the activity produces detectable indicators, but the clause's scope is limited to technical vulnerabilities and does not mandate general detection of covert C2 blending inside common protocols.
T1071.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous use of mail protocols for C2 (especially if tied to known vulnerable mail software), but the clause's scope is limited to technical vulnerabilities in assets rather than broadly detecting protocol-abuse behaviors across all mail traffic.
T1071.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for actual attacks, and procedures to detect the existence of vulnerabilities (including in third-party components), which surfaces DNS-tunneling C2 as anomalous traffic or known vulnerable software enabling it; the remainder is pre-compromise adversary infrastructure acquisition that the clause cannot observe.
T1071.005detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; this can surface pub/sub C2 when the broker or endpoints are in scope and the traffic pattern is anomalous or tied to a known vulnerable component, but the clause is scoped to technical vulnerabilities rather than arbitrary protocol abuse and does not mandate broad behavioral detection of covert C2 channels.
T1072detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface abuse of deployment/management tools when those tools or their components carry exploitable vulnerabilities.
T1074detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these surface the preparatory staging activity (unusual file copies, new central directories, cloud instance creation for staging) in most cases once it touches monitored assets or known-vulnerable components, though pre-compromise adversary staging outside the estate or in unmonitored locations remains unseen.
T1074.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous staging activity (e.g. unusual file copies or registry writes) when it matches known vulnerable tooling or patterns, but the clause's scope is technical vulnerabilities rather than general adversary behavior so only a slice of T1074.001 realizations is covered.
T1074.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous staging activity (especially in cloud IaaS or on monitored assets) but do not guarantee detection of the technique itself, which lives outside the vulnerability-management scope.
T1078detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, increased monitoring on vulnerable systems, and alignment with incident response to surface technical vulnerabilities and related activity; this can detect some post-compromise use of valid accounts (e.g. via anomalous behavior on known-vulnerable assets or during incident handling), but the bulk of T1078 (credential abuse, inactive accounts, pivoting without malware or exploitable vulns) sits outside its technical-vulnerability focus and is unseen by its mechanisms.
T1078.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party components, and monitoring/evaluation of the vulnerability management process itself, all of which surface the presence or use of default accounts as a known technical vulnerability (especially in appliances, cloud defaults, and integrated components).
T1078.001prevents — A.8.8 requires identifying, evaluating and addressing technical vulnerabilities (including via patching, disabling, workarounds or added controls such as access restrictions), which stops many default-account abuses when they are known/published; it does not stop creation or use of unknown/default accounts during initial setup or integration, nor does it reach the full breadth of credential-abuse vectors named in the technique.
T1078.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface domain account credential abuse indicators (e.g. via known vulnerable software, unpatched credential-dumping vectors, or anomalous domain usage) after the fact.
T1078.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface local account abuse (e.g. via anomalous logons, credential dumping artifacts, or unpatched privilege-escalation vectors), but the clause's core mechanism is vulnerability identification and remediation rather than real-time detection of the technique itself, leaving most behavioral indicators of local-account abuse outside its defined scope.
T1078.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities (including in cloud-provider resources via agreements), and increased monitoring as a compensating control, which can surface misconfigurations or vulnerable cloud accounts after they exist; this is a genuine but minority slice of the broad technique (credential abuse, brute force, phishing, persistence via additional credentials, privilege escalation via roles/Managed Identities) whose dominant vectors sit outside vulnerability management.
T1080detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, and increased monitoring as a compensating control, which can surface tainted shared content that introduces known vulnerabilities or malware signatures; this is a genuine but minority slice of the broad technique (most tainting uses custom/unknown malware that evades vuln-centric detection).
T1082detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, increased monitoring on known-vulnerable systems, and alignment with incident management to surface technical vulnerabilities and related activity; this catches system-information-gathering behaviors (especially post-compromise reconnaissance on monitored assets) in most cases, with the bounded remainder being pre-compromise or stealthy discovery on unmonitored/unknown assets.
T1087.002detects — A.8.8 requires monitoring, scanning, vulnerability assessments, penetration tests, and increased monitoring for actual attacks, which can surface anomalous enumeration of domain accounts as part of vulnerability or threat detection, but this is only a slice of possible detection surfaces rather than a bounded remainder.
T1087.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when patches are unavailable; this can surface anomalous use of Get-GlobalAddressList or related reconnaissance in monitored environments, but the control's scope is limited to technical vulnerabilities rather than general account-enumeration TTPs, leaving most realizations undetected.
T1090detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which can surface proxy-based C2 as anomalous traffic or exploited vulnerable components; this is only a slice because the clause is scoped to technical vulnerabilities (not all proxy usage) and monitoring depth is set by the organization rather than mandating universal detection of the technique.
T1090.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces the presence of proxy tools or vulnerable redirectors (e.g. HTRAN) after they exist on the network, but only for those that are known-vulnerable or leave detectable artifacts, leaving many custom or non-vulnerable internal proxies undetected.
T1090.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on vulnerable systems, which surfaces external-proxy C2 techniques that rely on known vulnerable redirector tools or compromised infrastructure
T1090.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring of vulnerable systems, which can surface indicators of multi-hop proxy chains (e.g. anomalous traffic patterns, compromised routers/IoT devices used in ORB/Tor chains, or patched images), but only for those already known or within scanned scope, leaving most stealthy or novel chains undetected.
T1091detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in assets/third-party components, and increased monitoring as a compensating control, which can surface indicators of malware introduced via removable media (e.g. anomalous files or known vulnerable autorun components), but does not mandate detection of the technique itself or cover the full range of air-gapped/manual/firmware vectors in T1091.
T1095detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface non-application-layer protocol usage (e.g. via anomalous ICMP/VMCI traffic or vulnerable components enabling it) but only as a slice dependent on scope, inventory coverage, and whether the protocol misuse manifests as a known vulnerability.
T1098detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface account manipulation artifacts (e.g. anomalous credential changes or permission modifications tied to known vulnerable accounts/components) but only as a minority slice rather than the bulk of the technique.
T1098.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for vulnerabilities in products/services (including third-party components), and evaluation of reports to surface technical vulnerabilities; while T1098.001 is an adversarial technique rather than a named CWE-style weakness, the control's mechanisms would surface many of its post-exploitation artifacts (e.g. unexpected credentials, SSH keys, access keys, or anomalous service principal changes) as indicators of compromise or misconfiguration when they align with known vulnerable patterns or threat intel.
T1098.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour tied to vulnerabilities, and increased monitoring as a compensating control when patches cannot be applied; this surfaces post-compromise permission changes that are known to be associated with exploitation of email vulnerabilities or misconfigurations, but does not broadly instrument or detect the permission-granting action itself across all platforms and without a prior known-vuln association.
T1098.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports that can surface anomalous IAM/role changes as potential indicators of compromise or misconfiguration, but this is scoped to technical vulnerabilities in assets rather than directly targeting adversary role-addition TTPs, leaving most of the technique (especially external-account or post-compromise privilege tweaks) outside its view.
T1098.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for actual attacks, and receiving reports to surface technical vulnerabilities (including in third-party components and cloud assets), which can discover SSH authorized_keys modifications when they introduce exploitable weaknesses or are flagged by threat intel; however, the control is scoped to known technical vulnerabilities rather than directly detecting stealthy persistence file changes, leaving most realizations of this technique outside its primary mechanism.
T1098.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and receiving/analyzing vulnerability reports, which surfaces device registration as anomalous MFA/device-management activity when it matches known vulnerable enrollment patterns or post-compromise indicators.
T1098.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring when no patch exists; these surface anomalous permission/role changes that realize or indicate the technique in container environments (especially when tied to known vulnerable components or misconfigurations), though detection is post-compromise and does not cover every stealthy or zero-day execution path.
T1098.007detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and procedures to detect the existence of vulnerabilities (including in products/services and via reports), which surfaces the post-compromise group-addition technique when it triggers observable indicators such as anomalous account changes or known-vulnerable privilege-escalation patterns; the bounded remainder is stealthy additions that evade scanning/monitoring scope.
T1102detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface anomalous use of legitimate web services as C2 (especially when tied to known vulnerable components or unusual traffic patterns), but the clause's scope is vulnerability-centric rather than broad behavioral detection of living-off-the-land C2 techniques, leaving most stealthy uses undetected.
T1102.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities; this can detect some dead-drop resolver usage when it leaves observable indicators (e.g. anomalous outbound connections or known malicious resolver domains) but does not systematically detect the technique itself, especially when obfuscated and using common legitimate services.
T1102.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface anomalous use of legitimate web services for C2 (especially via threat intel feeds or behavioral indicators), but the clause's scope is technical vulnerabilities in assets rather than post-exploitation C2 techniques, leaving most realizations undetected.
T1102.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous use of legitimate web services for one-way C2 (especially via threat intel feeds or behavioral anomalies), but the clause's scope is technical vulnerabilities in assets rather than adversary TTPs, leaving most stealthy implementations undetected.
T1104detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect the existence of vulnerabilities (including in third-party components and products), which surfaces multi-stage C2 infrastructure, loaders, and fallback channels once they are present on the estate or trigger observable behavior.
T1105detects — A.8.8 requires monitoring for vulnerabilities, vulnerability scanning, penetration testing, and increased monitoring as a compensating control, which can surface anomalous ingress tool-transfer activity (especially when tied to known vulnerable software or post-exploitation), but this is only a slice of the technique's many native utilities, protocols, and file-sync vectors that fall outside vulnerability-focused detection
T1106detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for actual attacks, and alignment with incident management to surface technical vulnerabilities and related behaviors, which would discover most native API abuse (especially in-process or library-based execution) once it is present or leaves detectable artifacts.
T1110detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring when no patch exists; these surface brute-force attempts that leverage or expose credential weaknesses (especially offline or against known-vulnerable auth), but do not broadly instrument login failures, rate limiting, or the technique's core guessing behavior itself.
T1110.001detects — A.8.8 requires monitoring for vulnerabilities, receiving reports, scanning, penetration testing, and increased monitoring as a compensating control when no patch exists; this surfaces password-guessing attempts on monitored services or via anomaly detection, but the clause's scope is technical-vulnerability identification rather than exhaustive real-time detection of all guessing across every listed protocol or platform, leaving a genuine slice uncovered.
T1110.001prevents — A.8.8 requires timely identification, evaluation, patching and compensating controls (account lockouts, MFA-capable auth, increased monitoring, virtual patching, disabling services) that stop password guessing from succeeding; the named remainder is legacy/service accounts or exempted identities where the clause's own guidance permits non-removal.
T1110.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces password-cracking-relevant credential or hashing weaknesses (e.g. weak storage, exposed hashes) in scope but does not broadly instrument cracking attempts themselves.
T1110.002prevents — A.8.8's procedures for vulnerability identification, evaluation, timely patching, workarounds, virtual patching, increased monitoring, and compensating controls (e.g. stronger auth requirements or disabling weak mechanisms) directly stop most instances of password cracking by removing or hardening the weak hashes/credentials before the adversary can exploit them off-network.
T1110.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring when no patch exists; these surface password-spraying attempts that leverage known weak/default credentials or unpatched authentication services, but the clause's scope is limited to technical vulnerabilities in assets and does not broadly instrument authentication logs, failed-login patterns, or throttling across all listed services and protocols.
T1110.003prevents — A.8.8 requires timely identification, evaluation, patching and compensating controls (including MFA-capable auth updates, account lockout tuning via workarounds, increased monitoring, virtual patching, and awareness) that stop the sprayed password from successfully authenticating in the bulk of covered cases; the named remainder is legacy protocols, exempted accounts, and unpatched cloud/SSO services where the clause's own guidance allows exceptions or compensating measures rather than universal prevention.
T1110.004detects — A.8.8 requires monitoring for anomalous behaviour, vulnerability scanning, penetration testing, increased monitoring of vulnerable systems, and use of threat intelligence to surface vulnerabilities and attacks; this can detect credential stuffing in flight on managed assets or via known vulnerable services, but the control's scope is vulnerability-centric rather than exhaustive authentication monitoring and does not reach adversary acquisition of dumps or all external SSO/cloud targets.
T1110.004prevents — A.8.8's vulnerability identification, supplier requirements, scanning, patching, and compensating controls (e.g. increased monitoring, access control changes, virtual patching) can block many credential-stuffing vectors that rely on known-vulnerable authentication services or unpatched components, but the technique's core (re-use of breached credentials from unrelated sites) is not a technical vulnerability in the target's own assets and is only partially reached by the clause's mechanisms.
T1111detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface MFA-interception weaknesses (e.g. in token generators, SMS services, or libraries) after they exist; this is a genuine but minority slice of the technique's full surface (keyloggers, device compromise, service provider attacks).
T1112detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface anomalous or malicious Registry modifications that expose or exploit known vulnerabilities (e.g., via CVE-tagged tools or configs), but this is limited to vulnerability-centric detection rather than general behavioral detection of the technique itself.
T1114.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous access or collection of .ost/.pst files if the activity is treated as suspicious, but the clause is scoped to technical vulnerabilities rather than generic adversary collection techniques and does not mandate detection of local email file access.
T1114.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when patches are unavailable; this can surface post-exploitation anomalous Exchange/Office 365 access or tool usage (e.g. MailSniper), but the clause's scope is set by asset inventory and vulnerability focus rather than mandating broad behavioral detection of credentialed email collection.
T1114.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control when no patch exists; this surfaces anomalous forwarding rules when they are treated as a misconfiguration or exploited vulnerability, but the clause is scoped to technical vulnerabilities rather than all rule-creation or persistence TTPs, leaving most adversary-created rules outside its view.
T1119detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies tied to known vulns, and increased monitoring as a compensating control, which can surface automated collection activity when it exploits or triggers a tracked vulnerability; this is only a slice of T1119 (most automated collection uses no exploitable vuln and leaves no detectable vuln signature).
T1123detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks on vulnerable systems, and increased monitoring as compensating controls, which can surface post-exploitation indicators of audio-capture malware/scripts leveraging APIs or peripherals; this is a genuine but minority slice of the technique (most realizations are not tied to a known vulnerable component).
T1125detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface malware/scripts using device APIs for video capture as a realized vulnerability or anomalous behavior; partial because this is scoped to known vulnerabilities or configured monitoring rather than reliably detecting all instances of the technique (e.g., novel/undisclosed malware).
T1127detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces the presence of vulnerable trusted developer utilities that enable T1127
T1127.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting them; these surface MSBuild abuse (a known technique often tied to vulnerable build processes or living-off-the-land binaries) in most cases, with the bounded remainder being entirely novel/undisclosed inline-task variants unseen by any scanning or monitoring.
T1127.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for actual attacks, tracking third-party libraries, receiving vulnerability reports, and keeping audit logs of the process, all of which surface the presence or use of vulnerable ClickOnce components or the technique leveraging them on Windows assets.
T1127.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and monitoring/evaluation of the process to surface technical vulnerabilities, which would discover the presence or use of JamPlus as an unapproved or vulnerable build tool enabling script proxying.
T1129detects — A.8.8 requires monitoring for vulnerabilities, vulnerability scanning, penetration testing, and increased monitoring as a compensating control, which can surface indicators of shared module loading when tied to known vulnerable libraries or anomalous module behavior, but does not broadly instrument or detect the technique itself across arbitrary paths or in-process execution.
T1132.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; standard encoding in C2 traffic can be a detectable indicator once catalogued as part of a known vulnerable implementation or TTP, but this is only a slice of the technique's realizations rather than a broad or guaranteed detection mechanism.
T1132.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface non-standard encoding in C2 traffic or related components when it appears as a detectable vulnerability or anomaly.
T1133detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which can surface T1133 when the exposed remote service (or its misconfiguration) is a known vulnerability; this is a genuine but minority slice of the technique (most T1133 use relies on valid accounts or unauthenticated exposure without a published vuln).
T1134detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; these surface anomalous token-manipulation artifacts (e.g. via known vulnerable APIs, libraries, or post-exploitation indicators) after the fact, but only for the subset tied to catalogued vulnerabilities rather than the technique in general.
T1134.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; token impersonation can be surfaced post-exploitation as anomalous behavior or via known vulnerable components/libraries, but this is scoped only to the vulnerability-management slice rather than the technique itself.
T1134.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface T1134.002 when it exploits a known vulnerable component or produces detectable anomalous behavior, but the technique itself is not a vulnerability and most executions (especially zero-day or non-vulnerable paths) remain undetected by this process.
T1134.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when a vulnerability is known; these can surface the use of token-creation APIs or anomalous logon sessions that realise T1134.003, but only after a vulnerable component is first identified and only for monitored scopes, leaving the bulk of in-process token activity undetected.
T1134.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies tied to vulnerabilities, and increased monitoring as a compensating control, which can surface PPID-spoofing artifacts when they are known, published, or trigger detectable signatures/anomalies; this is a genuine but minority slice of the technique (most instances are not tied to a scannable CVE-style technical vulnerability).
T1134.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; SID-History Injection is a post-exploitation technique leveraging a known Windows privilege-escalation vector that would surface in vuln scans, pentests or anomalous privileged token behavior, but only a minority slice of its stealthy or zero-day-like use falls inside the clause's defined detection scope.
T1136detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control, all of which surface the anomalous creation of accounts (a detectable post-exploitation artifact) when it leaves evidence in logs, asset changes, or configuration.
T1136.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect vulnerabilities (including in third-party components and acquired software), which can surface the vulnerable firewall management system or other exploitable flaws that enable the account-creation technique; this is a genuine but minority slice of the technique's surface (most local-account creation uses legitimate admin privileges with no preceding exploitable vuln).
T1136.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface post-creation indicators (e.g., anomalous account creation events or related misconfigurations) but does not target or reliably catch the account-creation technique itself.
T1136.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface the creation or anomalous use of a cloud account as a potential vulnerability or indicator after the fact; however, the control's scope is limited to technical vulnerabilities in assets/components and does not broadly instrument or detect adversary account creation behaviors across cloud platforms.
T1137detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface T1137 persistence mechanisms (e.g. malicious add-ins, templates, or Outlook rules) once present in Office components.
T1137.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces T1137.001 once the malicious Office template macro or its indicators are catalogued as a known vulnerability.
T1137.001prevents — A.8.8 requires vulnerability identification, evaluation, patching and compensating controls (including macro-aware secure coding per its own cross-ref to 8.28 and awareness-raising); this can stop many Office-template-macro persistence vectors once known, but leaves the initial insertion of a malicious macro (or registry hijack) unprevented until discovery occurs, and the clause does not mandate macro-disablement or template-integrity checks.
T1137.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities (including in third-party components and libraries), which can detect the anomalous Office Test registry key or malicious DLL as a post-exploitation indicator; however, this is scoped to known vulnerabilities and chosen monitoring coverage rather than reliably catching novel or custom persistence like T1137.002.
T1137.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface the presence of malicious Outlook forms as a technical vulnerability or anomalous persistence mechanism; however, this is scoped to known vulnerabilities in an asset inventory and does not broadly detect novel or custom form-based persistence techniques.
T1137.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface this post-compromise persistence technique when it introduces or exposes a detectable vulnerability in Outlook configuration.
T1137.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and procedures to receive vulnerability reports, which can surface the presence of malicious Outlook rules as a technical vulnerability or anomaly after they are present; this is a genuine but minority slice of the technique's full attack surface (e.g. does not guarantee detection of rule creation or email-triggered execution in all cases).
T1137.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the presence or use of malicious Office add-ins as a technical vulnerability after they are present on the system.
T1137.006prevents — A.8.8 requires identifying, evaluating and addressing technical vulnerabilities (including via patching, workarounds, disabling capabilities, virtual patching or increased monitoring), which can stop add-in-based persistence when the add-in is a known vulnerable component; this is only a slice because the technique is primarily a deliberate persistence mechanism rather than an exploitable technical vulnerability, many add-ins are first-party or custom (outside vulnerability databases), and the clause does not mandate blocking add-in loading or execution at startup.
T1140detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring of known vulnerabilities, which can surface the use of certutil, copy/type commands, or related malware utilities when they match known vulnerable patterns or generate detectable anomalies, but this is limited to post-execution discovery of known cases rather than reliably catching novel or non-vulnerable deobfuscation.
T1176detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries/source code, receiving vulnerability reports, and monitoring/evaluating the process to surface technical vulnerabilities in assets including extensions and their components; this covers the malicious or abused extensions in T1176 once present, with the bounded remainder being zero-day or fully novel extensions outside known vuln databases.
T1176.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process to surface technical vulnerabilities including those in browser extensions or related components.
T1176.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries/source code, and procedures to detect vulnerabilities in products/services (including external components), which surfaces malicious or abused IDE extensions once present in the environment or supply chain.
T1176.002prevents — A.8.8 requires vulnerability scanning, penetration testing, tracking of third-party libraries/source code, supplier requirements, and timely patching or compensating controls (workarounds, filters, increased monitoring); this can prevent many malicious IDE extensions (especially marketplace ones) from being installed or remaining exploitable, but leaves open side-loading of custom extensions, abuse of benign ones, and extensions that evade scanning or for which no timely patch exists.
T1185detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface T1185's reliance on exploitable browser vulnerabilities or injected components.
T1185prevents — A.8.8's vulnerability identification, evaluation, patching, and compensating controls (e.g. virtual patching, added access controls, increased monitoring) can stop many exploitable browser flaws that enable session hijacking, but this is only a slice: the technique also leverages inherent browser functionality, non-vulnerability injection vectors, and post-exploitation behaviors that the clause does not address.
T1187detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting the vulnerability, and alignment with incident management to surface technical vulnerabilities and related events; this catches the post-compromise use of forced authentication (e.g. via anomalous SMB/WebDAV traffic or known vulnerable components) in most cases, with the bounded remainder being pre-compromise adversary-controlled resource setup outside the organization's monitored estate.
T1189detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and receiving/sharing vulnerability reports, which can surface drive-by compromise indicators (e.g., exploited browser/plugin versions or post-exploitation artifacts) after the fact; this is a genuine but minority slice of the technique's full kill-chain surface (watering-hole delivery, initial script execution, and exploitation itself largely occur outside organizational visibility).
T1189prevents — A.8.8's vulnerability identification, scanning, patching, and compensating controls (e.g. virtual patching, disabling services, added monitoring) can stop many client-side browser/plugin vulnerabilities that T1189 relies on from being exploitable, but leaves a genuine remainder: zero-days, unpatched third-party components, user-enabled scripting/notifications, and watering-hole compromises of sites the organization does not control.
T1190detects — Regular vulnerability scanning and timely patching of public-facing systems directly reduces the number of exploitable weaknesses an attacker can leverage to gain initial access.
T1190prevents — A.8.8's core process (inventory, scanning, pentesting, timely patching, workarounds, virtual patching, and compensating controls) directly stops most T1190 exploitation paths by removing or shielding the public-facing weakness before the technique can succeed; the bounded remainder is zero-days or unpatchable legacy/edge devices where only detection or incident response applies.
T1190responds — A.8.8 requires incident-response alignment, timely action via 5.26 procedures when urgency demands, increased monitoring, and compensating controls (workarounds, virtual patching, traffic filters) once a vulnerability is known and an exploit event is underway; this bounds impact on the realized T1190 technique but does not contain/eradicate the actor or fully restore state, leaving the core response slice (and non-vulnerability-based exploits) uncovered.
T1195detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and evaluating reports to surface technical vulnerabilities, which directly detects supply-chain compromises once manifested as exploitable flaws in delivered components or updates.
T1195prevents — A.8.8 requires supplier contracts for vulnerability reporting, tracking of third-party libraries, vulnerability scanning/penetration testing of acquired components, and timely patching or compensating controls, which can stop many post-delivery exploitation paths from manipulated updates, dependencies, or images; it does not address pre-delivery manipulation of dev tools, source repos, or physical supply-chain interdiction.
T1195.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and evaluating reports to surface technical vulnerabilities in assets and components, which directly detects pre-positioned malicious dependencies and development tools (including typosquatting, abandoned packages, and compromised CI/CD actions) once they are known or observable.
T1195.001prevents — A.8.8 requires identifying, evaluating, and acting on technical vulnerabilities (including in third-party libraries, dependencies, and development tools via scanning, tracking, supplier requirements, and remediation such as updates or workarounds), which stops many supply-chain dependency compromises from reaching the consumer; it is only partial because the control assumes post-release discovery of already-manipulated components rather than stopping upstream manipulation or typosquatting before the malicious package is published and ingested.
T1195.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, tracking of third-party libraries/source code, receiving vulnerability reports, and evaluating reports to detect the existence of vulnerabilities in products/services (including external/supply-chain components), which surfaces supply-chain compromises of the kind described in T1195.002 once they become known vulnerabilities.
T1195.002prevents — A.8.8's inventory, supplier contract requirements, vulnerability disclosure programs, third-party library tracking, and remediation (including updates/patches) directly block many supply-chain manipulation vectors before the tampered software reaches the consumer; it does not cover every upstream manipulation scenario (e.g. nation-state compromise of a closed-source vendor's build pipeline before any vulnerability is known or reported).
T1195.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party components/libraries, receiving vulnerability reports, and monitoring/evaluating the process, which can surface supply-chain hardware/firmware compromises if they become known or detectable post-deployment; this is only a slice because many pre-receipt hardware backdoors (especially novel or undetected ones) leave no detectable vulnerability signature until after exploitation.
T1197detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for attacks exploiting known vulnerabilities, and alignment with incident management to surface technical vulnerabilities and associated behaviors, which would detect BITS abuse when it leverages known vulnerable components, unpatched systems, or observable anomalous transfer/job patterns; the remainder is novel/undisclosed BITS abuse without a published vulnerability.
T1199detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party components/libraries, receiving vulnerability reports, and increased monitoring as a compensating control, all of which surface T1199 exploitation of vulnerable trusted relationships or their accounts/components.
T1202detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring as a compensating control when patches are unavailable; this can surface post-exploitation artifacts of indirect command execution (e.g. anomalous process behavior or known vulnerable utilities) but does not instrument or discover the technique's stealthy pre-execution or in-flight abuse of proxy utilities.
T1203detects — Fewer unpatched client-side vulnerabilities mean attackers have reduced success when attempting to exploit user applications via malicious documents or web content.
T1203prevents — A.8.8's core process (inventory, scanning, penetration testing, timely patching/remediation of identified vulnerabilities, workarounds, virtual patching) directly stops most client-application vulnerabilities from remaining exploitable, closing the T1203 opportunity on managed assets; the bounded remainder is zero-day client exploits unknown to any monitored source at the moment of attack.
T1203responds — A.8.8's incident-response tie-in, vulnerability disclosure handling, and post-identification actions (e.g. increased monitoring, workarounds, virtual patching, or following 5.26 procedures) engage some response activities once client-application exploitation is underway, but the clause's dominant focus is pre-exploitation identification and remediation of the vulnerability itself rather than containing/eradication of an in-progress T1203 event.
T1204.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known technical vulnerabilities; this surfaces some T1204.001 instances that exploit a discovered client-side vulnerability but does not broadly detect social-engineering-driven link clicks that do not involve a technical vulnerability.
T1204.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface malicious files (or the vulnerabilities they exploit) after they are present but before or during user execution.
T1204.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface malicious/backdoored images once present in the inventory or runtime; this is genuine but only a slice (pre-deployment upload, naming tricks, and images outside scanned inventory or cloud-provider responsibility remain unseen).
T1204.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface the post-execution artifacts or anomalous commands from a successful ClickFix paste, but do not address the social-engineering delivery, the copy-paste act itself, or the pre-execution obfuscated prompt.
T1204.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, tracking of third-party libraries/source code, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface malicious libraries (whether uploaded, backdoored, or typosquatted) after they exist in the ecosystem or inventory.
T1204.005prevents — A.8.8's inventory, supplier requirements, tracking of third-party libraries, vulnerability scanning, and remediation (including patching or removal of vulnerable libraries) directly stop most malicious-library installation paths before execution; the bounded remainder is novel/zero-day libraries or typosquatting that evade known-vuln detection until after install.
T1205detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; traffic signaling (magic packets, port knocking, crafted packets) can be surfaced as anomalous traffic or a known vulnerable listening service/firewall rule, but the control does not mandate detection of the signaling technique itself when no CVE is present and many variants use already-open ports or raw sockets.
T1205.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; port knocking (a network stealth technique often tied to C2/persistence) can be surfaced as anomalous traffic or via vuln scans if the underlying open-port or firewall rule is a known vulnerable configuration, but this is only a slice of the technique's stealth methods (e.g., raw sockets, libpcap sniffing) and does not broadly detect the knocking sequence itself.
T1205.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, all of which can surface the presence or use of socket filters once they are treated as a known technical vulnerability (or trigger anomalous packet behavior); this is limited to partial because the technique is passive/low-activity until triggered, may evade standard scanning if not catalogued as a vulnerability, and the control's scope is set by the asset inventory and chosen information resources rather than mandating universal raw-socket or libpcap visibility.
T1207detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface the rogue DC registration as a suspicious AD schema change or anomalous replication behavior; however, the technique is designed to bypass logging/SIEM and operates post-compromise with admin/KRBTGT access, so detection coverage is limited to cases where those tools are in scope and tuned for it.
T1210prevents — By maintaining an asset inventory and applying patches to discovered vulnerabilities, the control shrinks the attack surface that adversaries scan for when attempting to exploit remote services for lateral movement.
T1210detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), receiving vulnerability reports, and increased monitoring to detect actual attacks exploiting them; this surfaces T1210's prerequisite discovery of vulnerable remote services and the exploitation attempt itself, with the bounded remainder being fully stealthy zero-days or attacks outside monitored/ scanned scope.
T1210responds — A.8.8's incident-response tie-in, urgency-based activation of 5.26 procedures, increased monitoring, and post-exploitation remediation (patching, virtual patching, workarounds) engage once T1210 exploitation is underway on discovered vulnerable remote services, but the bulk of the clause is pre-compromise identification/evaluation and the control does not itself contain or eradicate the actor
T1211detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and receiving/analyzing reports, which surfaces exploitable flaws (including those that could enable stealth/evasion) before or after deployment.
T1211prevents — A.8.8's core process (inventory, scanning, assessment, timely patching/remediation of technical vulnerabilities, including in cloud/third-party components) directly stops most exploitation opportunities that T1211 relies on before the adversary can leverage them for stealth.
T1211responds — A.8.8 explicitly requires acting on identified technical vulnerabilities via incident response procedures (5.26), timely remediation or compensating controls (workarounds, virtual patching, increased monitoring), and alignment with incident management to handle exploitation events once underway, which matches the `responds` verb for T1211's stealth exploitation technique.
T1212detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring to detect attacks exploiting them, which surfaces T1212 exploitation attempts or the underlying credential-related vulnerabilities before or while they occur.
T1212prevents — A.8.8's core process (inventory, scanning, vuln assessment, timely patching, workarounds, virtual patching, and supplier requirements) directly stops most exploitation of credential-related software vulnerabilities before the technique can run; the bounded remainder is zero-day or unpatchable credentialing flaws where only compensatory monitoring or incident response applies.
T1213detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface misconfigured or exposed information repositories (especially cloud-native ones) as technical vulnerabilities; this is only a slice of the technique because the control is scoped to known technical vulnerabilities rather than all repository access or data-mining behaviors.
T1213.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalous behaviour tied to vulnerabilities, and procedures to detect the existence of vulnerabilities in products/services (including third-party components), which surfaces the presence and use of an exposed Confluence repository containing sensitive data as a technical vulnerability.
T1213.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface the reconnaissance activity of mining SharePoint for network/system information as anomalous behavior or a precursor, but only where that activity is tied to a known vulnerability or falls inside the scoped monitoring — not the technique in general.
T1213.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, receiving vulnerability reports, and increased monitoring as a compensating control, all of which can surface adversary activity in code repositories (e.g. anomalous access or exposed credentials), but this is scoped only to technical vulnerabilities rather than the broader collection technique itself.
T1213.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks on vulnerable systems, and procedures to detect vulnerabilities in products/services (including third-party components like CRM SaaS), which can surface misconfigurations or unpatched flaws enabling T1213.004 but does not broadly detect the post-access data-mining technique itself.
T1213.005detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when patches are unavailable; these surface adversary use of messaging apps to exfiltrate credentials, source code, or IR discussions when those expose or exploit a technical vulnerability, but the clause does not mandate detection of the technique itself or of data mining absent a linked vulnerability.
T1213.006detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for actual attacks, and procedures to detect vulnerabilities (including in third-party/cloud components), which can surface misconfigurations or unpatched database software that enable T1213.006 but does not broadly detect the adversary technique of querying/mining data from accessible databases once credentials or access are obtained.
T1216detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/components, and increased monitoring to detect attacks exploiting them; this surfaces T1216 usage (via anomalous script proxy behavior or known vulnerable LOLBAS scripts) in most cases once known, though not all in-flight instances are guaranteed to be caught before or during execution.
T1216.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface this technique when it leverages vulnerable signed scripts or unpatched Windows components.
T1216.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, which can surface the presence or anomalous use of living-off-the-land binaries such as SyncAppvPublishingServer.vbs when tied to known vulnerable App-V components or suspicious PowerShell proxying; this is only a slice because the clause is scoped to technical vulnerabilities in an asset inventory rather than broadly detecting all abuse of signed scripts at runtime.
T1218detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring as a compensating control when patches are unavailable; this can surface anomalous use of proxy binaries (e.g. via logs or behavioral indicators) after the fact, but the clause's focus is pre-exploitation vulnerability discovery rather than runtime detection of the signed-binary proxy technique itself, leaving most execution paths outside its primary scope.
T1218.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the use of this technique (especially on unpatched Windows systems where it is a known exploitable vector).
T1218.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces this technique when it introduces or exploits a vulnerable/malicious CPL or control.exe abuse after deployment.
T1218.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; CMSTP abuse is a post-exploitation technique leveraging a signed binary, so it can be surfaced by those mechanisms when tied to known vulnerable components or anomalous behavior, but only a slice of possible executions (not all instances or novel variants).
T1218.004detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring as a compensating control, which can surface anomalous or suspicious use of InstallUtil as a living-off-the-land binary; this is a genuine but minority slice of the technique's full attack surface (e.g., does not catch every stealthy invocation or pre-execution proxying).
T1218.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface mshta.exe abuse (a known technique in public vuln databases, threat intel, and observable execution) after it is present in the environment.
T1218.007detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface anomalous or suspicious use of msiexec.exe (a signed LOLBin) when tied to known vulnerable MSI/DLL patterns or post-exploitation indicators.
T1218.008detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for actual attacks, and alignment with incident management to surface technical vulnerabilities and anomalous behavior, which would detect the use of a signed living-off-the-land binary such as odbcconf.exe when it is catalogued as vulnerable or exhibits attack-like activity.
T1218.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface anomalous or suspicious use of signed binaries like Regsvcs/Regasm when tied to known vulnerable patterns or post-exploitation behavior, but does not mandate or guarantee detection of this specific living-off-the-land technique itself.
T1218.010detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface Regsvr32 abuse (a known technique often tied to vulnerable/misused components or anomalous execution) after it occurs.
T1218.011detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for actual attacks, and alignment with incident management to surface technical vulnerabilities and related anomalous behavior; this can discover some post-exploitation artifacts or vulnerable components abused by T1218.011 (e.g. malicious DLLs or scripts), but does not broadly detect the living-off-the-land proxy execution technique itself or its obfuscations.
T1218.012detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface abuse of a signed native binary like verclsid.exe when it is catalogued as a vulnerable component or when anomalous execution is observed.
T1218.013detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting them; this surfaces mavinject.exe abuse (a known technique often tied to vulnerable signed binaries or injection flaws) in the monitored estate, with the bounded remainder being pre-compromise adversary acquisition of the binary itself.
T1218.014detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the presence or use of this signed-binary proxy technique when it leverages vulnerable MMC/.msc/CLSID components or libraries.
T1218.015detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the presence or use of vulnerable Electron components or the malicious code they enable.
T1219detects — A.8.8 requires monitoring for anomalous behaviour, vulnerability scanning, penetration testing, increased monitoring of known-vulnerable systems, and alignment with incident response to surface technical issues; this can discover post-compromise use of remote access tools (especially when tied to known-vulnerable software or anomalous sessions), but the clause's scope is vulnerability-centric rather than broad behavioral detection of legitimate RAT abuse, leaving most in-band or non-vulnerable-tool usage unseen.
T1219responds — A.8.8's incident-response tie-in and 'increasing monitoring'/'incident response procedures' options let it contain/eradicate an already-running RAT C2 session once discovered, but most of its text is about pre-discovery vulnerability handling rather than active response to the technique.
T1219.001detects — A.8.8 requires monitoring for anomalous behaviour, vulnerability scanning, penetration testing, increased monitoring of known-vulnerable systems, and alignment with incident response to surface technical vulnerabilities and related activity; this can detect IDE tunneling when it triggers observable anomalies, uses vulnerable IDE/extensions, or appears in scans/tests, but the control's scope is vulnerability-centric rather than broad behavioral detection of stealthy, legitimate-looking developer workflows, leaving a large remainder of technique executions unseen.
T1219.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and increased monitoring to detect actual attacks exploiting known vulnerabilities in third-party/remote-desktop tools once they are catalogued as vulnerable; this surfaces the technique when it uses a vulnerable implementation, with the bounded remainder being zero-day or unpatched-but-undiscovered cases.
T1220detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for attacks exploiting known vulnerabilities, and alignment with incident management to surface technical vulnerabilities and related anomalous behavior, which would detect most in-the-wild uses of this technique once a CVE or report exists for the abused components (msxml, wmic, etc.).
T1221detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, and monitoring for vulnerabilities (including in third-party components and libraries), which can surface template-injection vectors when they rely on known vulnerable document parsers, libraries, or unpatched Office/RTF components; this is a genuine but minority slice of the technique, which is primarily a runtime document abuse that does not require a pre-existing published vulnerability.
T1222detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; T1222 can be surfaced post-facto when it touches a vulnerable component whose CVE is already known and scanned, but most T1222 instances are permission changes on non-vulnerable files or as part of living-off-the-land without a pre-existing technical vulnerability, so only a minority slice is detected.
T1222.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known technical vulnerabilities; this surfaces some post-exploitation or anomalous permission-modification activity tied to exploitable vulns but does not broadly detect the technique itself when used without a vulnerability.
T1222.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface anomalous permission changes (e.g. via audit logs or behavioral indicators) after the fact, but only for monitored systems and only when the change is treated as a detectable vulnerability indicator rather than routine admin activity.
T1480.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and awareness of third-party component issues, which can surface mutex-based single-instance checks when they appear in known malware or vulnerable libraries, but this is only a slice of possible mutex usage rather than a bounded remainder.
T1484detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party), and increased monitoring as a compensating control, which can surface anomalous policy modifications that expose or exploit known misconfigurations/vulnerabilities in domain/tenant services (e.g. via GPO or trust changes), but this is limited to known-vuln detection rather than arbitrary or novel policy abuse.
T1484.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and receiving/analyzing reports to surface technical vulnerabilities (including in deployed software/configurations); this can discover post-modification indicators or misconfigurations stemming from T1484.001 but does not systematically detect the GPO modification technique itself or its AD-specific abuse patterns.
T1484.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control, which can surface misconfigurations or anomalous trust changes that expose exploitable vulnerabilities, but does not broadly instrument or detect the adversarial technique of trust manipulation itself.
T1485detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control when patches are unavailable; this surfaces the presence of the T1485-enabling weakness (unpatched software with destructive capabilities) before or during execution, though it does not directly observe the data-destruction act itself.
T1485recovers — A.8.8 explicitly requires backup/recovery mechanisms (via 5.9-5.14 inventory, update processes, and alignment with incident response) that restore data destroyed by T1485, with the named remainder being data written after the last backup or backups also destroyed by the same event.
T1485.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. cloud), receiving reports, and increased monitoring as a compensating control, all of which surface the misconfigured lifecycle policy as a technical vulnerability or anomalous change before or during exploitation on IaaS platforms.
T1486detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring to detect actual attacks, which surfaces ransomware (T1486) once the encrypting malware or its indicators are known and match the inventory
T1486recovers — A.8.8 explicitly requires backup/restore testing, alignment with incident response, and other controls (workarounds, virtual patching, increased monitoring) that enable recovery of encrypted data or services after T1486 impact, with the named remainder being data written after the last backup.
T1486responds — A.8.8 explicitly directs carrying out actions for identified vulnerabilities via incident response procedures (5.26) when urgent, aligning with containment/eradication once ransomware encryption is underway; the remainder is impact already realized (encrypted data) which is not undone by response.
T1489detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities (including in third-party components), and increased monitoring as a compensating control when patches are unavailable; this surfaces some T1489 instances that exploit known vulnerable services but does not broadly detect arbitrary or novel service-stop actions.
T1489responds — A.8.8 explicitly directs using incident response procedures (5.26) for urgent technical vulnerabilities and aligning the vulnerability management process with incident management to provide procedures once an incident occurs; this matches the technique's explicit goal of inhibiting/stopping incident response, but only covers the subset of T1489 uses that are themselves triggered by or discovered as a technical vulnerability rather than the bulk of direct adversary service-stop actions.
T1490recovers — A.8.8 explicitly requires backup/restore testing, alignment with incident management for recovery procedures, and compensating controls (workarounds, virtual patching, increased monitoring) that enable system recovery after T1490 has deleted recovery features or backups; the named remainder is that it does not itself restore already-deleted data.
T1491detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface defacement (or its prerequisites) after it occurs, but only for monitored assets and only where the defacement leaves detectable indicators rather than all instances.
T1491.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, increased monitoring on vulnerable systems, and receiving vulnerability reports, which can surface post-exploitation indicators of internal defacement (e.g. anomalous file modifications or known post-compromise TTPs) but only as a minority slice of the technique's full surface.
T1491.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which surfaces external defacement (a realized impact often stemming from an exploited vulnerability) after it occurs; partial because the clause's scope is vulnerability-centric and does not mandate broad detection of all defacement vectors or non-vuln-based cases like credentialed access.
T1495detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface indicators or post-exploitation evidence of firmware corruption (a technical vulnerability in device firmware); however, many firmware corruption techniques (especially those using physical access, custom malware, or non-public zero-days) leave no detectable pre- or mid-attack signal within the clause's defined scope.
T1496detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, increased monitoring on vulnerable systems, and tracking third-party components, all of which surface resource hijacking techniques (e.g. cryptomining, proxying, or anomalous compute/SMS usage) once present on assets.
T1496.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect vulnerabilities (including in third-party components, cloud assets, and deployed software), which surfaces compute-hijacking malware or anomalous resource consumption once present on targeted platforms.
T1496.001prevents — A.8.8's vulnerability identification, scanning, patching, and compensating controls (e.g. disabling services, traffic filters, increased monitoring) can block many common compute-hijacking vectors such as unpatched container APIs or known mining malware, but this is only a slice: the clause does not address initial access, privilege escalation, or novel/zero-day miners, and its cloud-provider carve-out leaves IaaS targets largely untouched.
T1496.001responds — A.8.8 requires acting on identified vulnerabilities via incident response procedures (5.26) when urgent, and aligns the vulnerability process with incident management to provide technical procedures for incidents; this matches the `responds` verb for containing/eradicating an in-flight compute hijacking (e.g. via increased monitoring, traffic filters, or turning off services), but only as one optional path among many non-incident measures and only after detection, leaving most of the technique's realization outside this control's direct response act.
T1496.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and increased monitoring to detect actual attacks on known vulnerabilities, which surfaces most bandwidth-hijacking malware or proxyware once a related vulnerability or anomalous network usage is present; the named remainder is zero-day or custom non-vulnerable implementations that leave no detectable signature before impact.
T1496.002responds — A.8.8 requires incident-response alignment, vulnerability-driven procedures that can invoke 5.26 incident handling once exploitation (including bandwidth-consuming botnet/proxyjacking activity) is underway, and compensatory measures such as increased monitoring or traffic filters that bound impact, but these are secondary to its core vulnerability-management focus and do not address the full technique once running.
T1496.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour, and procedures to detect vulnerabilities in products/services (including external components); this surfaces SMS-pumping abuse of messaging/OTP infrastructure as anomalous traffic or vulnerability, but only where the organisation's own assets or monitored cloud responsibilities are in scope — not the adversary's telecom-provider side or unmonitored third-party SMS services.
T1496.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports from internal/external sources (including cloud providers via agreements), which can surface hijacking indicators such as anomalous resource usage or unexpected service enablement in SaaS environments, but only as a minority slice since the control is scoped to known technical vulnerabilities rather than broad behavioral or financial-impact detection of adversary-in-the-middle abuse.
T1498detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface some network DoS-enabling conditions (e.g. unpatched bandwidth-exhaustion flaws or vulnerable third-party libs), but does not address detection of the bandwidth-exhaustion technique itself or most of the T1498 methods (spoofing, botnets, reflection).
T1498responds — A.8.8 explicitly directs routing high-urgency technical vulnerabilities into incident response procedures (5.26) and aligning the vulnerability process with incident management for technical procedures once an incident occurs, which matches the `responds` verb for an in-flight Network DoS; extent is only partial because the clause's core focus is pre-incident vulnerability identification/evaluation/remediation rather than active containment/eradication of a live attack.
T1498.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting vulnerabilities, and increased monitoring as a compensating control, which can surface some flooding attempts (especially those leveraging known-vulnerable services or components); however, the control is scoped to technical vulnerability management and does not broadly instrument or detect generic high-volume network floods independent of a discoverable vulnerability.
T1498.001responds — A.8.8's incident-response tie-in and compensatory measures (increased monitoring, traffic filters/virtual patching, turning off services, adapted access controls) let the org contain or bound an in-progress direct network flood once detected, but the clause's core focus is pre-attack vulnerability identification/patching rather than active incident containment/eradication of a flooding technique already underway.
T1498.002detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring as a compensating control when patches are unavailable; this surfaces some reflection amplifiers (e.g. vulnerable NTP/DNS/memcache instances in the organization's own inventory) but has no vantage point on external reflectors, spoofed traffic, or the attack in flight against the victim.
T1498.002responds — A.8.8 explicitly directs using incident response procedures (5.26) for urgent technical vulnerabilities and aligning the vulnerability management process with incident management to provide procedures once an incident occurs; reflection amplification is a realized network DoS incident that can be contained/eradicated via those procedures.
T1499detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting the vulnerability, and alignment with incident detection to surface technical vulnerabilities (including those enabling endpoint resource exhaustion or crashes); this discovers many but not all T1499 realizations, especially novel or non-vulnerability-based ones like pure botnet flooding without a reported flaw.
T1499prevents — A.8.8's timely patching, vulnerability scanning, remediation (including workarounds, traffic filters/virtual patching, increased monitoring, and disabling vulnerable services) can stop many exploitable endpoint DoS flaws in software/OS before adversaries can weaponize them, but leaves open-ended remainder for resource-exhaustion, botnet-driven, or non-vulnerability-based DoS that requires no exploitable bug.
T1499responds — A.8.8 explicitly routes urgent technical vulnerabilities into incident response procedures (5.26) for containment/eradication once an attack is underway, and aligns the vuln process with incident management to supply procedures for active incidents; this covers the technique only when it manifests as an exploitable vuln that has already begun, leaving the bulk of non-vuln-based resource exhaustion or botnet DDoS outside its scope.
T1499.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, which surfaces OS-level exhaustion-flood weaknesses (e.g., TCP stack limits) or related vulnerable configurations after they exist.
T1499.001responds — A.8.8 explicitly directs routing high-urgency technical vulnerabilities into incident response procedures (5.26) and aligning the vulnerability process with incident management for handling when an incident occurs; this matches the `responds` verb for an in-flight OS-exhaustion flood treated as an incident, but only a slice because the clause's dominant focus is pre-incident identification/evaluation/patching rather than active containment/eradication of the attack itself.
T1499.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which surfaces many service-exhaustion techniques once they are known and observable; it does not instrument or surface novel/zero-day floods or protocol-abuse variants before they are catalogued as vulnerabilities.
T1499.002responds — A.8.8 requires aligning vulnerability management with incident response (including using 5.26 procedures for urgent cases) and raising monitoring/awareness as compensating measures, which lets the organization respond to and contain an in-progress service exhaustion flood once detected; this is only a slice of full incident response, as the clause's primary focus is pre-attack vulnerability identification/remediation rather than active containment/eradication of a realized DoS event.
T1499.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting the vulnerability, and procedures to detect existence of vulnerabilities (including in products/services), which surfaces the resource-exhaustion condition or its indicators once present.
T1499.003responds — A.8.8's incident-response tie-in and its explicit option to route high-urgency vulnerabilities into 5.26 procedures let the control respond to an in-progress exhaustion flood once it is recognized as a realized vulnerability, but the clause is scoped to known technical vulnerabilities rather than arbitrary resource-exhaustion events, leaving most real-time containment/eradication outside its direct act.
T1499.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and alignment with incident response to surface exploitation events; this detects some in-flight or post-crash DoS from known vulnerabilities but not zero-days, unmonitored systems, or pre-execution discovery of the technique itself.
T1499.004prevents — A.8.8's core process (inventory, scanning, assessment, timely patching/remediation of known vulnerabilities, and compensating controls like virtual patching or increased monitoring) directly stops most exploitation of known vulnerabilities that would otherwise crash systems; zero-days and unpatched cases form the bounded remainder.
T1499.004responds — A.8.8 requires incident-aligned procedures, increased monitoring, and use of incident response (5.26) for urgent vulnerabilities; this surfaces and contains an in-progress exploitation (including DoS effects) on covered assets, but the clause's core is preemptive patching rather than active containment/eradication once the technique is underway, and many compensating measures (workarounds, awareness) sit outside the verb.
T1505detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface the presence of malicious/abused server software components after installation.
T1505.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface malicious or anomalous stored procedures after they are present.
T1505.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface the presence of a maliciously registered transport agent as a technical vulnerability on Exchange assets.
T1505.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities (including in web servers, third-party components, and deployed software), which would detect the presence of a web shell once introduced as a known or observable vulnerability.
T1505.003prevents — A.8.8's vulnerability identification, evaluation, timely patching, and compensating controls (virtual patching, extra monitoring, access controls, disabling services) can stop many web-shell installation vectors that rely on known exploitable flaws, but cannot prevent zero-days, custom webshells, or misconfigurations unrelated to tracked vulnerabilities.
T1505.003responds — A.8.8 explicitly directs using incident response procedures (5.26) for urgent vulnerabilities and aligning the process with incident management to provide technical procedures once an incident occurs, which matches the `responds` verb for containing/eradicating an already-underway web shell; however, the bulk of the control is on pre-incident identification/evaluation/remediation rather than active response, leaving a large slice outside this verb.
T1505.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces malicious IIS components installed as extensions/filters/modules once they are known or leave detectable artifacts.
T1505.004responds — A.8.8's incident-response tie-in and procedures for acting on detected vulnerabilities (via 5.26) let the control respond to an already-installed malicious IIS component by remediation or compensating controls, but this is only a slice of the full technique because the clause is not scoped to persistence, IIS, or runtime containment/eradication
T1505.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the modified/replaced termsrv.dll or anomalous Terminal Services behavior as a technical vulnerability or exploit indicator.
T1505.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface malicious or anomalous VIBs (as known post-exploitation indicators or vulnerable components) after they are present on ESXi hosts.
T1518detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process itself, all of which surface the presence of installed software (and versions) that contain or enable technical vulnerabilities — directly detecting the core of T1518's enumeration for vulnerable software.
T1518.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and increased monitoring as compensating measures, all of which can surface the discovery technique (or its artifacts) once it runs; this is a genuine but minority slice of the control's overall purpose and inventory-driven focus.
T1518.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface the specific discovery commands or anomalous process behavior (e.g. reg query, tasklist, or Veeam-specific enumeration) once the technique is in flight, but only for assets inside the scanned/monitored scope and only when the activity matches known vulnerability or anomaly patterns.
T1525detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking of third-party components/libraries, which can surface maliciously modified images in an inventory or registry as a known-vulnerable or anomalous artifact; this is genuine detection but only a slice, as the control's mechanisms focus on known vulnerabilities and do not reliably observe the initial implanting act itself or unknown backdoors.
T1525responds — A.8.8's incident-response tie-in and procedures for acting on detected vulnerabilities (via 5.26) let the control respond to an already-implanted image once discovered, but the clause's dominant focus is preemptive identification/patching of known vulns rather than containment/eradication of this persistence technique.
T1526detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface reconnaissance activity like cloud service enumeration when it triggers detectable signals or known-vuln patterns; this is a genuine but minority slice of the technique (most enumeration is not vulnerability-driven).
T1528detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for vulnerabilities in products/services/third-party components, and receiving vulnerability reports, which surfaces the presence of insecure token-handling code, misconfigurations, or unpatched components that enable T1528 (e.g. vulnerable OAuth flows, exposed IMDS, or weak service-account token storage).
T1530detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control; this surfaces some T1530 realizations (e.g. via anomalous access to misconfigured buckets or exploitation of a known vuln) but does not detect credential abuse, direct API access to properly-configured storage, or the initial misconfiguration itself.
T1530prevents — A.8.8's vulnerability identification, evaluation, timely patching, and compensating controls (e.g. access controls, traffic filters, increased monitoring) can prevent exploitation of misconfigurations or unpatched flaws that enable T1530, but this is only a slice: the control does not mandate or enforce correct initial IAM/ACL configurations that are the dominant root cause of open cloud storage, nor does it reach credential-leak vectors outside its technical-vulnerability scope.
T1531detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control, all of which surface T1531 (or its post-compromise indicators) when it manifests as a realized vulnerability or anomalous account change.
T1535detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of the environment (including cloud-provider responsibilities under agreements) to surface technical vulnerabilities and misconfigurations such as unused regions lacking detection coverage; this directly finds the enabling condition before or while the technique runs, with the bounded remainder being regions or accounts falling outside the defined inventory/monitoring scope.
T1537detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as compensating controls, which can surface anomalous internal cloud data transfers or backup/sync activity that blend with normal traffic, but only as a minority slice dependent on scope and configuration rather than directly targeting the T1537 technique.
T1538detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which surfaces the use of a cloud dashboard (especially one like Command Center that surfaces security findings/risks) when it reveals exploitable vulnerabilities or anomalies; this is a genuine but minority slice of the broad reconnaissance technique, not its dominant form.
T1539detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control, all of which surface the presence of exploitable cookie-stealing weaknesses (e.g. in browsers, libraries, or proxies) after they exist.
T1542detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and tracking third-party components, which can surface pre-OS boot firmware/BIOS/UEFI issues once they are known and reported; this is a genuine but minority slice of the technique (most pre-OS boot abuse is not yet a catalogued vulnerability and remains below host visibility).
T1542.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for actual attacks, and tracking third-party components (including firmware in the asset inventory), which can surface known firmware modification techniques or indicators after the fact; however, it is scoped to known/published technical vulnerabilities rather than novel or undetectable firmware rootkits, and many of its mechanisms (e.g., scanning) have limited visibility into firmware itself.
T1542.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities (including in firmware/components and third-party elements), but this only catches known/published cases or detectable anomalies and does not broadly detect novel or stealthy firmware modifications that evade integrity checks.
T1542.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and tracking third-party components to surface technical vulnerabilities (including in firmware/BIOS/UEFI layers via asset inventory and scanning tools), but bootkits are low-level persistence that often evade standard scanning and require specific suspicion or specialized detection the clause does not mandate.
T1542.003responds — A.8.8 explicitly directs using incident response procedures (5.26) for urgent vulnerabilities and aligning the process with incident management to provide technical procedures once an incident occurs; this matches the `responds` verb for a realized bootkit (already-underway persistence below the OS), but only partially because the clause is scoped to technical/software vulnerabilities in the asset inventory and the bootkit's firmware/boot-sector nature is a named remainder that falls outside routine patching/scanning.
T1542.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party components, receiving vulnerability reports, and increased monitoring to detect actual attacks, which surfaces ROMMON firmware anomalies or unauthorized updates on network devices after they occur; this is a genuine but minority slice because the control's primary focus is known CVE-style vulnerabilities in an asset inventory rather than stealthy adversary firmware replacement at boot time, and many ROMMONkit indicators (e.g., physical/local access or TFTP-based overwrite) sit outside routine scanning scope.
T1542.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; TFTP boot abuse (a network-device boot-sequence attack) is detectable by those means once a related vulnerability or anomalous netboot behavior is known, but only a slice of the technique (post-compromise or known-vuln cases) rather than the full technique in all its forms.
T1543detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface T1543 artifacts (new/modified services, daemons, agents) once present; mostly because it is scoped to known-vuln or anomalous patterns rather than all stealthy process-creation events.
T1543.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface anomalous launch-agent plist files or suspicious persistence behaviors when they match known vulnerable patterns or are flagged by threat intel; this is only a slice of the technique (post-compromise detection of known-bad agents rather than all instances).
T1543.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the presence or use of malicious systemd service files as a technical vulnerability or indicator once they exist.
T1543.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces the vulnerable drivers, signed vulnerable drivers (BYOVD), and related components used in this persistence technique.
T1543.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities (including in third-party components and system configurations), which can detect the presence of a malicious Launch Daemon once it is installed and known; this is a genuine but minority slice because the control is scoped to known/published vulnerabilities and does not broadly instrument for novel or zero-day persistence techniques.
T1543.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and procedures to detect vulnerabilities in products/services (including third-party components like container tools); this surfaces the modified container service or its vulnerable configuration post-deployment in most cases, though it does not guarantee detection of every in-memory or novel modification before impact.
T1546detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface some T1546 artifacts (e.g. anomalous triggers or known vulnerable components/libraries used in event mechanisms) but does not broadly detect the technique's execution or abuse across platforms.
T1546.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface the registry changes or anomalous file-association behavior that realize T1546.001 after they exist; the bounded remainder is pre-compromise adversary acquisition of the technique itself.
T1546.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface anomalous screensaver registry changes or malicious .scr files as potential indicators of compromise or misconfiguration, but this is limited to what falls inside the vulnerability-management scope rather than broadly detecting the persistence technique itself.
T1546.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the presence or use of this technique when it manifests as a detectable vulnerability or anomalous behavior.
T1546.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface this persistence technique when it modifies monitored shell config files or introduces detectable vulnerable/malicious code.
T1546.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface trap-based persistence when it is treated as (or exposes) a technical vulnerability; this is limited to a slice because the control is scoped to known/patchable vulnerabilities rather than arbitrary adversary persistence techniques like trap registration.
T1546.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, and monitoring for vulnerabilities (including in acquired software and cloud assets), which can surface the modified binary or tainted dylib as a known-vulnerable component after the fact; this is a genuine but minority slice of the technique's full attack surface (ad-hoc binary modification on macOS with no vendor patch or CVE).
T1546.007detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking of third-party components to surface technical vulnerabilities (including those enabling persistence like a malicious Netsh Helper DLL), but does not mandate detection of the runtime technique itself once the DLL is registered and triggered.
T1546.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for actual attacks, and receiving vulnerability reports, which can surface the modified binaries, registry changes, or anomalous accessibility-feature behavior after they exist; this is a genuine but minority slice of the technique (post-compromise detection of the artifact) rather than the dominant pre-execution or runtime behavioral detection surface.
T1546.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities (including in third-party libraries/components), and increased monitoring as a compensating control, all of which surface the presence of a malicious or vulnerable AppCert DLL in the registry or loaded processes.
T1546.010detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces the presence of malicious or vulnerable AppInit DLLs after they are introduced.
T1546.011detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting them; these surface Application Shimming (a known technique abusing installed shims or custom .sdb files) when it appears as a vulnerable configuration, anomalous shim database change, or post-exploitation artifact, with the bounded remainder being novel/undisclosed shim abuse that evades known-vulnerability detection.
T1546.012detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface IFEO-based persistence/privilege-escalation techniques when they introduce or expose a known vulnerability.
T1546.013detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface malicious or anomalous PowerShell profile content as a post-exploitation vulnerability or indicator.
T1546.014detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process itself, all of which surface the presence of an emond rule (a configuration-level vulnerability enabling persistence) after it has been written to the system.
T1546.015detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces COM hijacking that introduces or exposes a known vulnerable component or registry misconfiguration.
T1546.016detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the post-install execution or anomalous installer behavior associated with this technique on Linux/macOS/Windows platforms.
T1546.017detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; udev rule abuse is a post-exploitation persistence technique that can be surfaced by anomaly detection or vuln scanning of rule files once the technique is catalogued as a known vulnerability, but this is only a slice of the class (not all instances are known-vuln or produce detectable anomalies).
T1546.018detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking of third-party libraries/source code, which can surface Python startup-hook abuse (e.g. anomalous .pth or sitecustomize.py files) after it is present; this is genuine but only a slice, as the control's focus is known technical vulnerabilities rather than novel persistence implants and many implementations lack the specific file-integrity or Python-path monitoring needed to catch it reliably.
T1547detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface T1547 indicators (e.g. anomalous autostart entries, suspicious kernel modules, or known-vulnerable persistence mechanisms) after they are present on the estate.
T1547.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces malicious or anomalous persistence entries placed via registry run keys or startup folders when they introduce or expose a known vulnerability.
T1547.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface the presence of an authentication package DLL registered for autostart/persistence (a detectable configuration or code-level weakness once present on a Windows asset).
T1547.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface the presence of a malicious time-provider DLL registered for persistence (a detectable configuration or component vulnerability).
T1547.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface the presence of this technique (or its indicators) after it has been deployed as a persistence mechanism.
T1547.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the presence or use of a malicious SSP DLL (a known-vulnerable or anomalous component) after it has been added to the registry and before or during its execution at boot.
T1547.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries/source code for vulnerabilities, receiving vulnerability reports, and increased monitoring to detect actual attacks on known vulnerabilities; this surfaces LKM/kext-based rootkits once they are catalogued as a known technical vulnerability (as many real-world examples have been), though it does not detect novel/undiscovered ones or purely behavioral use prior to CVE assignment.
T1547.006prevents — A.8.8's vulnerability identification, scanning, patching, and compensating controls (e.g. disabling services, virtual patching, added access controls) can block many malicious LKMs/kexts once known, but does not stop novel/zero-day kernel module loading or prevent the technique class from arising in custom/unsigned code.
T1547.007detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control, which can surface anomalous plist modifications or malicious persistence entries as part of vulnerability or anomaly detection; however, this is scoped to known technical vulnerabilities rather than directly targeting the T1547.007 persistence technique itself, leaving most realizations undetected.
T1547.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/components (including third-party), tracking of third-party libraries, and increased monitoring as a compensating control, all of which surface the presence of a malicious LSASS driver as a technical vulnerability or anomalous component on Windows assets.
T1547.009detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting known vulnerabilities; these surface the presence or use of malicious shortcuts placed for persistence (a known post-exploitation technique) once the relevant vulnerability or anomalous file change is in scope.
T1547.010detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring as a compensating control, all of which surface the anomalous port monitor DLL or registry modification as a technical vulnerability or indicator after it is present.
T1547.012detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, all of which surface the presence of a malicious print processor DLL or anomalous spoolsv behavior after installation.
T1547.013detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface malicious autostart .desktop files if they are treated as a known-vulnerable configuration or anomalous persistence artifact; however, the clause is scoped to technical vulnerabilities (typically CVEs in software/components) rather than novel or custom persistence techniques, leaving most adversary-created XDG entries outside its detection mandate.
T1547.014detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces the technique when it introduces or triggers a detectable vulnerability (e.g. via anomalous registry changes or known persistence malware), but does not broadly detect the technique itself when no vulnerability is present or when masquerading hides it.
T1547.015detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and receiving vulnerability reports, which can surface the presence of malicious login items (as a post-exploitation artifact or anomalous persistence mechanism) after they are added; this is a genuine but minority slice because the clause is scoped to technical vulnerabilities (especially in software/components) rather than directly targeting behavioral persistence techniques like T1547.015.
T1548detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks on vulnerabilities, and alignment with incident management to surface technical vulnerabilities, which can detect some abuse of elevation mechanisms when they involve known exploitable flaws (e.g., in third-party components or unpatched elevation controls), but this is only a slice as the technique often relies on non-vulnerability methods like misconfigurations or legitimate API abuse that fall outside vulnerability management.
T1548.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, and increased monitoring to detect actual attacks exploiting known vulnerabilities; this surfaces setuid/setgid misconfigurations that are catalogued as known exploitable issues (e.g. via GTFOBins), but does not broadly detect novel or unlisted abuse of the technique.
T1548.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/components, and increased monitoring as a compensating control, which can surface many UAC bypass techniques that rely on known vulnerable auto-elevated binaries, COM objects, or unpatched Windows components; however, this is only a slice because novel/undisclosed bypasses, purely behavioral elevation without a CVE, or lateral-movement variants are not covered by the vulnerability-centric process.
T1548.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for actual attacks, and procedures to detect the existence of vulnerabilities (including in products/services and external components); these surface misconfigurations or weaknesses in sudo/sudoers that enable T1548.003 (e.g. NOPASSWD entries, disabled tty_tickets, or stale timestamp files) once present on the system.
T1548.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface the presence or exploitation of this deprecated-API privilege-escalation technique on macOS assets once it is known and included in vulnerability intel or scan coverage.
T1548.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, all of which surface misconfigurations that enable T1548.005 (e.g. overly permissive JIT/impersonation/PassRole settings) after they exist.
T1548.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface TCC manipulation techniques that rely on vulnerable macOS components, misconfigurations, or third-party library weaknesses.
T1550detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, all of which surface the presence of vulnerable software/configurations that enable T1550 (e.g. unpatched credential-caching or ticket-handling flaws); this is genuine detection of the enabling weakness, though it does not directly observe the technique in flight and leaves gaps for novel/undisclosed material.
T1550.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface misconfigurations or vulnerable token-handling libraries that enable T1550.001; this is a genuine but minority slice of the technique (focused on vuln discovery rather than token theft or usage itself).
T1550.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/components, and increased monitoring as a compensating control when patches are unavailable; this can surface anomalous PtH behavior tied to known credential vulnerabilities or weak hash storage, but only as a minority slice rather than the bulk of the technique.
T1550.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface PtT-enabling conditions such as unpatched credential-dumping vectors or known Kerberos weaknesses after they exist.
T1550.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party), receiving reports, and increasing monitoring to detect attacks exploiting known vulnerabilities; this surfaces T1550.004 post-exploitation or via associated vulnerable components (e.g. weak session handling) in most cases, with a bounded remainder for novel/undisclosed cookie-theft vectors outside scanned inventory.
T1552detects — A.8.8 requires monitoring for vulnerabilities, increased monitoring on vulnerable systems, vulnerability scanning/penetration testing, and receiving reports, which can surface the presence of unsecured credential artifacts (e.g. via known-vulnerable credential stores or post-exploit indicators) but does not broadly instrument for credential-search behaviors across all platforms or storage locations.
T1552.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components and configs), and increased monitoring as a compensating control, all of which surface insecure credential storage when it is catalogued as a known vulnerability or detectable misconfiguration.
T1552.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces insecure credential storage as a known vulnerability class in the Registry.
T1552.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface the presence or use of history files containing credentials as part of broader anomaly or vulnerability detection, but the clause is scoped to technical vulnerabilities rather than credential exposure in user artifacts and does not mandate detection of this specific technique.
T1552.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the presence of insecurely stored private keys as a technical vulnerability.
T1552.005detects — A.8.8 requires monitoring for vulnerabilities, increased monitoring as a compensating control, vulnerability scanning/penetration testing, and alignment with incident management to surface technical vulnerabilities; this can detect the presence of credentials or misconfigurations exposed via the Instance Metadata API (or related SSRF), but does not broadly instrument or surface the adversary technique of querying the API itself from a compromised instance.
T1552.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for actual attacks, and procedures to detect the existence of vulnerabilities (including in products/services and via reports), which surfaces the presence of GPP-stored credentials as a known, scannable vulnerability class on Windows domain assets.
T1552.007detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting the vulnerability, and procedures to detect existence of vulnerabilities (including in third-party components), which surfaces the insecure API exposure or credential-leaking logs that enable T1552.007; mostly because detection depends on the chosen scope, tools, and whether the specific container API configuration is covered by the inventory and scanning.
T1552.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party), receiving reports, and increased monitoring as a compensating control, all of which surface the presence of unsecured credentials in chat services as a technical vulnerability.
T1553detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities (including in third-party libraries/code), receiving reports, and increased monitoring as a compensating control, all of which can surface T1553 subversions that leave detectable artifacts such as unsigned or altered binaries, stolen certs, or registry/permission changes.
T1553.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components); this surfaces Gatekeeper bypasses that arise from known logic errors, unchecked file types, or vulnerable libraries, but does not broadly detect novel or logic-based bypasses that are not catalogued as vulnerabilities.
T1553.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface the presence or use of stolen/compromised code-signing materials once they are known in threat intel or reported as a vulnerability
T1553.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries/source code, receiving vulnerability reports, and increased monitoring to detect attacks exploiting known vulnerabilities; these surface T1553.003 once the hijack (a known technique with published PoCs) appears in asset inventories or is reported/scanned, though pre-compromise adversary acquisition of SIP/trust components on external infrastructure is unseen.
T1553.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control, which can surface the anomalous root-certificate installation or the atypical/pre-installed root certs when they match known-bad indicators or supply-chain reports; this is a genuine but minority slice of the technique (most instances are local admin actions with no published CVE).
T1553.005detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface MOTW-bypass artifacts (e.g. anomalous container/mount activity or known vulnerable formats) after the fact, but the control's scope is technical vulnerability management of assets/components and does not broadly instrument the specific MOTW bypass technique itself.
T1553.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks on known technical vulnerabilities; this surfaces some policy-modification vectors that rely on exploitable vulnerable signed drivers or components, but does not broadly detect the technique itself (e.g. direct bcdedit/csrutil/registry changes or kernel memory edits without an associated known vuln).
T1554detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, receiving reports, and monitoring/evaluating the process to surface technical vulnerabilities in assets including modified binaries or unpatched software that could enable T1554
T1554prevents — A.8.8's vulnerability identification, timely patching, and remediation (including for third-party components and libraries) prevents many instances of binary modification that rely on known exploitable flaws or unpatched software, but does not stop an adversary who already has code execution from directly patching or replacing arbitrary binaries, nor does it address the post-modification impair-defenses step.
T1555detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which surfaces the presence of vulnerable password stores or related credential-handling weaknesses after deployment.
T1555.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface the presence or exploitation of credential-stealing techniques like T1555.001 when they expose or exploit known Keychain-related weaknesses; however, it is scoped only to technical vulnerabilities (not all credential-dumping behaviors) and depends on what the organization includes in its monitoring scope.
T1555.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the presence of an insecure credential-caching implementation (or its unpatched exploitation path) in deployed systems.
T1555.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the presence of browser credential-storing weaknesses or the T1555.003 technique when it runs; the named remainder is memory-search variants or unmonitored/unknown browser installs outside the asset inventory.
T1555.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for actual attacks, and procedures to detect the existence of vulnerabilities (including in third-party components), which surfaces the presence of Credential Manager credential-extraction opportunities once they are known or observable.
T1555.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), tracking third-party libraries, receiving vulnerability reports, and increasing monitoring to detect attacks exploiting known vulnerabilities; this surfaces T1555.005 when it relies on exploitable flaws in password manager implementations (e.g., memory scraping via known CVEs or brute-force weaknesses), though it does not broadly detect post-exploitation credential theft from an unpatched but non-vulnerable manager.
T1555.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for actual attacks, receiving vulnerability reports, and alignment with incident management to surface technical vulnerabilities (including in cloud services via agreements), which would detect misconfigurations or privileges enabling secret retrieval from stores like AWS Secrets Manager, Azure Key Vault; mostly because detection depends on the specific inventory/monitoring scope chosen and does not guarantee coverage of all adversary access paths or post-compromise secret requests.
T1556detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, all of which surface T1556-style modifications (e.g. to PAM, LSASS, or plugins) once present as a technical vulnerability.
T1556.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, all of which surface the anomalous patch/LSASS modification or the Skeleton Key-like malware that realises T1556.001; the bounded remainder is in-memory-only patches that evade scanning until the next reboot or detection window.
T1556.001responds — A.8.8 requires incident-response alignment, increased monitoring for attacks, and use of incident response procedures when addressing urgent vulnerabilities; this surfaces and contains the Skeleton Key patch once detected but does not eradicate the in-memory patch without reboot.
T1556.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the presence or use of a malicious password filter DLL as a technical vulnerability (or its indicators) after it is present.
T1556.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface PAM modifications/backdoors as technical vulnerabilities on Linux/macOS.
T1556.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, which can surface the modified image or anomalous authentication behavior post-deployment; partial because the control is scoped to known/published technical vulnerabilities and does not broadly instrument for novel backdoor implants in network device firmware.
T1556.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the reversible-encryption configuration weakness or its exploitation artifacts on Windows/AD systems.
T1556.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, receiving reports, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces T1556.006 when it modifies MFA mechanisms that are catalogued as vulnerable (or when the modification itself is a detectable flaw), with the bounded remainder being stealthy or zero-day MFA patches outside scanned inventory.
T1556.007detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), tracking third-party libraries, receiving vulnerability reports, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces the backdoored hybrid auth processes (PTA agent DLL, AD FS config, registered rogue agent) once they are a detectable technical vulnerability or anomalous behavior, with the bounded remainder being stealth modifications that evade all listed detection methods before exploitation.
T1556.008detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface the presence of a maliciously registered Network Provider DLL as a technical vulnerability (or anomalous credential-capture behavior) on Windows assets.
T1556.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities (including in third-party components and cloud services), and evaluation of reports to surface technical weaknesses; conditional access policy misconfigurations that weaken MFA/IP/device checks are detectable as vulnerabilities in IAM configurations or via scanning for insecure policy states.
T1557detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for attacks exploiting known vulns, and receiving vulnerability reports, which can surface AiTM-enabling issues (e.g. unpatched ARP/DNS/LLMNR flaws, weak TLS configs) after they exist but does not broadly detect the live technique itself.
T1557.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for vulnerabilities in products/services (including third-party components), receiving reports, and increased monitoring as a compensating control, all of which surface name-resolution poisoning vectors or the vulnerable LLMNR/NBT-NS/mDNS services after they exist in the environment.
T1557.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating measure, which can surface ARP poisoning as anomalous network behavior or a known protocol weakness, but only where it is treated as a scannable/known technical vulnerability rather than generic MITM traffic.
T1557.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; rogue DHCP spoofing is a network-level attack that can be surfaced by those means once a related vulnerability (or anomalous DHCP traffic) is known, but the clause does not broadly instrument for the technique itself and the bulk of its focus is on software/component vulnerabilities rather than this protocol-abuse behavior.
T1557.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for actual attacks, and receiving vulnerability reports, which can surface evil-twin-style rogue access points when they are treated as a known technical vulnerability (e.g., via wireless scanning or threat intel), but this is only a slice because the control is scoped to technical vulnerabilities in assets/inventory rather than broadly detecting adversarial Wi-Fi deception in real time.
T1558detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface indicators of Kerberos ticket theft or forgery attempts (e.g. via anomalous behavior or known vulnerable software/configs), but this is scoped only to vulnerability-related discovery rather than directly or comprehensively detecting the T1558 technique itself.
T1558.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, increased monitoring on known issues, and alignment with incident management to surface technical vulnerabilities and related activity; this can detect post-exploitation indicators of a golden ticket (e.g. anomalous TGS requests or KRBTGT-related anomalies) but does not systematically detect the core technique of forging TGTs from a stolen KRBTGT hash.
T1558.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces silver-ticket-enabling conditions (e.g. unpatched Kerberos flaws, weak service-account hashes, or vulnerable third-party components) after they exist but does not cover all detection vectors for the technique itself.
T1558.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface the weak RC4-encrypted TGS tickets or vulnerable service accounts that enable Kerberoasting.
T1558.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when mitigations are applied; these can surface observable precursors or artifacts of AS-REP roasting (e.g. anomalous AS-REQ volume or LDAP enumeration) on the monitored estate, but the core technique (offline cracking of captured AS-REP data) occurs outside the organization's visibility and many steps produce no detectable event until credential use.
T1558.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), increased monitoring as a compensating control, and alignment with incident management to surface vulnerabilities that enable techniques like ccache theft; this covers the bulk of observable post-compromise artifacts on Linux/macOS with only narrow remainder for purely memory-resident ccache handling outside scanned inventory.
T1559detects — Addressing vulnerabilities in inter-process communication mechanisms reduces opportunities for attackers to abuse COM, DDE, or similar channels to execute code.
T1559.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface COM abuse when it maps to a known exploitable vulnerability or anomalous behavior.
T1559.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface DDE-based execution as anomalous or vulnerable behavior on Windows assets.
T1559.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the improper XPC input handling or client validation weaknesses (often published as CVEs) that enable this macOS-specific technique.
T1560.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control; this can surface anomalous use of archiving utilities (or their vulnerabilities) when they match known vulnerable patterns or behaviors, but does not broadly detect the T1560.001 technique itself.
T1560.002detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring as a compensating control when no patch exists; this can surface anomalous use of archival libraries (or their presence in unpatched software) after the fact, but does not instrument or detect the runtime technique of an adversary invoking a library to archive data for exfiltration.
T1560.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface custom archival (e.g. via anomalous process behavior, unusual file entropy, or custom crypto in binaries), but the clause's scope is set by asset inventory and known-vuln sources, leaving most custom-method implementations (no CVE, no library) outside its primary detection surface.
T1561detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; this surfaces some T1561 instances that leverage known exploitable vulns (e.g. in propagation or write primitives) but does not address unknown, zero-day, or non-vulnerability-based disk wipes.
T1561recovers — A.8.8 requires backup/recovery capabilities (via 5.9-5.14 inventory, update processes, and explicit compensating controls like restoring from backups when patches are unavailable), which directly recovers state after a disk-wipe event; mostly because the clause's own guidance notes that some data written since the last backup remains unrecoverable.
T1561.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces the presence of exploitable disk-wipe vectors (e.g. unpatched drivers or vulnerable libraries) before or during an attack but does not broadly detect the runtime technique itself across all platforms or propagation methods.
T1561.001recovers — A.8.8 explicitly lists increasing monitoring, workarounds, virtual patching, turning off services, and (via alignment with incident response and backups in related clauses) restoring availability after destructive wiping; this recovers from realized T1561.001 impact on a slice of cases but does not address all propagation vectors or unrecoverable overwrites.
T1561.001responds — A.8.8 explicitly directs routing high-urgency technical-vulnerability cases into incident-response procedures (5.26) and aligning the vulnerability-management process with incident handling so that discovered vulnerabilities trigger technical response steps; this matches the `responds` verb for an already-underway destructive event, but only for the subset of disk-wipe incidents that surface through vulnerability scanning or reporting rather than the full technique surface.
T1561.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces the presence of exploitable disk-wipe vectors (e.g. unpatched Shamoon-style malware or vulnerable CLI tools) before or during an attempt, but does not broadly detect the runtime wipe technique itself across all platforms or propagation methods.
T1561.002recovers — A.8.8 requires backup/restore capabilities, testing, and alignment with incident response to restore wiped systems after the technique has run, with the named remainder being data written since the last backup.
T1563detects — A.8.8 requires monitoring for vulnerabilities, vulnerability scanning, penetration testing, increased monitoring on known issues, and alignment with incident response to surface technical vulnerabilities and related events; this can detect some hijacking artifacts (e.g. anomalous sessions or exploited vulnerable remote services) but does not broadly instrument for session hijacking behaviors across RDP/SSH/telnet.
T1563.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party components/libraries, receiving vulnerability reports, and increasing monitoring to detect attacks exploiting known vulnerabilities; SSH agent hijacking (often via agent socket compromise or root-level access) is surfaced by these when the enabling flaw (e.g., weak agent perms, unpatched SSH) is known and scanned for.
T1563.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control when patches are unavailable; RDP hijacking (T1563.002) is a post-exploitation technique often enabled by or surfaced through unpatched RDP/terminal services flaws (e.g., weak session handling, known CVEs), so the control surfaces the enabling conditions or the technique in flight via those mechanisms.
T1563.002responds — A.8.8 requires aligning vulnerability management with incident response (including communicating vulnerabilities and providing technical procedures for incidents), and its incident-response tie-in plus increased-monitoring and traffic-filter workarounds can bound an active RDP hijacking once underway, but the clause's dominant focus is pre-incident vulnerability identification/patching rather than active containment/eradication of this live technique.
T1564detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which surfaces some hiding techniques (e.g. via anomalous behavior or known vuln signatures) but not the broad class of hiding artifacts in general.
T1564.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface hidden files/directories used in post-exploitation or as part of known vulnerable tooling, but this is scoped only to vulnerability-related artifacts rather than the technique in general.
T1564.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party components, and procedures to detect vulnerabilities in products/services (including external ones), which surfaces hidden-user accounts created via configuration changes when those changes introduce or expose exploitable weaknesses or are flagged by scans/assessments.
T1564.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for actual attacks, and receiving reports to surface technical vulnerabilities; while these can surface some post-exploitation artifacts or anomalous hidden-window behaviors if they trigger known vulnerable components or observable attack patterns, the core technique (registry edits, plist flags, -WindowStyle Hidden, CreateDesktop) is a living-off-the-land configuration change with no inherent vulnerability, so only a minority slice is caught.
T1564.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; NTFS attribute hiding (T1564.004) can be surfaced by such scanning or monitoring when the technique leaves detectable artifacts or is tied to a known vulnerable component, but this is only a slice since the control's scope is technical vulnerabilities rather than all stealth techniques or file-system anomalies.
T1564.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, and increased monitoring to detect actual attacks exploiting technical vulnerabilities; a hidden file system is a technical mechanism that can be surfaced by such scans/assessments when it leaves detectable artifacts or anomalous disk usage, but many stealth implementations (e.g. reserved sectors, non-standard fragmentation) fall outside routine vuln scanning scope.
T1564.006detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and increased monitoring to detect attacks, which surfaces the use of virtualization technologies (native support, dropped binaries, rogue VMs on ESXi, sandbox configs) as anomalous behavior or unpatched vulnerable components after deployment.
T1564.007detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries/source code, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface VBA stomping as a known technique in Office documents or malicious macros once it is present in the environment.
T1564.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control when patches are unavailable; this surfaces the existence of malicious email rules (a post-compromise configuration anomaly) in some but not all cases, as the control is scoped to technical vulnerabilities rather than all adversarial mailbox behaviors.
T1564.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking third-party components/libraries to surface technical vulnerabilities; resource-fork hiding is a detectable macOS-specific technique that would appear in scans or anomaly monitoring when the fork contains known-vulnerable or malicious code, but the clause's scope is set by asset inventory and chosen tools, leaving many non-vulnerable or custom forks outside its view.
T1564.010detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour tied to vulnerabilities, and increased monitoring as a compensating control, which can surface process-memory anomalies or known vulnerable techniques that rely on PEB manipulation; this is a genuine but minority slice of the technique (most instances are not tied to a known vulnerable component or CVE).
T1564.011detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks on known vulnerabilities, and increased monitoring as a compensating control, which can surface usage of nohup/-ErrorAction SilentlyContinue/etc. once catalogued as a known technique in a vuln report or threat intel feed; this is a genuine but minority slice because the clause is scoped to technical vulnerabilities (primarily in products/components) rather than runtime adversary behavior or novel evasion not tied to a CVE.
T1564.012detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists, which can surface the presence of excluded malicious files or the abuse of AV exclusions as anomalous behavior; this is only a slice because the clause is scoped to known technical vulnerabilities rather than all adversary file-hiding artifacts or runtime exclusion abuse.
T1564.014detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for actual attacks, and evaluation of reports to surface technical vulnerabilities; while this can discover xattr-based hiding if it manifests as a known exploitable flaw in scanned assets or triggers anomaly detection, the technique itself is a stealth/persistence method rather than a named technical vulnerability, so only a slice is reached.
T1565detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which can surface data manipulation when it is realized through a known technical vulnerability; this is only a slice of T1565 because the technique can be carried out without exploiting any scannable/patchable vulnerability (e.g. via legitimate access or zero-days).
T1565.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring when patches cannot be applied; these surface stored data manipulation when it exploits a tracked technical vulnerability (or is visible in logs/audits), with the bounded remainder being novel/zero-day manipulation that evades known-vuln detection.
T1565.001recovers — A.8.8 requires backup/restore capabilities, testing, and alignment with incident response to restore data integrity after manipulation at rest, with the named remainder being unrecoverable changes since the last backup or cases where no viable update/workaround exists.
T1565.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which can surface T1565.002 when it exploits a known transmitted-data weakness; this is only a slice because the technique can be deployed without a discoverable vulnerability and the clause's detection is scoped to known technical vulnerabilities rather than arbitrary MITM-style manipulation.
T1565.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and alignment with incident management to surface technical vulnerabilities and related events; this catches runtime data manipulation when it stems from or triggers a detectable exploited vulnerability (the dominant realized form), with the bounded remainder being stealthy manipulations that leave no observable vulnerability artifact.
T1566detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface phishing lures or related indicators (e.g. malicious attachments/links) when they trigger known-vuln signatures or post-delivery analysis; this is a genuine but minority slice of the broad social-engineering delivery technique described in T1566.
T1566.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for actual attacks, and awareness of reported vulnerabilities, which can surface spearphishing attachments exploiting known vulnerabilities or anomalous behavior, but does not broadly detect the social engineering delivery, attachment manipulation, or zero-day exploits central to the technique.
T1566.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control, which can surface spearphishing-linked exploits or malicious infrastructure after they are known; this is a genuine but minority slice of the social-engineering, link-obfuscation, consent-phishing and user-execution aspects of T1566.002.
T1566.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in assets/third-party components, and increased monitoring as a compensating control, which can surface indicators of spearphishing (e.g., malicious links/attachments or anomalous behavior tied to known vulnerable services), but does not broadly detect the social engineering technique itself across non-enterprise channels.
T1566.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring of known vulnerabilities, which can surface some post-compromise artifacts or anomalous behavior after a successful vishing attack but does not target the social-engineering delivery or pre-execution phase itself.
T1567detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface T1567 when it exploits a known-vulnerable web service or produces detectable anomalies, but the control does not mandate detection of the exfiltration technique itself and leaves most legitimate-looking uses of permitted web services undetected.
T1567.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous HTTPS/API traffic or unusual code-repo writes that match the T1567.001 pattern, but the clause's scope is technical vulnerabilities in assets rather than adversary exfiltration behaviors, leaving most realizations undetected.
T1567.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when no patch exists; these can surface anomalous exfiltration (including to cloud storage) as an indicator of exploitation, but detection is not the clause's purpose and coverage is limited to what the organization explicitly scopes into its vulnerability and monitoring processes.
T1567.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface anomalous outbound connections or data posted to pastebin-like sites when they align with known vulnerable components or observable patterns, but the clause is scoped to technical vulnerability management rather than general exfiltration detection.
T1567.004detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when patches are unavailable; this can surface webhook exfiltration when it triggers detectable network or behavioral anomalies, but the control's scope is limited to technical vulnerabilities and does not broadly instrument for stealthy SaaS webhook abuse that blends with normal traffic.
T1568detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known vulnerabilities; this surfaces some dynamic resolution implementations that rely on observable vulnerable components or libraries (e.g. via CVE), but does not address algorithmically generated C2 that evades known-vuln detection.
T1568.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when addressing vulnerabilities, which can surface fast-flux C2 infrastructure as anomalous DNS behavior or known malicious patterns, but the clause's scope is set by asset inventory and known technical vulnerabilities rather than mandating broad network/DNS telemetry that would catch most fast-flux instances.
T1568.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface DGA-related indicators (e.g. anomalous DNS, vulnerable libraries implementing DGA, or known malware using it) but does not mandate or guarantee detection of the technique itself in all cases.
T1568.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring of vulnerabilities (including in third-party components), which can surface the presence of this technique in deployed software after the fact; it does not guarantee detection of all instances or in all environments.
T1569detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for attacks exploiting known vulnerabilities, and procedures to detect the existence of vulnerabilities (including in third-party components), which surfaces T1569 abuse when it leverages a known-vulnerable service or daemon; the bounded remainder is novel/undisclosed service-abuse techniques that fall outside known-vulnerability detection.
T1569.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces some post-exploitation use of launchctl (e.g. via anomalous process or known vulnerable launchd behavior) but does not broadly instrument or detect the technique itself across all macOS executions.
T1569.002detects — A.8.8 requires monitoring for vulnerabilities, scanning, penetration testing, and increased monitoring as a compensating control when patches are unavailable; this can surface anomalous service creation/execution tied to known vulnerable components or post-exploitation, but does not broadly instrument or detect the technique itself across Windows service control manager abuse.
T1569.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for attacks exploiting known vulnerabilities, and increased monitoring as a compensating control, which can surface abuse of systemctl (a known Linux technique) once catalogued; it does not mandate general behavioral detection of the technique itself independent of a prior vulnerability.
T1571detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface non-standard port usage when it is already catalogued as a known vulnerable configuration or when it produces observable anomalies, but the clause is scoped to technical vulnerabilities in assets/components and does not broadly instrument for novel or custom port-abuse behaviors.
T1572detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control when patches are unavailable; this surfaces tunneling techniques that rely on vulnerable implementations (e.g. unpatched SSH, DoH libraries, or proxy components) but does not broadly detect the technique itself when used with up-to-date or non-vulnerable tooling.
T1573detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, which can surface the presence of weak/embedded-key encryption implementations that enable reverse engineering of C2 channels.
T1573.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when mitigations are applied, which can surface observable indicators of symmetric crypto use in C2 (e.g. anomalous encrypted traffic patterns or known vulnerable implementations), but does not mandate or guarantee detection of the technique itself.
T1573.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring to detect attacks exploiting them; this surfaces use of asymmetric crypto in C2 when it is a known-vulnerable implementation or observable anomaly.
T1574detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/components/libraries, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces T1574 instances that rely on known vulnerable hijack vectors (e.g. unpatched library loading or DLL search order) after they are disclosed, though it misses novel/undisclosed hijacks.
T1574.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface DLL hijacking/sideloading techniques when they involve known vulnerable libraries, unpatched components, or observable anomalous behavior.
T1574.001prevents — A.8.8's vulnerability scanning, penetration testing, third-party library tracking, timely patching, and compensating controls (e.g. virtual patching, increased monitoring, disabling services) can stop many exploitable DLL hijacking vectors before they succeed, but this is a minority slice: the control is scoped to known/published vulnerabilities and does not address novel or zero-day planting, search-order logic flaws, or sideloading that does not surface as a detectable technical vulnerability.
T1574.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface dylib hijacking opportunities or the malicious dylib itself as a technical vulnerability (especially via weak linking or missing-library paths).
T1574.005detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface this known installer-permissions weakness (and its reported instances) after it exists in deployed software.
T1574.005prevents — A.8.8's vulnerability identification, evaluation, timely patching, and compensating controls (e.g. ACL changes, virtual patching, disabling services) can stop many installer permission weaknesses from being exploitable, but the clause is silent on secure development practices that would stop the weak permissions from being introduced in the first place and does not reach every third-party installer an organization might run.
T1574.006detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces T1574.006 (a known technique abusing LD_PRELOAD/DYLD_INSERT_LIBRARIES in loaded libraries) when it appears in scanned components, reported bugs, or observed anomalous behavior, with the bounded remainder being novel/undisclosed hijacks not yet in any vulnerability database.
T1574.007detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, monitoring for vulnerabilities in products/services, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces the technique when it leverages a known vulnerable binary, library, or configuration exposed via PATH hijacking, with the bounded remainder being novel/undisclosed instances of the technique.
T1574.008detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, and monitoring for vulnerabilities in products/services (including after deployment), which surfaces search-order hijacking opportunities arising from unpatched vulnerable programs or libraries; the named remainder is custom in-house programs not captured by those mechanisms.
T1574.009detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, and increased monitoring to detect actual attacks exploiting known vulnerabilities; this surfaces the unquoted-path condition (a known, scannable misconfiguration) in assets and can detect exploitation in flight, with the bounded remainder being novel/undisclosed instances before they reach scanning sources.
T1574.009prevents — A.8.8's vulnerability scanning, assessment, patching, and compensating controls (e.g. access controls, traffic filters, increased monitoring) can identify and fix unquoted paths in services/shortcuts before exploitation, but this is only a slice of the weakness class since the control does not mandate secure path quoting in development or configuration baselines.
T1574.010detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface the permission weakness (or its exploitation) in services binaries after deployment.
T1574.010prevents — A.8.8's vulnerability identification, evaluation, timely patching, and compensating controls (workarounds, virtual patching, added access controls, increased monitoring) can stop the permission flaw from being exploitable before the technique runs, but this is only a slice: the clause is scoped to known/published technical vulnerabilities and does not mandate or enforce correct service binary permissions in the first place.
T1574.011detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces insecure registry permissions as a known technical vulnerability in the asset inventory.
T1574.012detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface COR_PROFILER-based hijacking when manifested as a known vulnerable .NET component, profiler DLL, or anomalous process behavior.
T1574.013detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for attacks exploiting known vulnerabilities, and alignment with incident detection; these surface the technique when it leverages a known vulnerable component or produces observable anomalies, but the technique itself is a living-off-the-land memory-resident hijack with no inherent vulnerability and can be restored to evade detection, so only a slice is covered.
T1574.014detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces AppDomainManager injection as a known technique when it appears in scanned components or reported vulnerabilities.
T1578detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks, and procedures to detect vulnerabilities (including in cloud-provider resources via agreements), which can surface post-modification anomalies or misconfigurations that enable T1578; however, it is scoped to technical vulnerabilities rather than directly targeting adversarial infrastructure modifications or evasion behaviors, leaving most of the technique outside its detection focus.
T1578responds — A.8.8 requires alignment with incident management (5.26) and fallback to incident response procedures when addressing urgent vulnerabilities, which directly enacts the `responds` verb once the modification technique is underway; the extent is partial because the clause is scoped to technical vulnerabilities (e.g., unpatched components) rather than all infrastructure modifications performed by an authenticated insider or via stolen credentials.
T1578.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface the anomalous creation of snapshots (a detectable cloud IaaS event) when it aligns with known vulnerable configurations or threat intel, but this is scoped only to what the organization's chosen monitoring and scanning covers rather than all snapshot creations.
T1578.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and logging of vulnerability management steps, which can surface anomalous creation of cloud instances (especially if tied to known vulnerable images, unapproved configs, or post-creation vuln assessment), but the control's scope is primarily vulnerability identification rather than general creation-event detection and many stealthy or policy-compliant creations go unseen.
T1578.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect the existence of vulnerabilities (including in cloud assets via inventory and supplier reporting), which can surface evidence of deleted instances as suspicious activity or missing assets, but this is scoped to vulnerability-focused detection rather than general forensic or instance-lifecycle monitoring.
T1578.004detects — A.8.8 explicitly requires increased monitoring to detect actual attacks exploiting a known vulnerability and alignment with incident management to surface vulnerability data, which can surface reversion of a cloud instance performed to hide post-exploitation activity; this is only a slice because the clause is scoped to known technical vulnerabilities rather than arbitrary evasion techniques, and detection is not its primary purpose.
T1578.004responds — A.8.8's incident-response tie-in and compensatory measures (increased monitoring, virtual patching, awareness, incident alignment) let the organization respond to and contain a reversion that has already run, but the clause's core focus is pre-exploitation vulnerability handling rather than active incident containment of evasion techniques.
T1578.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and evaluation of reports to surface technical vulnerabilities (including in cloud assets and third-party components), which can detect misconfigurations like altered quotas, policies, or regions when they introduce or expose a known vulnerability; however, the control is scoped to technical vulnerabilities rather than all configuration modifications, leaving many stealthy T1578.005 instances (e.g., approved quota changes with no CVE) undetected.
T1584detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface some compromised infrastructure (e.g. via known vulns, anomalous behavior, or botnet indicators) but only as a minority slice of the broad pre-attack technique that also includes stealthy compromises, supply-chain hijacks, and non-vuln-based takeovers.
T1584.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and receiving vulnerability reports, which can surface known DNS server flaws that enable compromise (including in third-party assets), but does not address detection of the post-compromise adversary technique itself or unknown/zero-day server compromises.
T1584.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in assets (including third-party/cloud components), and procedures to detect existence of vulnerabilities, which surfaces compromised VPS infrastructure when it introduces exploitable weaknesses (as in the technique's compromise step); mostly because detection is scoped to known vulnerabilities in inventoried assets and may miss novel/undisclosed compromises or non-vulnerable hijacks.
T1584.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring as a compensating control, which can surface the presence of the server compromise (a technical vulnerability) after it has occurred.
T1584.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party components/libraries, receiving vulnerability reports, and increased monitoring to detect attacks exploiting them; this surfaces the compromise of third-party systems into a botnet (or the vulnerable state enabling it) in most cases, though some stealthy or zero-day botnet buildouts fall outside routine detection.
T1584.007detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports to surface technical vulnerabilities in assets including cloud components; this can detect compromised serverless functions after the fact but does not cover the initial compromise, attribution challenges, or all runtime behaviors described.
T1584.008detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in assets (incl. third-party components and network devices via inventory and scanning), and increased monitoring as a compensating control, which can surface some compromised network devices or related vulns post-compromise; however, the technique occurs pre-compromise on external third-party infrastructure outside the organization's estate and monitoring scope, so only a slice is detectable.
T1584.008prevents — A.8.8 requires identifying, evaluating and addressing technical vulnerabilities (including in third-party network devices via inventory, scanning, patching, and compensating controls such as virtual patching or increased monitoring), which stops many exploitation paths that would let adversaries compromise those devices for later use; it is not full because the control is scoped to known/patchable vulnerabilities, leaves unpatched or zero-day cases (explicitly noted as targeting devices without robust defenses), and does not reach adversary supply-chain or pre-compromise actions on unmanaged third-party devices.
T1588.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process, all of which surface (i.e. detect) the presence or use of vulnerable tools acquired per T1588.002; mostly because it is scoped to known technical vulnerabilities in an asset inventory and does not guarantee detection of every custom, cracked, or novel tool acquisition.
T1588.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, receiving vulnerability reports, and increased monitoring as a compensating control, which can surface stolen or abused code-signing certs when they appear in vuln intel, bug bounties, or post-compromise scans; this is only a slice of the PRE technique (e.g., purchase via front orgs is rarely detectable this way).
T1588.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for reports, and increased monitoring to detect actual attacks on known vulnerabilities, which surfaces some exploits obtained via T1588.005; however, it has no view of pre-public exploits bought/stolen from dark markets or adversary R&D before they are reported or trigger observable behavior.
T1588.006detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for reports, and awareness of disclosures, which can surface adversary activity of acquiring vulnerability information (especially public or vendor-reported ones); however, it does not instrument or observe the adversary's own pre-compromise research, closed-database access, or targeting of researchers, leaving a large slice of the technique unseen.
T1592.002detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for reports, and awareness of third-party components, which can surface the adversary's reconnaissance of installed software versions (especially when it overlaps with known-vulnerable components or produces observable artifacts), but the control's scope is limited to post-identification vulnerability management rather than broadly detecting all pre-compromise host-software gathering techniques on PRE platforms.
T1595detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting known vulns, and increased monitoring as a compensating control, all of which surface active scanning (T1595) when it reveals or exploits technical vulnerabilities.
T1595.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting known vulns, and increased monitoring as a compensating control, which can surface the network scanning activity itself when it triggers observable artifacts or known vuln signatures; this is a genuine but minority slice of the broad PRE reconnaissance technique rather than its dominant form.
T1595.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for reports, and evaluation of assets to surface technical vulnerabilities (including those an external adversary would discover via T1595.002), with the bounded remainder being scans the organization does not know about or cannot reach (e.g. fully air-gapped assets).
T1595.003detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and awareness of reported issues, which can surface reconnaissance patterns (e.g. repeated probing or wordlist-driven enumeration) once they trigger known-vuln signatures, anomaly thresholds, or post-scan analysis; this is a genuine but minority slice because the clause centers on known technical vulnerabilities in assets rather than broad detection of pre-exploitation reconnaissance techniques like wordlist scanning on unknown directories or buckets.
T1598.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces some spearphishing-linked vulnerabilities (e.g., in web forms, phishing kits, or tracking pixels) but leaves the social-engineering delivery, QR codes, and pre-delivery reconnaissance mostly untouched.
T1599detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when a vulnerability is known; these can surface the compromise of a boundary device (or its vulnerable state) once present on the organization's estate, but the technique's upstream reconnaissance, device acquisition, and external bridging steps sit outside that scope.
T1599.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks on known technical vulnerabilities; this surfaces some NAT-traversal activity when it manifests as a detectable vulnerability or anomalous configuration change on boundary devices, but the technique is not itself a published vulnerability in most cases and much of it (especially custom/patched NAT or post-compromise config changes) falls outside routine vuln scanning scope.
T1600detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control, which can surface T1600 indicators such as anomalous crypto-related changes or known-vulnerable device images after they exist.
T1600.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, all of which surface the weakened crypto configuration or vulnerable device image post-compromise.
T1600.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; this surfaces the technique (or its prerequisite compromise) on monitored network devices when it aligns with tracked vulnerabilities, but only a slice is covered since the control is scoped to known technical vulnerabilities rather than all instances of this adversary technique.
T1601detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and receiving vulnerability reports, which can surface post-modification indicators or anomalous firmware behavior on network devices; however, the control is scoped to known/published technical vulnerabilities and does not broadly instrument for novel or in-memory OS image modifications on embedded platforms.
T1601.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for anomalies, and receiving reports to surface technical vulnerabilities (including in firmware/OS images and third-party components); this can detect post-exploitation indicators or known-vulnerable images but does not broadly detect in-memory patching, boot-loader manipulation, or novel adversary modifications of network device images.
T1601.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), and increased monitoring as a compensating control, which can surface the presence or effects of a downgraded image as an unpatched/outdated/vulnerable state on network devices; this is only a slice because the control is scoped to known vulnerabilities in an asset inventory and does not broadly instrument for the adversarial downgrade action itself.
T1602detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these surface adversary activity against exposed configuration repositories (a common vuln vector per the cited TAs), though not every stealthy collection method is guaranteed to be caught.
T1602.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including network devices), and increased monitoring as a compensating control, all of which surface anomalous SNMP/MIB access or exposed management info as part of technical vulnerability discovery.
T1602.002detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, monitoring for attacks exploiting known vulnerabilities, increased monitoring when no patch exists, and alignment with incident management to surface technical vulnerabilities (including those enabling config access via SNMP/SMI on network devices); this detects the technique when it triggers observable indicators, with the bounded remainder being stealthy/pre-compromise dumps that produce no detectable anomaly.
T1606.001detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these can surface indicators of forged-cookie usage (e.g. anomalous sessions or known vulnerable cookie-generation libraries), but the clause's scope is technical vulnerabilities rather than post-exploitation authentication bypass, leaving most realizations of T1606.001 outside its primary detection surface.
T1606.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; forged SAML tokens (often from stolen signing certs or misconfigurations) can be surfaced by these when the cert compromise or anomalous auth is in scope, but the control's focus is on known technical vulns in an asset inventory rather than novel forgery or pre-compromise cert theft, leaving a large remainder.
T1608.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface the presence or use of an improperly obtained/installed certificate as a technical vulnerability on adversary-controlled or compromised infrastructure.
T1608.004detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and monitoring/evaluating the process itself to surface technical vulnerabilities in assets (including web-facing ones that could host drive-by content), which directly detects the staged malicious resources or exploitable conditions described in T1608.004; mostly because it is scoped to known/patchable vulnerabilities in an asset inventory rather than novel adversary staging on acquired/compromised infrastructure.
T1608.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, and monitoring for technical vulnerabilities in assets (including third-party components and software), which can surface some link-target infrastructure (e.g. cloned phishing sites or uploaded malware on owned/known domains) but does not address adversary-controlled external resources, link-shorteners, IPFS, or pre-phish setup on PRE platforms.
T1609detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. third-party components), and increased monitoring as a compensating control, all of which surface container admin command abuse when it is tied to a known vulnerable configuration, misconfiguration, or unpatched component in the container runtime or orchestration layer.
T1610detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when vulnerabilities are known; these can surface container deployment anomalies or vulnerable/privileged containers post-deployment (especially in cloud/K8s via asset inventory and scanning), but the control's scope is technical vulnerability management rather than general detection of the adversary technique itself, leaving most deployment vectors (e.g., via APIs, dashboards, or benign images) outside its primary mechanism.
T1611detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for actual attacks, and evaluation of reports to surface technical vulnerabilities (including those enabling container escapes such as unpatched kernel flaws, misconfigurations, or privileged-container issues), which directly detects the enabling conditions of T1611 even if it does not observe the technique in flight.
T1611prevents — A.8.8's vulnerability identification, evaluation, patching, and compensating controls (e.g. virtual patching, disabling services, added access controls) can prevent some escape paths that rely on exploitable vulns in the container/runtime/hypervisor, but many documented techniques rely on intentional misconfigurations (privileged containers, bind mounts, docker.sock exposure) rather than unpatched vulns, which the control does not address.
T1612detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and increased monitoring for actual attacks, all of which surface the custom malicious image or its build artifacts on the host after T1612 completes.
T1613detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface container/resource discovery techniques when they trigger observable indicators or known vulnerable container components; this is only a slice because the clause is scoped to technical vulnerabilities rather than broadly instrumenting all discovery behaviors in container environments.
T1615detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalous behaviour tied to known vulnerabilities, and increased monitoring as a compensating control; these can surface reconnaissance activity that matches known Group Policy discovery patterns or tools, but the clause's scope is limited to technical vulnerabilities in assets rather than all adversary discovery techniques.
T1619detects — A.8.8 requires monitoring, scanning, vulnerability assessments, and increased monitoring for attacks (including on cloud assets via agreements), which can surface anomalous enumeration of cloud storage objects as part of discovery or attack patterns, but this is only a slice of possible detections rather than a bounded remainder.
T1620detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, and procedures to detect vulnerabilities in products/services (including external components), which surfaces T1620-style reflective loading when it is implemented via known vulnerable libraries, components, or unpatched code that enables it.
T1621detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for actual attacks on vulnerable systems, and increased monitoring as compensating controls, which can surface anomalous MFA request patterns or fatigue attacks once they are recognized as exploiting a known MFA weakness; this is only a slice because the clause is scoped to technical vulnerabilities in assets/components rather than broadly detecting the MFA-bypass technique in real time across all identity-provider or SaaS surfaces.
T1647detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and increased monitoring to detect actual attacks, all of which surface plist modification as a post-exploitation technique or indicator when it leaves detectable artifacts or known vulnerable components.
T1648detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party/cloud components), and increased monitoring as a compensating control, which can surface serverless abuse artifacts (e.g. anomalous functions, crypto-mining payloads, or event-triggered backdoors) once they are known or leave detectable traces; partial because the clause is scoped to known technical vulnerabilities rather than novel/zero-day adversary behaviors, and many T1648 examples involve living-off-the-land creation of legitimate-looking serverless resources that do not inherently register as a 'vulnerability'.
T1649detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/third-party components, and increased monitoring when no patch exists; these surface certificate-related misconfigurations, weak enrollment rights, exposed CAs, and unpatched certificate services that enable T1649, covering the bulk of its technical vectors with a bounded remainder in post-compromise golden-certificate forging that may evade preemptive detection.
T1651detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as compensating controls when patches are unavailable; these surface abuse of cloud management services (especially post-compromise or via third-party components), but only as a slice of the technique's execution rather than a mandated, comprehensive detection mechanism.
T1653detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, and tracking of third-party components plus an audit log of all steps; these surface power-setting abuse (a post-compromise configuration change or utility misuse) when it matches known vulnerable patterns, reported IOCs, or anomalous behavior, with the bounded remainder being entirely novel or stealthy abuse that evades scanning and monitoring.
T1654detects — A.8.8 requires monitoring, scanning, vulnerability assessments, and increased monitoring for attacks when no patch exists, which can surface log-enumeration activity as anomalous behavior or part of an incident, but only as one optional compensating measure among many and without mandating broad log-access or SIEM monitoring coverage.
T1657detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for vulnerabilities (including in third-party components), and increased monitoring as a compensating control, which can surface indicators of technical theft methods (e.g. compromised accounts, ransomware precursors) but does not broadly detect the financial objective, social engineering, or non-vulnerability-based paths described in T1657.
T1659detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control when patches are unavailable; this surfaces the presence of the upstream-channel or traffic-injection weakness after it exists but does not cover all adversary-in-the-middle-style injection vectors or non-vulnerability-based traffic manipulation.
T1665detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface some hiding techniques (e.g. anomalous traffic patterns, spoofed infrastructure, or vulnerable C2 artifacts) but does not systematically detect the core network-traffic manipulation or evasion behaviors described.
T1666detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (incl. cloud), and increased monitoring as a compensating control, which can surface anomalous hierarchy changes that expose or exploit known misconfigurations/vulnerabilities, but does not broadly detect the T1666 technique itself (e.g. API calls like CreateAccount/LeaveOrganization) outside a vulnerability context.
T1667detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring as a compensating control when patches are unavailable; these surface the anomalous flood of sign-up or spam messages as an attack in progress, but the clause is scoped to technical vulnerabilities in assets rather than generic abuse of external email services or social-engineering spam, leaving a large remainder of T1667 instances undetected by it.
T1671detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party/cloud components), receiving reports, and increased monitoring as a compensating control, all of which surface malicious OAuth integrations as a technical vulnerability in the SaaS/cloud environment after they are present.
T1674detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface input-injection techniques (or their artifacts) when they exploit known vulnerabilities, but does not broadly detect the technique itself when used against unpatched or unknown vectors.
T1675detects — A.8.8 requires vulnerability scanning, penetration testing, monitoring for anomalies, increased monitoring of vulnerable systems, and alignment with incident management to surface technical vulnerabilities and related activity; this can detect exploitation of ESXi flaws enabling T1675 (as in the cited 2023 zero-days), but does not broadly instrument guest-VM command execution or the specific APIs/tools involved.
T1677detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in third-party libraries/source code, and procedures to detect vulnerabilities in products/services (including external components used in builds), which surfaces poisoned pipeline code or artifacts when they match known patterns or are reported; this is a genuine but minority slice because most T1677 variants (esp. novel/zero-day injections via PRs or indirect files) are not known vulnerabilities until after exploitation, and the control's scanning focus is post-deployment or on inventory rather than real-time CI pipeline integrity.
T1679detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect actual attacks, which can surface the selective-exclusion artifacts or anomalous ransomware behavior once it is underway.
T1680detects — A.8.8 requires increased monitoring to detect actual attacks exploiting known vulnerabilities and uses scanning/penetration testing plus threat-intelligence feeds to surface vulnerable components or configurations; this can catch some T1680 instances that target known-vulnerable storage-enumeration paths or unpatched discovery tools, but does not broadly instrument or detect the technique itself across its platforms and benign-looking commands.
T1684.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, monitoring for vulnerabilities in products/services/components, and receiving vulnerability reports, which can surface misconfigurations such as weak/absent DMARC policies (treated as a technical vulnerability in email auth); this is a genuine but minority slice of the technique, which is primarily about runtime header forgery rather than a scannable flaw.
T1685detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control, all of which surface tampering with or impairment of security tools (a detectable technical vulnerability)
T1685responds — A.8.8 requires aligning vulnerability management with incident response (including communicating vulnerabilities to the IR function and providing technical procedures for incidents) and using incident response procedures for urgent cases, which lets the organization respond to an in-progress T1685 event once detected; this is only a slice of the broad technique (e.g., does not address containment/eradication of tampering itself), so partial per event-lane doctrine and anchors such as IR-4 vs T1486.
T1685.001detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, monitoring for attacks exploiting the vulnerability, and procedures to detect the existence of vulnerabilities (including in products/services), which surfaces the T1685.001 technique when it leaves detectable artifacts such as disabled services, registry changes, or altered audit policies.
T1685.002detects — A.8.8 explicitly requires increased monitoring to detect actual attacks exploiting a known vulnerability, vulnerability scanning/penetration testing, receiving reports, and alignment with incident management for communicating vulnerability data; this surfaces some T1685.002 instances (e.g. via anomalous config changes or post-disable attack activity) but does not broadly instrument or detect the logging-disable technique itself across cloud platforms.
T1685.003detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring when no patch exists; these surface tampering that produces falsified UIs or health indicators (especially after the initial impairment of EDR/logging agents), but only where the spoof itself leaves detectable artifacts or is treated as a vulnerability in the monitored inventory.
T1685.004detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services (including third-party components), receiving reports, and increased monitoring as a compensating control, all of which surface the presence or use of the audit-disabling technique or its artifacts on Linux systems.
T1685.005detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect the existence of vulnerabilities (including in products/services and via reports), which surfaces the T1685.005 technique when it is used to cover tracks on monitored Windows systems; the named remainder is that detection depends on the scope of monitoring and does not catch every instance (e.g., offline log deletion without triggering alerts).
T1686detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which surfaces firewall-tampering techniques (or their artifacts) once they create detectable vulnerable states or anomalous configurations on monitored assets.
T1686.001detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and procedures to detect the existence of vulnerabilities (including in cloud-provider resources via agreements), which surfaces the firewall modification as a realized vulnerability or anomalous configuration change.
T1686.001responds — A.8.8's incident-response tie-in and its explicit option to route high-urgency vulnerabilities through 5.26 procedures let the control respond to an already-underway T1686.001 once it is discovered as a realized vulnerability, but the clause's dominant focus is pre-exploitation identification/patching rather than containment/eradication of an active technique, leaving most of the verb's scope outside its defined actions.
T1686.002detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, receiving reports, and increased monitoring as a compensating control, all of which surface the vulnerable firewall configurations, rule changes, or exploited device weaknesses that enable T1686.002; the bounded remainder is post-compromise adversarial changes that are not themselves a published vulnerability.
T1686.003detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests/vulnerability assessments, monitoring for actual attacks, and procedures to detect vulnerabilities (including in products/services and via reports), which surfaces the anomalous firewall modifications or disabled state as a technical vulnerability or configuration drift on Windows assets.
T1687detects — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and receiving vulnerability reports, all of which surface exploitable flaws in defensive components before or as they are targeted by T1687.
T1687prevents — A.8.8's core purpose and actions (inventory, scanning, patching, remediation of identified vulnerabilities including in security tools and third-party components) directly stop most exploitable vulnerabilities in defensive components from existing in a state where T1687 can succeed; the bounded remainder is zero-days and unpatchable cases where only mitigations apply.
T1688detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for vulnerabilities in products/services/components, and increased monitoring as a compensating control, which can surface anomalous safe-mode boots or related registry/BCD changes when they are catalogued as known techniques or leave detectable artifacts; this is only a slice because the clause is scoped to technical vulnerabilities (typically CVEs in software) rather than ATT&CK techniques, does not mandate host telemetry for boot behavior, and leaves many in-memory or post-boot abuse paths unseen.
T1689detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, tracking of third-party libraries, receiving vulnerability reports, and ongoing evaluation/monitoring of the technical vulnerability management process itself, all of which surface the presence or use of outdated/vulnerable versions that enable downgrade attacks.
T1689prevents — A.8.8's inventory, scanning, patching, and remediation process (including for third-party components and libraries) stops many downgrade opportunities by keeping systems current and removing vulnerable older versions; it does not address all cases such as protocol-level or boot-manager downgrades that exploit backward compatibility without a patchable component.
T1690detects — A.8.8 explicitly requires vulnerability scanning, penetration testing, monitoring for anomalies, and increased monitoring to detect attacks exploiting known vulnerabilities; while T1690 is a post-compromise technique that can be surfaced as anomalous behavior or via vuln scanning of misconfigured systems, it is not a named technical vulnerability and most instances (e.g. HISTCONTROL tweaks, PSReadLine changes) fall outside routine vuln detection.

Prevented OWASP Web Top 10 (2025) risks (25)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01→P A02→P A03→P A05→P A06→P A07→M A08→P A09→M A10→P

Why these map — AI rationale (under review)

A01finds — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking third-party libraries, receiving reports, and evaluating identified issues, which surfaces many Broken Access Control instances (e.g. missing checks, IDOR) after deployment; however, this is only a slice as the category also includes design/implementation defects best found by code analysis rather than post-deployment vuln scanning.
A01mitigates — A.8.8's compensating measures (virtual patching, traffic filters, adapted access controls, increased monitoring) can bound the blast radius or detect exploitation of some A01 weaknesses (e.g. certain path traversals or SSRF), but do not address the core authorization-decision failures that dominate the category.
A02mitigates — A.8.8's compensating measures (virtual patching, added firewalls, increased monitoring, workarounds, turning off features) bound the realized impact of an exposed attack surface without removing the weak defaults or incomplete hardening themselves.
A03finds — A.8.8 explicitly requires vulnerability scanning, penetration testing, tracking of third-party libraries, receiving reports, and evaluating systems against vulnerability information, which discovers vulnerable/outdated dependencies (the largest slice of A03); it does not address compromised build pipelines or signing infrastructure.
A03mitigates — A.8.8's compensating controls (virtual patching, traffic filters, increased monitoring, workarounds, access-control adaptations) bound the consequence of a realised supply-chain weakness without removing the vulnerable/outdated/compromised dependency, pipeline or signing infrastructure itself
A03remediates — A.8.8 explicitly requires acting on identified vulnerabilities by developing/applying patches, updates, workarounds, virtual patching or other mitigations that remove or neutralize the vulnerable/outdated dependency (the dominant member of A03); it does not address compromised build pipelines or signing infrastructure, which remain after the control runs.
A05finds — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving reports, and evaluating identified vulnerabilities, which directly surfaces injection flaws (SQL, command, XSS, etc.) in deployed systems, code, and components.
A05mitigates — Boundary and traffic-filter mitigations (virtual patching, firewalls, increased monitoring) in A.8.8 explicitly bound the consequence of a realized injection without removing the unneutralized input, but most category members (SQLi, XSS) never cross an organizational boundary so the slice is limited.
A05remediates — A.8.8 explicitly requires developing remediation (patches/updates), testing it, and applying it (or workarounds/virtual patching) to remove the vulnerable condition once identified; this directly remediates many injection flaws (e.g. via code changes or filters), but leaves a bounded remainder for cases with no available update, unpatchable interpreters, or where the control falls back only to detection/monitoring rather than removal.
A06finds — A.8.8 explicitly requires vulnerability scanning, penetration testing, vulnerability assessments, tracking of third-party libraries, and evaluation of reports to discover technical vulnerabilities, which surfaces some design-level weaknesses (e.g. missing controls detectable via testing or known patterns) but not the bulk of architecture-level insecure design flaws that require threat modeling or secure design review rather than post-deployment scanning.
A07finds — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, receiving vulnerability reports, and evaluating reports to discover technical vulnerabilities, which directly surfaces most authentication failures (weak credentials, flawed reset flows, session issues) once they exist as exploitable flaws in deployed systems or components.
A08mitigates — A.8.8's remediation steps (virtual patching, traffic filters, added access controls, increased monitoring, workarounds) bound the consequence of realized integrity failures such as unsigned updates or insecure deserialization, but do not address the core weakness of trusting code/data without verification, nor CI/CD paths.
A09finds — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services (including external components), and receiving/analyzing reports, all of which surface missing or ineffective logging/alerting as a technical vulnerability.
A10finds — A.8.8 explicitly requires vulnerability scanning tools, penetration tests, vulnerability assessments, tracking of third-party libraries, procedures to detect vulnerabilities in products/services, and receiving/analyzing reports, all of which surface error-handling, fail-open, and inconsistent-state weaknesses that fall under A10:2025.
A10mitigates — A.8.8's compensating controls (workarounds, virtual patching, added access controls, increased monitoring, turning off vulnerable capabilities) bound the consequence or exposure of a realised mishandled-exception weakness without removing the underlying error-handling defect itself
A10remediates — A.8.8's core purpose and procedures (identify, evaluate, patch/update, workaround, virtual patch, increased monitoring) directly remove or correct mishandled error paths, fail-open logic, and leaked information once discovered, but only for those that surface as identifiable technical vulnerabilities rather than all design or code-level exceptional-condition defects.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.