Cyber Resilience

← ISO 27001 Annex A

A.8.9 Technological

Configuration management

AttributesPreventive C·I·A Protect Secure configuration Protection

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (22)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AC-6←P CM-11←P CM-2←F →M CM-3←M →M CM-4←M CM-5←M CM-6←F →M CM-7←M →M CM-8←P →P CM-9←M SA-10←M SI-7←P CM-1gov

Why these map — AI rationale (under review)

CM-2mostlycovers — Both controls establish and maintain secure baseline configurations for systems and components throughout their lifecycle.
CM-3mostlycovers — Both require formal change control processes and logging for all configuration modifications to hardware, software, and services.
CM-6mostlycovers — Both mandate defining, applying, and periodically reviewing standardized secure configuration settings across organizational assets.
CM-7mostlycovers — A.8.9's mandate to maintain correct security settings and prevent unauthorized/incorrect configuration changes accounts for the bulk of CM-7's least-functionality and restriction requirements, but leaves a residual on the explicit configuration of 'only essential capabilities' (the first CM-7 objective) that is narrower than A.8.9's general correctness focus.
CM-7partialaligns with — Both emphasize disabling or restricting unnecessary functions, services, and privileged accounts to reduce attack surface.
CM-8partialaligns with — Both require maintaining accurate records of system components and their configuration relationships for accountability.

Aligned NIST CSF 2.0 outcomes (18)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

PR.PS-01←F →F ID.AM-08gov ID.RA-07gov PR.AA-05gov PR.PS-02gov PR.PS-03gov PR.PS-04gov PR.PS-05gov

Why these map — AI rationale (under review)

PR.PS-01fullcovers — The ISO control's mandate to define, enforce, record, and monitor secure configuration baselines for hardware, software, services, and networks directly implements the CSF outcome of establishing and applying configuration management practices.
PR.PS-02mostlyaligns with — By requiring periodic review and update of standard templates when new threats, vulnerabilities, or software/hardware versions appear, the control ensures software is maintained and replaced in line with risk.
PR.PS-03mostlyaligns with — The control's requirement to maintain and enforce secure hardware configurations throughout the asset lifecycle aligns with the CSF outcome of managing hardware commensurate with risk.
ID.AM-08partialaligns with — Requiring configuration records, change logs, and owner information for every asset supports the CSF outcome of managing systems, hardware, software, services, and data throughout their life cycles.
ID.RA-07partialaligns with — The control's requirement that configuration changes follow a formal change-management process and that deviations are assessed and corrected addresses the CSF outcome of managing changes and exceptions for risk impact.
ID.AM-08implements — A.8.9 operationalizes secure configuration management across the full asset life cycle that ID.AM-08 names; the link is within the asset-management domain but the outcome does not explicitly name configuration management.
ID.RA-07implements — A.8.9's operational process of managing and securing configuration changes directly gives effect to the governance outcome of managing, risk-assessing, recording and tracking changes and exceptions within the risk-assessment domain
PR.PS-02implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
PR.PS-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (13)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V13.2.1→M V13.2.2→M V13.2.3→M V13.2.4→P V13.2.5←P →P V13.4.2←M →P V13.4.3←P V13.4.7←P V15.2.3←M →P V6.3.2←M

Why these map — AI rationale (under review)

V13.2.1mostlyaligns with — The ISO control's requirement to enforce secure baseline configurations on backend components and services directly supports the ASVS mandate that non-standard session mechanisms between backend elements must still be protected by documented, controlled communication settings.
V13.2.2mostlyaligns with — Requiring recorded, monitored configurations for all backend services and APIs mirrors the ASVS expectation that every inter-component link (middleware, data stores, OS services) follows an approved, non-default security posture.
V13.2.3mostlyaligns with — Mandating immediate replacement of vendor default credentials and restriction of privileged identities implements the same objective as the ASVS rule that service-to-service authentication must never rely on factory or default credentials.
V13.2.4partialaligns with — Defining and maintaining allow-listed external resources within configuration templates aligns with the ASVS requirement to restrict outbound connections to only pre-approved destinations.
V13.2.5partialaligns with — The ISO practice of restricting server-initiated requests to an approved allow-list of targets corresponds to the ASVS control that web or application servers must be configured with explicit outbound resource restrictions.
V13.4.2partialaligns with — Periodic monitoring and automatic enforcement of secure configurations helps ensure debug modes and unnecessary services remain disabled in production, satisfying the intent of the ASVS requirement to disable debug features.
V15.2.3partialaligns with — By disabling or restricting unnecessary functions and services through standard secure templates, the ISO control achieves the same goal as the ASVS rule that production environments must contain only required functionality.

Related weaknesses / CWE (92)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Why these map — AI rationale (under review)

CWE-1233nonemitigates — Configuration management enforces lock-bit settings and prevents unauthorized hardware register changes.
CWE-1283nonemitigates — Configuration management enforces integrity of boot-time registers and measurement data.
CWE-1313nonemitigates — Configuration management can mandate secure hardware settings that prevent activation of test/debug logic.
CWE-282nonemitigates — Configuration management includes maintaining correct ownership of system components and files.
CWE-378nonemitigates — Configuration management can enforce secure defaults for temporary file permissions.
CWE-708nonemitigates — Configuration baselines may specify ownership, but the control is broader and does not target ownership assignment errors.
CWE-1051prevents — Configuration management directly addresses hard-coded network resource identifiers by enforcing externalized, version-controlled settings.
CWE-11prevents — Configuration management directly requires disabling debug builds and removing diagnostic information from production releases.
CWE-1112mitigates — Configuration management records execution parameters, but does not guarantee completeness of documentation.
CWE-1125prevents — Configuration management directly limits unnecessary services, ports and features that enlarge the attack surface.
CWE-1188prevents — Mandating secure baseline templates and immediate replacement of vendor defaults directly stops systems from being deployed with insecure factory settings that attackers can exploit.
CWE-1190prevents — Configuration management enforces secure boot ordering and DMA enablement timing.
CWE-12prevents — Configuration management directly requires proper configuration of error handling to avoid information disclosure.
CWE-1221prevents — Configuration management enforces secure default values and parameter settings for hardware registers and IP modules.
CWE-1222mitigates — Configuration management can enforce fine-grained lock settings but does not guarantee hardware register granularity.
CWE-1231mitigates — Configuration management can define and enforce lock-bit settings, but does not prevent runtime modification of the bit itself.
CWE-1234mitigates — Configuration management can enforce secure debug settings, yet hardware-level lock bypass may still occur outside its scope.
CWE-1253prevents — Configuration management can enforce correct fuse settings and prevent unauthorized changes that would leave the system in an insecure state.
CWE-1269prevents — Configuration management directly prevents release of non-release builds by enforcing approved, documented configurations.
CWE-1272mitigates — Configuration management can embed secure-state-transition settings, yet does not guarantee data clearing.
CWE-1282mitigates — Configuration management enforces immutable firmware and write-once settings, directly preventing unauthorized reprogramming of assumed-immutable data.
CWE-1295prevents — Configuration management can disable debug flags, providing partial mitigation without covering the control's broader scope.
CWE-1304prevents — Configuration management directly requires preserving and verifying hardware configuration state across power events.
CWE-1314prevents — Configuration management enforces write-protection and integrity checks on parametric/sensor calibration data.
CWE-1342mitigates — Configuration management can enforce CPU microcode versions and disable vulnerable speculative features.
CWE-1391prevents — Enforces secure baseline configurations that should remove default credentials, yet does not guarantee credential strength.
CWE-1392prevents — The requirement to replace vendor default authentication information immediately after installation directly counters the use of default credentials that attackers commonly target.
CWE-1393prevents — Configuration management processes typically enforce changing defaults during hardening.
CWE-1394prevents — Enforces secure configuration baselines that should replace default keys.
CWE-15prevents — Configuration management directly prevents external tampering with system settings.
CWE-250prevents — The control explicitly calls for minimizing privileged identities and disabling unnecessary accounts, thereby reducing the number of processes that run with unnecessary privileges.
CWE-258prevents — Configuration management processes would normally detect and correct insecure empty-password settings.
CWE-260prevents — Configuration management processes can enforce removal of secrets from config files, but the control is broader.
CWE-276prevents — Standard templates that restrict access to utility programs and host parameter settings prevent the assignment of overly permissive default permissions on critical resources.
CWE-278prevents — Configuration management can define secure default permissions and prevent insecure inheritance during deployment or copy operations.
CWE-284prevents — Enforcing recorded, monitored, and deviation-corrected configurations limits an attacker’s ability to exploit improper access control by keeping systems in a known secure state.
CWE-344prevents — Configuration management prevents use of hard-coded or invariant values by enforcing environment-specific settings.
CWE-379mitigates — Configuration management can enforce secure default permissions on temporary directories.
CWE-427prevents — Configuration management can enforce approved search-path settings but does not inherently prevent the weakness.
CWE-433prevents — Configuration management ensures correct server settings for content types but is broader than this specific weakness.
CWE-453prevents — Configuration management enforces secure default values and prevents insecure initialization.
CWE-455mitigates — Configuration management ensures secure initialization settings and failure handling, directly mitigating non-exit on failed init.
CWE-471mitigates — Configuration management ensures that values declared immutable remain under controlled change processes.
CWE-489prevents — Configuration management can disable or remove debug features through hardened baselines.
CWE-520prevents — Configuration management can enforce secure impersonation settings, but eliminating the weakness does not materially advance broader configuration governance.
CWE-525prevents — Configuration management can mandate secure browser cache settings across the estate.
CWE-529prevents — Configuration management can enforce ACL file permissions but does not address the weakness directly.
CWE-555prevents — Enforces secure configuration management, reducing the risk of plaintext secrets being stored in application config files.
CWE-6prevents — Configuration management ensures session-ID length settings are correctly defined and maintained.
CWE-605prevents — Configuration management can enforce and audit port-binding settings across systems.
CWE-665prevents — Configuration management can enforce secure defaults and initialization settings but is not the primary control for code-level initialization.
CWE-69mitigates — Secure baseline configurations can disable or restrict ADS features on Windows systems, reducing exposure without eliminating the underlying coding weakness.
CWE-732prevents — By defining and enforcing secure permission settings in configuration templates, the control reduces the likelihood that critical resources receive incorrect permission assignments.

Mitigated MITRE ATT&CK techniques (1806)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.001←M T1001.002←M T1001.003←M →P T1003→P T1003.001←P →P T1003.002←P →P T1003.003→P T1003.004→P T1003.005←P →P T1003.006←P →P T1003.007→P T1003.008→P T1005→P T1006←M →P T1007→P T1011←P T1011.001←M T1012→P T1014←M →P T1016.001→P T1016.002→P T1018→P T1020→P T1020.001←M →P T1021←M →P T1021.001←M →P T1021.002←M →P T1021.003←P →P T1021.004←P →P T1021.005←M →P T1021.006←M →P T1021.007←M →P T1021.008←M →M T1027→P T1027.001←M T1027.002←M →P T1027.004←M →P T1027.005←M →P T1027.006←M T1027.007←M T1027.008←M T1027.009←M T1027.010←M T1027.011←M →P T1027.013←M T1027.014←M T1027.016←M T1027.017←M T1027.018←M T1030←M T1033→P T1036←M →P T1036.001→P T1036.002←M →P T1036.003←M →P T1036.004←M →P T1036.005←M →P T1036.006←M →P T1036.007←M →P T1036.008←M →P T1036.009←M →P T1036.010←M →P T1036.011←M →P T1036.012←M T1037→P T1037.001→P T1037.002→P T1037.003←M →P T1037.004←M →P T1037.005←M →P T1040←M →P T1041→P T1046←M →P T1047←M →P T1048→P T1048.003←P →P T1049→P T1052.001→P T1053←M →P T1053.002→P T1053.003←M →P T1053.005→P T1053.006→P T1053.007←M →P T1055←M →P T1055.001←M →P T1055.002←M →P T1055.003←M →P T1055.004←M →P T1055.005←M →P T1055.008←M →P T1055.009←M →P T1055.011←M →P T1055.012←M →P T1055.013←M →P T1055.014←M →P T1055.015←M →P T1056→P T1056.001←P →P T1056.002←M T1056.003←M →P T1056.004←P →P T1057→P T1059←M →P T1059.001←M →P T1059.002→P T1059.003←M →P T1059.004→P T1059.005→P T1059.006→P T1059.007→P T1059.008←M →P T1059.009←M →P T1059.010→P T1059.011→P T1059.012←P →P T1059.013←M →P T1068←M →P T1069→P T1069.001→P T1069.002→P T1069.003→P T1070←M →P T1070.003←M →P T1070.004←M →P T1070.005→P T1070.006←M →P T1070.007←M →P T1070.008←P →P T1070.009←M →P T1070.010←M →P T1071←M T1071.001←M →P T1071.002←M →P T1071.003←M T1071.004←M →P T1071.005←M →P T1072←M →P T1074.001→P T1078→P T1078.001→M T1078.002←P →P T1078.003→M T1078.004→P T1080←M →P T1082→P T1083→P T1087→P T1087.001→P T1087.002→P T1087.003→P T1087.004→P T1090←M →P T1090.001←M →P T1090.002←M →P T1090.003←M T1090.004←M T1091←M →P T1095←M →P T1098←M →M T1098.001→P T1098.002→P T1098.003→P T1098.004→P T1098.005→P T1098.006→P T1098.007→P T1102←M →P T1102.001←M →P T1102.002←M →P T1102.003←M →P T1104←P T1105←P →P T1106←P →P T1110→P T1110.001→M T1110.002→P T1110.003→P T1110.004←M →P T1111←M →P T1112→P T1114.002→P T1114.003→P T1120→P T1123←P →P T1124→P T1125←P T1127←M →P T1127.001←M →P T1127.002←M →P T1127.003←M →P T1129→P T1132←M T1132.001←M T1132.002←M T1133→P T1134←M →P T1134.001←M →P T1134.002←P T1134.003←P →P T1134.004←M →P T1134.005←M →P T1135→P T1136→M T1136.001→M T1136.002←P →P T1136.003→P T1137←M →P T1137.001←M →P T1137.002→P T1137.003←M →P T1137.004→P T1137.005←M →P T1137.006←M →P T1176←M →P T1176.001←M →P T1176.002←M →P T1185←M →P T1187←P →P T1189←M →P T1190←M →P T1195←M T1195.001←P →P T1195.002←M →P T1195.003←M T1197←M →P T1199←M →P T1200←M →P T1201→P T1202←M →P T1203←M →P T1204←P T1204.002←M →P T1204.003←M →P T1204.004←M T1204.005←M →P T1205←M →P T1205.001←M →P T1205.002←M →P T1207→P T1210←M →P T1211←M →P T1212←M →P T1213←M →P T1213.003→P T1213.005→P T1213.006→P T1216←M →P T1216.001←M →P T1216.002←M →P T1218←M →P T1218.001←P →P T1218.002←M →P T1218.003←M →P T1218.004←M →P T1218.005←M →P T1218.007←M →P T1218.008←M →P T1218.009←M →P T1218.010←M →P T1218.011←M →P T1218.012←M →P T1218.013←M →P T1218.014←M →P T1218.015←M →P T1219←M →P T1219.001←M →P T1219.002←M →P T1219.003←M →P T1220←M →P T1221←M →P T1222→P T1222.001←M →P T1222.002←M →P T1480←P T1480.001←M T1482→P T1484→P T1484.001→P T1484.002→P T1485→M T1485.001→P T1486→M T1489←M →P T1490←M →M T1491←P →P T1491.001←P →P T1491.002→P T1495←M →P T1496←P →P T1496.001←M →P T1496.002→P T1496.003→P T1496.004←M →P T1497←M T1497.001←M T1497.002←M T1497.003←P →P T1498→P T1498.001→P T1498.002→P T1499←P →P T1499.001→P T1499.002←P →P T1499.003→P T1499.004←P →P T1505←M →P T1505.001←M →P T1505.002←M →P T1505.003←M →P T1505.004←M →P T1505.005→P T1505.006←M →P T1518→P T1518.001→P T1518.002→P T1525→P T1526←M →P T1528←P →P T1529←P →P T1530→M T1531←P →P T1535→P T1537←M →P T1538→P T1539←M →P T1542←M →P T1542.001←M →P T1542.002←M →P T1542.003←M →P T1542.004←M →P T1542.005←M →P T1543→M T1543.001→P T1543.002→M T1543.003→M T1543.004→P T1543.005→P T1546→P T1546.001→P T1546.002→P T1546.003←M →P T1546.004→P T1546.005→P T1546.006←P →P T1546.007→P T1546.008→P T1546.009→P T1546.010→P T1546.011→P T1546.012→P T1546.013→P T1546.014→P T1546.015→P T1546.016←M →P T1546.017→P T1546.018←M →P T1547→M T1547.001→P T1547.002→P T1547.003→P T1547.004→P T1547.005→P T1547.006→P T1547.007→P T1547.008→P T1547.009→P T1547.010←P →P T1547.012→P T1547.013→P T1547.014→P T1547.015→P T1548←M →M T1548.001→P T1548.002←M →P T1548.003→M T1548.004←M →P T1548.005→P T1548.006←M →P T1550←M →P T1550.001←F →P T1550.002←F →P T1550.003←M →P T1550.004←F →P T1552→P T1552.001→P T1552.002←P →P T1552.003←P →P T1552.004←P →P T1552.005←M →P T1552.006→P T1552.007→P T1552.008←P →P T1553←M →P T1553.001←M →P T1553.002←P →P T1553.003→P T1553.004→P T1553.005←M →P T1553.006→P T1554→P T1555←P →P T1555.001→P T1555.002→P T1555.003→P T1555.004→P T1555.005→P T1555.006←P →P T1556→P T1556.001←M →P T1556.002←P →P T1556.003→P T1556.004←M →P T1556.005→M T1556.006→P T1556.007→P T1556.008→P T1556.009←M →P T1557←P →P T1557.001←M →P T1557.002→P T1557.003←M →P T1557.004←M →P T1558←P →P T1558.001→P T1558.002←M →P T1558.003←P →P T1558.004→P T1558.005←P →P T1559.001→P T1559.002←M →P T1559.003←P →P T1560.001→P T1560.003→P T1561←M →M T1561.001←P →M T1561.002←P →P T1563→P T1563.001←M →P T1563.002←M →P T1564→P T1564.001→P T1564.002→P T1564.003→P T1564.004←M →P T1564.005→P T1564.006→P T1564.007→P T1564.008→P T1564.009→P T1564.010→P T1564.011→P T1564.012→P T1564.013→P T1564.014→P T1565→P T1565.001→P T1565.002→P T1565.003→P T1566.003←M T1567→P T1567.001→P T1567.002→P T1567.003→P T1567.004→P T1568←M T1568.001←M T1568.002←M T1568.003←P →P T1569←M →M T1569.001←M →P T1569.002←P →P T1569.003←M →P T1570→P T1571→P T1572←M →P T1574→P T1574.001←M →P T1574.004←M →P T1574.005→P T1574.006←M →P T1574.007←M →P T1574.008←M →P T1574.009→P T1574.010→M T1574.011→M T1574.012←M →P T1574.013←M →P T1574.014←M →P T1578→P T1578.001←M →P T1578.002←M →P T1578.003←M →P T1578.004←M →P T1578.005→P T1580←M →P T1583.005←M T1583.007←M T1584←M T1584.001←M →P T1584.002←M T1584.003←P T1584.004←M T1584.005←P T1584.006←M T1584.007←M →P T1584.008←M →P T1586.003←M →P T1587.001←P T1588.001←P T1588.005←M T1589.001→P T1595→P T1595.002→P T1596.004←M T1599→P T1599.001→P T1600←P →P T1600.001→P T1600.002←M →P T1601←M →P T1601.001→P T1601.002→P T1602→P T1602.001←M →P T1602.002→M T1606←M T1606.001←M T1606.002←M →P T1609←M →P T1610←P →P T1611←M →P T1612←M →P T1613→P T1615→P T1620←M →P T1621←M →P T1622←M T1647→P T1648←M →P T1649←P →P T1650←M T1651←M →P T1653←P →P T1654→P T1659→P T1665←M T1666→P T1668←M T1669←P →P T1671←M →P T1673→P T1675←P →P T1677←M →P T1678←P T1679←P →P T1680→P T1684←M T1684.002←M T1685→P T1685.001→P T1685.002→P T1685.003←M →P T1685.004→P T1685.005←M →P T1685.006←M →P T1686→M T1686.001→M T1686.002→M T1686.003→M T1687←P →P T1688←M →P T1689→P T1690←M →P

Why these map — AI rationale (under review)

T1001.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous protocol or service configurations (e.g. unexpected certificates, enabled insecure services, or clock skew aiding impersonation), but this is limited to configuration state rather than runtime traffic analysis or behavioral detection of impersonated C2.
T1003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength evaluation) can surface deviations or anomalous changes that enable or accompany credential dumping, but this is limited to configuration drift rather than reliably detecting the technique's execution in memory, caches, or structures across platforms.
T1003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, minimizing privileged access) stop many common credential-dumping vectors at source, but leave a genuine remainder (e.g. LSASS dumping via permitted admin tools, memory scraping of running processes, custom tools) that the clause does not address.
T1003.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized changes to LSASS-related settings (e.g. SSP registry keys) or deviations that enable the technique, but does not broadly detect in-memory credential dumping or process-injection variants of T1003.001
T1003.001prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, restrict powerful utilities and host parameters, change defaults, minimize privileged access) directly block several named vectors for LSASS dumping (e.g. unnecessary SSPs, weak defaults, excessive admin rights, unrestricted utilities like procdump), but leave the core in-memory credential-harvesting technique available to any process that legitimately holds SeDebugPrivilege or equivalent, which is a large residual slice of the technique.
T1003.002detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including privileged accounts, unnecessary services, and default passwords), which can surface some SAM access anomalies or insecure configs enabling T1003.002 but does not broadly instrument for the credential extraction technique itself.
T1003.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary accounts/services, minimizing privileged access, changing defaults, restricting utilities) directly stop many common vectors for SYSTEM-level SAM extraction (e.g. via Mimikatz or reg save on default setups), but cannot block all post-exploitation paths once an adversary already holds sufficient privileges or introduces new tools.
T1003.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous access or changes to NTDS.dit (or related backups) when it deviates from the hardened baseline, but this is limited to configuration drift rather than reliably catching the technique's stealthy tools (e.g. Volume Shadow Copy, ntdsutil.exe) or the credential theft itself.
T1003.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting privileged access and powerful utilities, minimizing admin rights, changing defaults) directly block several listed methods (ntdsutil.exe, Invoke-NinjaCopy, Volume Shadow Copy via service restrictions) on domain controllers and limit who can reach NTDS.dit, but do not stop all paths (e.g. legitimate admin use of secretsdump.py or physical/logical access to backups) and leave the core credential-extraction goal reachable.
T1003.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous changes or access that enable LSA secrets extraction (e.g. via Mimikatz or registry tools), but this is limited to configuration drift or related anomalies rather than directly detecting the credential access technique itself.
T1003.004prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting powerful utilities and registry access, minimizing privileged accounts, changing defaults) directly block common vectors for SYSTEM-level LSA secret extraction on Windows, but leave open paths such as memory dumping by already-privileged processes or misconfigurations not captured in the templates.
T1003.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized extraction or anomalous access to credential caches (e.g. via Mimikatz or tdbdump altering configs), but this is limited to configuration drift or post-access anomalies rather than reliably detecting the credential access technique itself across all platforms and methods.
T1003.005prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, minimize privileged access, change defaults, restrict utilities, monitor for deviations) directly close many of the configuration states and access paths that let SYSTEM/sudo-level tools reach and dump the credential caches, but the technique can still succeed on systems whose required domain-authentication components legitimately cache credentials and on configurations that do not fully disable every extraction vector.
T1003.006detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including privileged access minimization, disabled insecure services, and password strength evaluation), which can surface anomalous DCSync replication behavior or unauthorized config changes on domain controllers, but this is limited to configuration drift rather than reliably catching the technique in flight or all its variants.
T1003.006prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address points b, c, d, f (disable/restrict unnecessary services, utilities, default passwords, privileged accounts) that are the dominant prerequisites for granting the high-privilege replication rights DCSync requires; the control does not reach every possible misconfiguration vector or post-compromise privilege escalation that could still enable the technique.
T1003.007detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous access or changes involving /proc (e.g. via system management tools), but this is indirect, not guaranteed for credential-gathering patterns, and limited to configuration state rather than runtime technique execution.
T1003.007prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary services/functions, minimize privileged identities, change defaults, restrict utilities) can prevent some credential-storing programs and overly permissive proc access from existing in the first place, but the technique's core reliance on /proc being readable by root or self-processes (and many legitimate services needing to run) leaves a large residual slice untouched.
T1003.008detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing password strengths, assessing activities) can surface unauthorized reads or dumps of /etc/passwd and /etc/shadow as deviations or anomalous activity, but this is limited to configuration-focused tools rather than general process/file-access monitoring and does not guarantee detection of the technique itself.
T1003.008prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary accounts/services, minimize privileged access, change defaults, restrict utilities) stop many common vectors for reaching and dumping the files, but do not block all privilege-escalation or root-level access paths an adversary could still use to read them.
T1005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting utilities and privileged access, hardening defaults) prevent some local data-gathering vectors on the platforms it covers, but leave many others (e.g. standard user file-system access, process memory reads, or collection via permitted interpreters) untouched.
T1006detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled functions/services, restricted utilities, and access rights), which can surface some T1006 usage (e.g. anomalous vssadmin/esentutl invocation or unexpected volume-level changes) but does not broadly instrument for direct volume access or file-system-bypass behaviors across all platforms and tools.
T1006prevents — A.8.9's processes, standard secure-configuration templates and monitoring explicitly require disabling/restricting unnecessary functions/services, powerful utilities, and default parameters, plus enforcing those templates; this stops many of the built-in and third-party utilities (vssadmin, wbadmin, esentutl, PowerShell scripts) named in T1006 from being available or runnable, but leaves a genuine remainder for direct volume APIs, custom low-level drivers, and any privileged code that can still parse NTFS structures even on a hardened baseline.
T1007detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous service enumeration commands or unexpected service changes as part of configuration drift detection, but this is limited to monitored/configured assets and does not broadly target the discovery technique itself.
T1012detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing activities with management tools) can surface anomalous registry queries that deviate from expected secure baselines, but this is limited to monitored/config-managed assets and does not broadly instrument or alert on the technique itself.
T1014detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface rootkit-induced changes to system components or settings (e.g. via integrity checks or anomalous configs), but this is limited to detectable configuration artifacts rather than reliably catching low-level hooking, firmware/bootkit, or stealth mechanisms that evade standard system management tools.
T1014prevents — A.8.9's secure-configuration templates and enforcement (disabling unnecessary services/identities/functions, restricting utilities, minimizing privileged access, monitoring for deviations) stop many user/kernel-level rootkit installation vectors that rely on altering defaults or adding components, but do not reach lower hypervisor/firmware/bootkit layers or all possible hooking techniques.
T1016.001detects — A.8.9's monitoring of configurations and comparison against secure templates can surface anomalous outbound discovery activity (e.g. unexpected ping/tracert/GET from misconfigured hosts), but this is indirect, not purpose-built for the technique, and limited to monitored/configured assets only.
T1016.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can block common discovery vectors such as netsh, wlanAPI calls, or reading credential files on many systems, but this is only a slice: the technique can still run via other unhardened interfaces, admin-required calls, or on systems where Wi-Fi utilities remain necessary.
T1018detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous discovery commands or config changes enabling them (e.g. via management tools), but this is limited to monitored/configured assets and does not broadly detect passive/local methods or all T1018 variants.
T1020detects — A.8.9's monitoring of configurations, deviation detection, and review of activities can surface anomalous automated exfiltration tools or processes that deviate from approved baselines, but this is limited to configuration drift or visible changes rather than reliably catching the exfiltration behavior itself.
T1020.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized mirroring/redirection changes on managed devices and IaaS, but only for configurations within the organization's defined scope and tooling (not all adversary modifications or unmonitored cloud instances).
T1020.001prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring explicitly require disabling/restricting unnecessary functions/services, changing defaults, minimizing privileged access, and addressing deviations; this stops most native traffic-mirroring features (especially in cloud IaaS and many network devices) from being available or left enabled for adversary abuse, but leaves a bounded remainder for post-compromise ROMMONkit/Patch-System-Image modifications that alter the running image outside the configuration-management boundary.
T1021detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength) can surface unauthorized or anomalous remote-service configuration changes or usage, but this is limited to configuration drift rather than runtime detection of the technique itself (e.g. valid-account logins via SSH/RDP).
T1021prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, minimizing privileged access) stop many remote-service vectors on Linux/macOS/Windows/IaaS but leave domain/RDP/SSH/SaaS federation paths that still accept valid accounts intact.
T1021.001detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection (including password strength evaluation), which can surface anomalous RDP usage or unauthorized configuration changes enabling the technique, but this is indirect, not RDP-specific, and limited to configuration state rather than real-time RDP sessions or credential use.
T1021.001prevents — A.8.9's templates and enforcement disable unnecessary services (including RDP where unneeded), restrict powerful utilities and privileged accounts, and change defaults, stopping many RDP abuse paths that rely on enabled services or weak defaults; residual paths remain via explicitly required RDP, valid accounts obtained elsewhere, or misconfigurations not caught by templates.
T1021.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous use of admin shares or privileged access changes, but this is indirect, limited to configuration drift rather than real-time detection of the SMB technique itself, and depends on what the chosen tools actually instrument.
T1021.002prevents — A.8.9's templates and enforcement (disable unnecessary services/identities, restrict powerful utilities and admin access, change defaults, monitor for deviations) directly constrain the admin-share exposure and privileged-account surface that T1021.002 relies on, but the control is silent on SMB protocol configuration, share ACLs, NTLM settings, and patch levels explicitly named in the technique, leaving a genuine minority slice prevented.
T1021.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized DCOM-related changes (e.g. to ACLs, enabled services, or privileged identities), but this is limited to configuration drift rather than reliably detecting in-flight technique use or the broader attack behavior.
T1021.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, minimizing privileged accounts, restricting utilities, changing defaults) can prevent DCOM lateral movement when they remove or harden the exposed COM objects, insecure methods, or excessive privileges the technique relies on, but this is only a slice because the technique can still succeed against required services or accounts that cannot be disabled.
T1021.004detects — A.8.9 requires monitoring configurations with tools to review settings, evaluate password strengths, compare against templates and address deviations; this can surface unauthorized SSH enablement, weak/default auth or anomalous config changes on Linux/ESXi but does not broadly detect the T1021.004 technique of using valid accounts for SSH logins once enabled.
T1021.004prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services, restricting privileged access, changing defaults, minimizing admin identities) can prevent SSH from being enabled or reachable on many systems where it is not required, but the technique remains available on systems that legitimately need SSH (a named, substantial remainder per the control's own guidance on applicability and feasibility).
T1021.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized VNC use or insecure VNC settings (e.g. default creds, unnecessary services), but this is limited to configuration drift rather than reliably detecting in-flight VNC abuse by valid accounts.
T1021.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, changing defaults, minimizing privileged access) can block many VNC abuse vectors on Linux/Windows/macOS, but VNC can still be a required/authorized service for legitimate remote access and the control does not reach credential or brute-force aspects of the technique.
T1021.006detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized use of WinRM (a service often restricted or disabled in secure templates), but this is limited to configuration drift or specific logged actions rather than reliably detecting the technique in flight across all cases.
T1021.006prevents — A.8.9's templates and enforcement (disable unnecessary services/functions, minimize privileged accounts, change defaults, restrict utilities) can prevent WinRM from being available or reachable with valid accounts on managed systems, but this is only a slice: the technique still works where WinRM is required/authorized, on unmanaged assets, or via accounts exempted from the templates.
T1021.007detects — A.8.9's monitoring of configurations (comparing actuals to secure templates, reviewing password strengths, assessing activities) can surface anomalous or unauthorized cloud service access/config changes post-compromise, but this is a minority slice of the technique's core (federated login via valid accounts, CLI/web console, or app tokens) rather than broad detection of the login itself.
T1021.007prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly enforce disabling unnecessary identities/services, restricting privileged access and default credentials on cloud/IaaS/SaaS platforms, which stops many T1021.007 vectors that rely on weak or overly permissive federated accounts; it leaves the remainder of valid on-premises accounts, tokens, and federation misconfigurations that still allow login.
T1021.008detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized or anomalous direct VM connections (especially those altering config or using privileged defaults), but this is limited to configuration-focused tools rather than general behavioral detection of the technique.
T1021.008prevents — A.8.9's defined processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly close the 'by default' privileged-access vectors named in the technique (e.g. default auth, unnecessary services, privileged identities, clock sync, timeouts) for both new and operational cloud VMs, with only the bounded remainder of post-compromise credential abuse left unreached.
T1027prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, baseline monitoring) prevent some T1027 vectors such as command obfuscation via interpreters or environment variables on managed systems, but leave the bulk of file encoding, encryption, compression, splitting, and in-transit obfuscation untouched.
T1027.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous packed binaries or packing utilities as deviations from approved baselines, but this is limited to monitored assets and does not broadly target the technique's evasion artifacts or custom packers.
T1027.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous compilation tools or post-delivery changes on managed systems, but this is limited to configured assets and does not broadly detect the delivery or on-demand compilation of uncompiled source payloads (especially encrypted/embedded or on unmanaged endpoints).
T1027.005detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface post-modification changes or anomalies in tools/assets (including those altered to evade signatures), but this is limited to configuration drift rather than reliably detecting the adversarial indicator-removal act itself.
T1027.011detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous fileless storage (e.g. unexpected Registry/WMI changes or shared-memory artifacts) but only as a minority slice of the broad technique, which also includes in-memory, obfuscated, and non-configuration data staging.
T1027.011prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting utilities, minimizing privileged access, monitoring for deviations) can prevent some common fileless storage vectors such as abuse of WMI, event logs, or unnecessary shared-memory areas, but leaves many others (Registry, /tmp, read-only bypasses, encoded payloads for persistence) untouched.
T1033prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary accounts/services, minimizing privileged identities, restricting utilities, changing defaults) stop some common discovery vectors such as whoami/w/who/show users on hardened systems, but leave many others (process/file ownership, env vars, logs, session info) untouched.
T1036detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface renamed/masqueraded artifacts that deviate from expected baselines (e.g. unexpected file names, locations, or utilities), but this is limited to monitored/configured assets and does not broadly detect all masquerading variants like metadata manipulation or service name abuse.
T1036prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, baseline monitoring with deviation correction) stop many common masquerading vectors like renamed system binaries or abused default services, but do not address all forms such as metadata manipulation, file-type spoofing or location abuse on non-enforced assets.
T1036.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous or non-compliant binaries (including those with invalid signatures that deviate from expected signed templates), but this is limited to configuration drift detection rather than reliably identifying the adversarial mimicry technique itself across all cases.
T1036.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous file/registry names containing the RTLO character when they deviate from approved baselines, but this is limited to monitored/configured assets and does not broadly detect the technique in phishing, unmonitored paths, or non-configuration contexts.
T1036.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface renamed utilities or non-standard paths when they deviate from recorded baselines or expected secure configs, but this is limited to configuration-focused checks rather than runtime process or file-renaming detection.
T1036.003prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) directly constrain the attack surface of legitimate utilities that adversaries rename, preventing many abuse vectors; however, it does not address all renaming or relocation cases (e.g., custom copies of allowed tools or post-enforcement masquerading), leaving a genuine minority slice unaddressed.
T1036.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized task/service names that deviate from baselines, but this is limited to monitored/configured assets and does not broadly target masquerading of descriptions or names across all execution contexts.
T1036.004prevents — A.8.9's standard templates and enforcement of secure configurations (e.g. minimizing privileged identities, disabling unnecessary services/functions, changing defaults) directly constrain the attack surface and naming conventions an adversary can abuse when creating masquerading tasks/services, but this is only a slice of the technique's full scope (e.g. post-compromise renaming of existing tasks, description field manipulation, or evasion via similarity to legitimate ones).
T1036.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including unauthorized changes) can surface masquerading resources that deviate from approved baselines or trusted locations/namespaces, but this is limited to monitored/configured assets and does not broadly detect all naming/location approximations (e.g., subtle Registry mimics or unmonitored containers).
T1036.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, using standard baselines) prevent many naming/location masquerades that rely on abusing defaults, unused services, or overly permissive setups, but do not stop an adversary from deliberately naming a malicious resource after a legitimate one that must remain present and enabled.
T1036.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous file naming or unauthorized changes that realize this technique on managed systems, but this is limited to post-placement detection within the organization's configured assets and does not broadly instrument for the technique itself.
T1036.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous double-extension files that violate hardened settings (e.g. disabled dangerous extensions or restricted file types), but this is limited to configuration drift rather than reliably catching the technique in payloads or user execution paths.
T1036.007prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, change defaults, monitor for deviations) can prevent the OS-level hiding of the true extension that enables the masquerade on Windows, but this is only one slice of the technique's attack surface (user training, email attachment handling, and execution policies lie outside its scope).
T1036.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous file signatures, extensions, or polyglot formatting that deviate from approved baselines, but this is limited to monitored assets under configuration management rather than general detection of masquerading during transfer or execution.
T1036.008prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, using standard secure baselines, monitoring for deviations) can block common masquerading vectors that rely on insecure defaults or altered file-handling behaviors, but do not address all adversary techniques such as polyglot files or manual hex edits during transfer/storage.
T1036.009detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous PPID alterations or daemonization on managed Linux/macOS systems when they deviate from approved baselines, but this is limited to configuration drift rather than reliably catching in-process native API calls or runtime process tree evasion.
T1036.010detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities can surface anomalous/masquerading account names that deviate from approved baselines (especially service or privileged accounts), but this is limited to post-creation configuration checks rather than reliably catching the creation/rename act itself or all naming approximations across the broad platform scope.
T1036.010prevents — A.8.9 requires standard secure-configuration templates that disable unnecessary/untrusted accounts, minimize privileged identities, change defaults, and monitor/enforce them; this directly stops many masquerading service or generic account names (e.g. “admin”, “root”, backup-service) from being viable, but leaves residual cases such as modeled legitimate user accounts or post-compromise renames outside the template scope.
T1036.011detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous process names or deviations in running processes on Linux, but this is limited to what the chosen system management tools actually observe and does not inherently target in-memory argv overwrites.
T1037detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized boot/logon initialization scripts after they are present, but this is limited to monitored assets and does not broadly instrument script execution or persistence behavior across all platforms and use cases.
T1037prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting privileged access and utilities, changing defaults, minimizing admin identities) directly block many common vectors for unauthorized modification or placement of boot/logon initialization scripts, but this is only a slice: the technique can still be introduced via permitted/necessary services, remote administration paths, or post-install changes that follow the mandated change-management process.
T1037.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized registry changes that implement a logon script, but this is limited to configuration drift detection rather than reliably catching the technique's execution or all persistence artifacts.
T1037.001prevents — A.8.9's processes, standard templates and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and host parameter settings, minimizing privileged identities, and enforcing secure baselines (including registry and logon-related settings) over the system lifetime, which stops most paths to unauthorized logon script registration for persistence; the named remainder is techniques that still succeed under an admin account that the control itself permits when necessary.
T1037.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including changes to plist files or default parameters) can surface unauthorized LoginHook modifications after they occur, but this is limited to monitored assets and does not guarantee detection of all instances or the technique's execution.
T1037.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter changes, minimizing privileged access, and enforcing baselines (including via change management), which directly blocks unauthorized plist edits that install a LoginHook; the partial extent follows because the control is a general process (not a macOS-specific mechanism), the technique is deprecated since 10.11, and enforcement depends on how rigorously the organization applies the templates to this exact plist.
T1037.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized logon script changes (especially via GPO/AD), but this is limited to configuration drift rather than reliably catching in-use malicious scripts or the persistence technique itself.
T1037.003prevents — A.8.9's processes, standard templates and monitoring directly enforce disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities and preventing unauthorized configuration changes (including GPO/AD logon-script settings), which stops the adversary from assigning or altering the persistence mechanism; partial because the control is a general process that depends on the implementer actually hardening the specific logon-script vectors rather than a universal mechanism that closes every possible assignment path.
T1037.004detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized RC script changes after they occur on covered systems, but this is limited to a slice (only monitored assets, only post-change, and many lightweight/embedded platforms in the technique's scope lack such tooling).
T1037.004prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary services/functions, restricting privileged changes, enforcing baselines on startup scripts, and correcting deviations, which stops most RC-script abuse at source; the named remainder is lightweight/embedded systems (e.g. ESXi) where the technique is one of the few persistence options and defaults are harder to override.
T1037.005detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) using system management tools, which can surface unauthorized StartupItems artifacts after they are created on macOS, but the clause is scoped to configuration settings rather than boot-time execution artifacts or persistence techniques and does not mandate coverage of this deprecated mechanism.
T1037.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the technique by disabling unnecessary services/functions, restricting privileged changes, enforcing baselines that omit the deprecated StartupItems mechanism, and correcting deviations; the partial remainder is that the control is a general process (not a universal macOS-specific mechanism) whose effectiveness still depends on the rigour with which the implementer disables the vector and on systems where the template was not applied.
T1040detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing with management tools, addressing deviations) can surface anomalous configuration changes or insecure settings that enable sniffing (e.g. promiscuous mode, span ports, insecure services), but this is indirect, limited to config artifacts rather than detecting the sniffing technique in flight or the captured data itself.
T1040prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/ports, minimizing privileged access, changing defaults, restricting utilities) remove many vectors that enable sniffing (promiscuous mode on unnecessary interfaces, exposed management services, default creds on network devices), but do not address all cases such as legitimate span ports, cloud traffic mirroring, or sniffing of unencrypted but authorized traffic.
T1041detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous C2-like traffic or unauthorized config changes enabling exfil, but this is indirect, scope-limited to configured assets, and does not broadly instrument or detect the encoded exfiltration technique itself.
T1046detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing with management tools, addressing deviations) can surface anomalous service discovery activity or unauthorized configuration changes enabling it, but this is indirect, not a dedicated detection of the T1046 technique itself, and limited to monitored/configured assets.
T1046prevents — A.8.9's defined secure-configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) directly stop many forms of network service discovery by removing or locking down the very services, ports, and daemons (e.g. mDNSResponder, unused listeners) that T1046 relies on, but leaves a genuine remainder: discovery of services that remain operationally required or are introduced post-baseline.
T1047detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled unnecessary functions/services and restricted utilities), which can surface anomalous WMI usage on managed Windows systems but does not mandate or guarantee coverage of all WMI abuse vectors (e.g. remote COM APIs, PowerShell, or unmonitored assets).
T1047prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly close the unnecessary-services and default-settings vectors for WMI abuse on managed Windows assets (e.g., disabling unneeded WMI components or changing defaults), but leave the bulk of the technique (legitimate local/remote WMI use via PowerShell, COM APIs, or required admin features) untouched.
T1048detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous protocol use or unauthorized changes enabling alternate exfil channels (e.g. enabled FTP/SMB/curl), but this is limited to configuration drift rather than reliably detecting the exfiltration act itself across all platforms and vectors in the technique.
T1048.003detects — A.8.9's monitoring of configurations, deviation detection from secure templates (e.g. disabling insecure services, restricting utilities, changing defaults), and review of activities can surface some misconfigurations enabling unencrypted exfil (such as enabled insecure protocols), but does not broadly detect the technique's runtime execution or obfuscated data flows over allowed protocols.
T1049detects — A.8.9's monitoring of configurations with management tools, deviation detection from secure templates, and review of activities can surface anomalous use of discovery utilities (e.g. netstat, lsof) or unexpected config changes enabling them, but this is limited to configuration drift or logged activity within the monitored scope rather than reliably detecting the T1049 technique itself across all platforms and execution paths.
T1049prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/utilities, restricting powerful tools, minimizing privileged access, and monitoring for deviations) can prevent many of the listed discovery utilities/commands from being available or executable on hardened systems, but this leaves a large remainder on platforms where such tools are required for legitimate operation or where adversaries can still query via allowed network/CLI features.
T1052.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous USB usage or unauthorized configuration changes enabling exfiltration, but this is limited to configuration drift or logged events rather than reliably detecting the exfiltration technique itself across all platforms and air-gapped scenarios.
T1053detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous scheduled tasks or changes that deviate from secure baselines (e.g. unexpected scheduled jobs), but this is limited to configuration drift rather than reliably catching in-flight abuse, remote scheduling, or masked executions across all platforms and T1053 sub-techniques.
T1053prevents — A.8.9's processes, standard secure-configuration templates and monitoring explicitly require disabling unnecessary functions/services, restricting privileged access and powerful utilities, and enforcing baselines that can block abuse of task-scheduling mechanisms on managed systems; this stops many but not all instances (e.g. containers, network devices, remote scheduling, or unsynchronized new deployments leave real residual).
T1053.002detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled unnecessary services/utilities and restricted privileged access); this surfaces anomalous or unauthorized use of at for scheduling on monitored systems but does not broadly instrument or guarantee detection of all at abuse vectors (e.g., WMI, sudo, or unmonitored platforms).
T1053.002prevents — A.8.9's standard templates and enforcement of secure baselines (disable unnecessary services/utilities, restrict privileged access and default configs, minimize admin identities) directly constrain the at utility and its allow/deny files on Linux/macOS plus the Task Scheduler service on Windows, but the control is a general process that does not mandate removal of at itself and leaves many deployment-specific ways for the technique to remain available.
T1053.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized or anomalous cron/crontab changes on covered assets, but this is limited to configuration drift rather than runtime execution or all adversary uses of cron for persistence.
T1053.003prevents — A.8.9's processes, standard secure-configuration templates and monitoring explicitly require disabling/restricting unnecessary functions/services, minimizing privileged access, changing defaults, and enforcing templates over the asset lifetime; this stops many (but not all) unauthorized cron/persistence schedules at the configuration layer, leaving a slice reachable via permitted services, approved admin accounts, or post-enforcement changes.
T1053.005detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous scheduled tasks or config changes that enable them, but this is limited to monitored/configured assets and does not broadly detect all abuse vectors, hiding techniques, or runtime execution.
T1053.005prevents — A.8.9's standard templates and enforcement of secure baselines (disabling unnecessary services/functions, restricting privileged access and utilities, changing defaults, minimizing admin identities) directly block many common abuse vectors for creating or scheduling malicious tasks, but do not reach all methods (e.g. hidden tasks via direct registry edits under SYSTEM, WMI/PowerShell abuse that stays within allowed functions, or post-compromise changes).
T1053.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized systemd timer/service unit files (especially in privileged paths), but this is limited to configuration drift detection rather than reliably catching all adversary timer abuse for persistence or remote activation.
T1053.006prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary services/functions, restricting privileged access and default parameters, and enforcing baselines on operational systems; this stops many (but not all) systemd timer abuse paths for persistence because user-level timers, certain privileged timers required by the OS, and post-install changes via authorized tools remain feasible.
T1053.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized container orchestration jobs (e.g. unexpected CronJobs), but this is limited to configuration drift detection rather than reliably catching the technique's runtime abuse or malicious payload across all deployment scenarios.
T1053.007prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of baselines (including disabling unnecessary functions/services, restricting privileged access and utilities, and addressing deviations) directly constrain the ability to create or alter container-orchestration CronJobs/Jobs with malicious payloads or persistence settings, but only for systems built and maintained under the control; it does not reach adversary-controlled clusters, misconfigurations outside the defined templates, or post-compromise job creation.
T1055detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous configuration changes or deviations that enable process injection (e.g. unexpected service enablement or privilege alterations), but this is indirect, post-facto, and limited to configuration artifacts rather than the in-process technique itself.
T1055prevents — A.8.9's templates and enforcement of secure baselines (disable unnecessary functions/services, minimize privileged identities, restrict utilities, change defaults) remove some attack-surface vectors that process injection abuses, but do not stop the many platform-specific legitimate APIs and live-process techniques that remain available.
T1055.001detects — A.8.9 requires monitoring configurations with management tools to verify settings, evaluate password strengths, assess activities, and address deviations from secure templates (e.g. disabling unnecessary functions/services, restricting utilities); this can surface anomalous process behavior tied to DLL injection as a configuration deviation or activity, but only for a slice within the defined monitoring scope rather than broadly detecting all technique variants.
T1055.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities and host parameters, minimizing privileged identities) can block common vectors for DLL injection such as unrestricted CreateRemoteThread or writable process memory in non-hardened services, but this is only a slice — many core techniques (reflective injection, module stomping, legitimate DLL hollowing) remain viable in processes that must retain necessary functionality or elevated rights.
T1055.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous configuration changes or unauthorized process-altering activity that enables PE injection, but this is indirect, not guaranteed, and limited to what the chosen monitoring tools actually observe.
T1055.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities/privileges, minimizing admin rights) can block common vectors for PE injection such as unrestricted CreateRemoteThread or writable process memory in non-hardened services, but this is only a slice — the technique can still succeed against live processes that remain permitted under the baseline, and the clause does not reach all injection surfaces or remap requirements.
T1055.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous configuration changes or process/memory states associated with hijacking on monitored assets, but this is limited to configuration drift rather than reliably detecting in-process thread execution or the specific API call sequence.
T1055.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities/parameter settings, minimizing privileged identities, and monitoring for deviations) can block common prerequisites or tools used in thread hijacking on managed systems, but this is a minority slice of the technique's attack surface given its reliance on live-process memory manipulation that secure baselines do not comprehensively stop.
T1055.004detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled unnecessary functions/services and restricted utilities), which can surface anomalous configuration states or changes linked to APC injection setup on Windows systems, but does not directly observe the in-process APC queuing or execution itself.
T1055.004prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities and host parameters, minimizing privileged access) can block common vectors or prerequisites for APC injection on managed Windows systems, but the technique's core reliance on native APIs (OpenThread/QueueUserAPC) in live processes is not directly closed by configuration baselines.
T1055.005detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection against secure templates (including disabled unnecessary functions/services and restricted utilities), which can surface anomalous TLS callback manipulations in monitored Windows processes/configs but only for a chosen slice of assets and without mandating process-injection-specific detection.
T1055.008detects — A.8.9's monitoring of configurations and comparison against secure templates (including disabled unnecessary functions/services, restricted utilities, and privilege minimization) can surface anomalous ptrace-based activity or deviations on Linux systems, but this is limited to configuration drift or specific observable settings rather than reliably detecting the technique in flight or its memory-injection artifacts.
T1055.008prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities/parameter settings, minimizing privileged identities) can block common ptrace-based injection vectors on Linux when those configurations are applied at build and runtime, but the control does not reach ptrace itself, child-process debugging rights that remain after minimization, or runtime attachment to live processes.
T1055.009detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled unnecessary functions/services and restricted utilities), which can surface anomalous configuration changes or process memory tampering on Linux but does not broadly instrument or detect the in-process ROP injection technique itself.
T1055.009prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and parameter settings, minimizing privileged access) can prevent the /proc-based enumeration and memory overwrite steps on many Linux systems, but the technique's reliance on core kernel-provided /proc interfaces that cannot be fully disabled leaves a genuine residual slice
T1055.011detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities can surface anomalous configuration changes or deviations that enable EWM injection (e.g. non-hardened defaults, enabled unnecessary functions/services, or weak privilege settings), but this is indirect, post-facto, and limited to configuration state rather than runtime process injection or the technique itself.
T1055.012detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous process-creation or memory-modification patterns that indicate hollowing (especially via management tools), but this is limited to configuration drift or observable deviations rather than reliably detecting the in-memory technique itself.
T1055.012prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and parameter settings, minimizing privileged identities) can block some hollowing vectors that rely on exposed APIs or permissive process-creation defaults, but the technique's core memory-unmapping and write primitives remain available in any live process spawned by the adversary.
T1055.013detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous configuration states or unauthorized changes that enable TxF abuse in process doppelgänging, but this is limited to configuration artifacts rather than directly detecting the in-memory technique or its execution steps.
T1055.013prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and parameter changes, monitoring for deviations) can block some enablers of TxF abuse or the initial transaction step on managed systems, but the technique's core memory-section manipulation and evasion of monitored APIs is a code-level injection behavior outside the scope of configuration management.
T1055.014detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled unnecessary functions/services and restricted utilities), which can surface anomalous configuration changes or unexpected library mappings involved in VDSO hijacking on Linux, but this is limited to configuration drift rather than reliably catching in-process memory patching or syscall stub hijacking itself.
T1055.015detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous configuration changes or unauthorized alterations that enable ListPlanting (e.g. via insecure defaults or disabled functions), but does not broadly instrument or detect the in-process message-passing, memory copying, or callback execution itself.
T1056detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some input-capture mechanisms (e.g. anomalous hooks or unauthorized credential prompts that alter config), but this is limited to configuration-state anomalies and does not broadly detect the technique's runtime behaviors like API hooking or web portal deception across platforms.
T1056.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface some keylogging implementations (e.g. registry mods, unexpected drivers, or altered system images) but does not broadly detect the dominant in-memory/API hooking or hardware-buffer methods.
T1056.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, etc.) can block several keylogging vectors such as custom drivers, registry mods, or unnecessary hooks, but many methods (API hooking, hardware buffer reads, or Modify System Image) remain possible on hardened systems.
T1056.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized changes that install credential-capturing code on portals (especially post-compromise via admin access), but this is limited to configuration drift rather than reliably catching the initial exploit, the malicious code itself, or runtime credential capture.
T1056.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, changing defaults, minimizing privileged access) can block the post-compromise administrative modification of a web portal or the initial exploitation vector on some externally facing services, but this is only a slice of the technique's attack surface given its reliance on legitimate admin access or web service exploits that hardened configs do not universally stop.
T1056.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous hooking-related changes (e.g. IAT modifications, LD_PRELOAD vars, disabled functions), but this is limited to configuration drift rather than reliably catching in-process API hooks or credential-capturing behavior itself.
T1057detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities performed can surface anomalous process-listing commands or deviations that enable discovery, but this is limited to configuration-state checks rather than real-time detection of the technique itself across all platforms and execution paths.
T1057prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/utilities, restricting powerful tools, minimizing privileged access, and monitoring for deviations) prevent many common process-discovery vectors such as ps, tasklist, Get-Process, and CLI show processes on hardened systems, but leave open the use of native APIs, /proc reads, and other mechanisms that do not rely on disabled utilities.
T1059prevents — Enforcing minimal, hardened command interpreters and scripting environments limits the execution avenues available to adversaries who rely on interactive shells or scripting languages.
T1059detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized use of interpreters (e.g. via unexpected changes or activity logs), but this is scoped only to configuration drift rather than general detection of interpreter abuse in execution.
T1059.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous PowerShell usage or unauthorized changes enabling it, but this is limited to configuration drift rather than reliably detecting in-flight technique execution or abuse via DLL interfaces.
T1059.001prevents — A.8.9's templates and enforcement can disable unnecessary services, restrict powerful utilities, minimize privileged identities, and harden defaults (including PowerShell execution policy or constrained language mode), stopping many abuse vectors on managed Windows systems; however, the technique can still run via .NET DLL interfaces, in-memory execution, or on unmanaged/legacy systems where the control's scope does not reach.
T1059.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized AppleScript usage (e.g. via unexpected script interpreters, osascript invocations, or config changes enabling it), but this is limited to configuration drift rather than reliably catching in-flight technique execution or all abuse vectors on macOS.
T1059.002prevents — A.8.9's secure-configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, and monitoring for deviations) can prevent AppleScript abuse on macOS by removing or locking down osascript, scripting interfaces, and related automation vectors in the baseline, but this is only a slice: the language is a built-in OS capability that cannot be fully excised without breaking legitimate functionality, many execution paths (e.g. inside running apps or via NSAppleScript APIs) remain available, and the control does not address runtime script content or all deployment contexts.
T1059.003detects — A.8.9 requires monitoring of configurations (including via system management tools) to detect deviations from secure baselines such as disabled unnecessary functions/services or restricted utilities; this surfaces some abuse of cmd.exe (e.g. anomalous invocation of powerful commands or batch activity) but only as a minority slice of the technique's surface, not its dominant interactive/remote execution paths.
T1059.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) can prevent cmd.exe from being available or usable for adversary execution on managed Windows systems, but this is only a slice because many legitimate uses, required system functions, and already-installed interpreters cannot be fully removed.
T1059.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized shell usage (e.g. unexpected scripts or privilege escalations), but this is limited to configuration drift rather than general runtime detection of shell abuse across all T1059.004 vectors like interactive C2 sessions or persistence payloads.
T1059.004prevents — A.8.9 mandates secure configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged accounts, and changing defaults, which directly removes or constrains many common Unix shell abuse vectors (e.g. unnecessary shells like bash on minimal systems, default creds, excessive privileges); this is only a slice because the technique remains available where the OS legitimately requires a shell (the dominant case on Linux/macOS/ESXi) and the control does not eliminate all interpreter functionality or block all post-compromise script execution.
T1059.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of VB/VBA/VBScript interpreters or scripts on managed systems, but this is limited to configuration drift or activity within the organization's defined baseline scope rather than reliably detecting all adversary abuse of VB for execution.
T1059.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, changing defaults, minimizing privileged access) can prevent abuse of VB/VBScript/VBA interpreters on managed systems, but this is only a slice: the technique also runs via Office macros, third-party apps, or on unmanaged Linux/macOS endpoints outside the configuration baseline.
T1059.006detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous Python usage or unauthorized interpreter/script changes on managed systems, but this is limited to configuration drift rather than general detection of Python-based execution or malicious behaviors.
T1059.006prevents — A.8.9's templates and enforcement can disable unnecessary services/interpreters, restrict powerful utilities, and minimize privileged access, which removes some avenues for Python abuse on managed systems; however, Python is a common legitimate dependency that cannot be globally removed, leaving the dominant usage vector (and many post-exploitation paths) untouched.
T1059.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized JavaScript interpreters, scripts, or runtime changes on managed systems, but this is limited to configuration drift rather than reliably detecting in-memory JS execution, obfuscated payloads, or drive-by abuse across all platforms and vectors.
T1059.007prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) can prevent many common abuse vectors for JavaScript interpreters and runtime environments, but not all platform-specific or web-based execution paths, leaving a genuine minority slice unaddressed.
T1059.008detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including on network devices), which surfaces unauthorized CLI-driven changes after they occur; this is a genuine but minority slice of the technique (most T1059.008 executions are not configuration deviations and many network devices sit outside monitored/config-managed scope).
T1059.008prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly constrain or remove many of the CLI-abusing opportunities named in the technique (unnecessary services, default credentials, excessive privileges, insecure parameters, unauthorized changes), but the control does not reach every vector (e.g., legitimate admin CLI use after initial compromise or via SSH).
T1059.009detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized API usage that deviates from approved baselines (especially in cloud services), but this is limited to configuration drift or logged changes rather than reliably detecting in-flight malicious command execution via APIs.
T1059.009prevents — A.8.9's processes, standard secure templates (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, changing defaults), enforcement, and monitoring directly constrain many abuse vectors for cloud APIs (e.g. via hardened CLIs, shells, SDKs, and IAM configs in IaaS/SaaS), but cannot remove the APIs themselves or block all authorized administrative paths that adversaries leverage with stolen credentials.
T1059.010detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of AHK/AutoIT interpreters or scripts on managed Windows systems, but this is limited to configuration drift or activity within the monitored scope rather than reliably detecting the technique's execution or compiled payloads.
T1059.010prevents — A.8.9's standard templates and enforcement of secure baselines (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) can prevent many legitimate uses of AHK/AutoIT interpreters or their compiled executables on Windows endpoints, but the technique can still run via allowed/required automation tools, custom scripts, or phishing-delivered payloads that do not violate the baseline.
T1059.011detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous Lua interpreters, scripts, or unauthorized changes enabling the technique, but only for monitored/configured assets and not the runtime execution itself.
T1059.011prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close the slice of this technique that relies on an unnecessary or insecurely-configured Lua interpreter or scripting host (e.g. by disabling unused interpreters, restricting powerful utilities, changing defaults, and detecting deviations), but cannot stop abuse of a Lua interpreter that remains required and correctly configured for legitimate embedded or operational use.
T1059.012detects — A.8.9 requires monitoring of configurations with management tools to detect deviations from secure templates (including disabled unnecessary functions/services and restricted utilities), which can surface abuse of hypervisor CLIs like esxcli/vim-cmd when they alter configs, but this is limited to configuration drift rather than general malicious command execution or the technique's full scope.
T1059.012prevents — A.8.9 mandates secure configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities, and minimizing privileged access; this can prevent abuse of hypervisor CLIs like esxcli/vim-cmd on ESXi when those are treated as unnecessary, but the control does not mandate their removal and many hypervisor deployments require them for legitimate management.
T1059.013detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of container CLIs/APIs (e.g. via management tools or logs), but this is limited to configuration drift or privileged access rather than reliably detecting all malicious command execution in containers.
T1059.013prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close many avenues for unauthorized CLI/API abuse (e.g., disabling unnecessary services, restricting powerful utilities, enforcing least-privilege identities, and detecting deviations), but leave open legitimate admin use of docker/kubectl that adversaries can still leverage once initial access is obtained.
T1068detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous privilege-escalating changes or BYOVD artifacts on monitored assets, but this is limited to configuration drift rather than reliably catching the exploit technique itself or unmonitored components.
T1068prevents — A.8.9's secure-configuration templates and enforcement (disabling unnecessary services/functions, minimizing privileged identities, changing defaults, restricting utilities) stop many vulnerable components from being present or exploitable, but do not address unknown vulnerabilities, BYOVD, or already-installed vulnerable drivers/services that still permit T1068.
T1069detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous permission/group changes or settings after the fact, but this is a minority slice of T1069's broad discovery methods across platforms and does not mandate detection of the technique itself.
T1069prevents — A.8.9's templates and enforcement (minimize privileged identities, disable unnecessary ones/functions, restrict utilities, change defaults) directly stop many permission-group configurations that adversaries would otherwise discover, but this is only a slice of the technique's broad discovery surface across platforms and runtime methods.
T1069.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous permission/group changes or misconfigurations that enable T1069.001, but this is limited to configuration drift rather than directly detecting the discovery technique itself (e.g. net localgroup execution).
T1069.001prevents — A.8.9's standard templates and enforcement (minimizing privileged identities, disabling unnecessary accounts/functions, restricting utilities, changing defaults) directly block many of the permission-group reconnaissance paths the technique relies on, but the control does not reach all discovery vectors (e.g. unmonitored scripts or non-configuration-based enumeration) and is scoped to managed assets rather than every possible execution context.
T1069.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous permission/group enumeration (e.g. via unexpected admin-group reads or config changes), but this is only a minority slice of the technique's execution on Linux/macOS/Windows with no dedicated detection of the listed commands or LDAP queries.
T1069.002prevents — A.8.9's templates and enforcement disable unnecessary identities/services, minimize privileged accounts, change defaults, and monitor for deviations, which directly blocks many discovery paths for domain groups/permissions (e.g. via restricted utilities or hardened configs); it is only a slice because the technique can still run via allowed/necessary accounts, standard commands on unmanaged assets, or post-compromise without altering configs.
T1069.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including privilege-related settings like admin accounts, unnecessary identities, and access restrictions) can surface anomalous permission-group or ACL enumeration activity in managed cloud assets, but only for deviations from the recorded baseline rather than the discovery technique itself, leaving most of the class (especially unaudited or non-configuration-enforced discovery) unreached.
T1069.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly enforce least-privilege settings (minimize admin identities, disable unnecessary accounts/functions, change defaults, restrict utilities) that stop many discovery paths for cloud groups/ACLs, but the control addresses only the configuration surface and leaves runtime authenticated enumeration (e.g. az ad user get-member-groups, GetBucketAcl) reachable via already-compromised low-privilege sessions.
T1070detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous changes to logs, histories or metadata that deviate from secure baselines, but this is limited to configuration artifacts only and does not broadly detect selective indicator removal across all platforms or artifact types.
T1070.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous or unauthorized changes that delete or alter command-history files, but this is only a minority slice of the technique (post-facto file deletion on specific platforms) rather than broad detection of command-history clearing itself.
T1070.003prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, restrict utilities, change defaults, monitor for deviations) can block common ways command-history clearing is enabled or performed, but leaves many platform-specific vectors (e.g. rm ~/.bash_history, Clear-History, manual file edits) reachable on operational systems.
T1070.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous file deletions that deviate from expected secure baselines (e.g. via logs or management tools), but this is limited to configuration-impacting cases rather than general post-intrusion cleanup of dropped artifacts.
T1070.005detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous share-connection removal as a configuration change or suspicious activity on Windows systems, but only for monitored assets and does not broadly instrument the specific T1070.005 technique.
T1070.006detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous timestamp changes on monitored assets as deviations, but this is limited to configuration-focused checks rather than broad file-timestamp forensics or runtime detection of timestomping commands.
T1070.006prevents — A.8.9's standard templates and enforcement of secure configurations (including disabling unnecessary functions/services, restricting utilities, and monitoring for deviations) can block common timestomping vectors such as the `touch` command or user-level API calls on many systems, but this is only a slice because the control does not mandate kernel-level protections, immutable timestamps, or coverage of all platforms/variants where timestomping remains possible.
T1070.007detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations (including changes to network-related settings) can surface some T1070.007 artifacts such as altered firewall/proxy configs or cleared registry/log entries when they deviate from baseline, but this is limited to monitored/config-managed items and does not broadly detect all forms of history clearing across platforms or logs.
T1070.007prevents — A.8.9's defined secure-configuration templates, enforcement processes, monitoring for deviations, and explicit items (disable unnecessary functions/services, restrict powerful utilities, change defaults, minimize privileged access) stop many of the configuration changes and artifacts the technique relies on from being possible or persistent; the remainder is post-compromise deletion of already-written artifacts (e.g. specific registry keys or log entries) that the control does not block.
T1070.008detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized mailbox data changes or clearing commands when they alter monitored mail application or service configs, but this is limited to configuration drift rather than the technique's core data-deletion actions across platforms.
T1070.009detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations (including changes to services, accounts, registry, etc.) can surface cleanup actions that deviate from the secure baseline, but this is limited to monitored configuration items rather than all persistence artifacts or non-configuration evidence removal.
T1070.010detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous relocated malware files that deviate from approved baselines or appear in unexpected locations, but this is limited to configuration-focused tools rather than general file system or behavioral detection of the relocation technique itself.
T1071.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous use of web protocols or deviations enabling their abuse (e.g. via enabled insecure services or utilities), but this is limited to configuration state rather than real-time traffic or C2 behavior itself
T1071.002detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing with management tools, addressing deviations) can surface anomalous protocol usage or unauthorized file-transfer services on monitored assets, but this is limited to configuration drift rather than real-time detection of embedded C2 traffic or protocol abuse that blends with legitimate use.
T1071.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous DNS usage or non-compliant settings that enable tunneling, but this is limited to configuration drift rather than reliably detecting the technique in flight or its embedded traffic.
T1071.004prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can prevent DNS tunneling/beaconing on many platforms by removing or locking down the unnecessary DNS client features or outbound query capabilities that adversaries abuse, but DNS remains an essential administrative service on all listed platforms so the control cannot remove the vector universally.
T1071.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous pub/sub protocol usage or insecure broker configs that enable the technique, but this is limited to configuration drift rather than reliably detecting embedded C2 traffic or the technique in flight.
T1072detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface abuse of deployment tools (e.g. anomalous changes or privileged use), but this is limited to configuration state rather than the technique's full runtime behaviors like RCE or lateral movement across all platforms.
T1072prevents — A.8.9's processes, standard secure-configuration templates (minimizing privileges, disabling unnecessary functions/services/utilities, changing defaults, etc.), enforcement, monitoring, and deviation remediation directly constrain abuse of deployment/configuration tools by limiting the attack surface, privileged access, and unauthorized changes that enable T1072, but do not stop all cases (e.g., already-compromised admin accounts or unaddressed SaaS/network-device tools).
T1074.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous staging behaviors (e.g. unexpected files, registry changes, or privileged copies) but only as a minority slice of the technique's core (copying collected data to a local staging dir via shells or utilities), which is not itself a configuration deviation.
T1078detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews to evaluate password strengths and assess activities, and comparison against target templates (with deviations addressed), which surfaces abuse of valid (including inactive/default/privileged) accounts as anomalous activity or configuration drift.
T1078prevents — A.8.9's templates and enforcement directly close several named slices of T1078 (disabling inactive/unused accounts, changing defaults immediately, minimizing privileged identities, disabling insecure functions/services) but leave the dominant bulk (credential compromise, phishing, reuse, overlap/pivot across valid active accounts) untouched.
T1078.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations (including default accounts, passwords, and privileged identities) surfaces misuse or persistence of default accounts after the fact, but only for monitored assets and only when the deviation is observable in configuration state rather than the initial abuse event itself.
T1078.001prevents — A.8.9 explicitly requires changing vendor default authentication information (e.g. passwords) immediately after installation, defining/reviewing secure configuration templates that disable unnecessary accounts/identities and restrict privileges, and enforcing those templates over the asset lifetime, which stops most default-account abuse vectors named in the technique.
T1078.002detects — A.8.9's monitoring of configurations, comparison to templates, and review of activities/password strengths can surface anomalous use or deviation involving domain accounts (e.g. unexpected privilege changes), but this is indirect, not focused on credential abuse or the technique's core execution vectors like dumping or reuse.
T1078.002prevents — A.8.9's templates and enforcement (minimize privileged identities, disable unnecessary accounts/services, change defaults, restrict utilities) directly stop many ways domain accounts become obtainable/abusable for initial access or escalation, but leave open vectors such as credential dumping (T1003), password reuse from elsewhere, or compromise of already-valid high-privilege domain accounts.
T1078.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength) can surface deviations such as unexpected local accounts or reused defaults, but this is limited to configuration-state anomalies rather than runtime abuse, credential dumping, or lateral movement of the technique itself
T1078.003prevents — A.8.9 mandates standard secure-configuration templates and enforcement processes that explicitly include minimizing/disabling unnecessary local accounts and identities, changing defaults, disabling insecure services, and monitoring for deviations — directly stopping most abuse paths for local accounts (especially unnecessary or default ones) across the technique's platforms and use cases.
T1078.004detects — A.8.9 requires monitoring configurations with tools that compare actual settings against secure templates, which can surface misconfigurations (e.g., overly permissive role assignments or default credentials) that enable T1078.004 but does not broadly detect the technique's use of valid accounts for access, persistence, or lateral movement.
T1078.004prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly close the misconfiguration vectors named in T1078.004 (default creds, excessive privileges, unnecessary services/identities, weak role assignments) for both newly provisioned and live cloud accounts; the bounded remainder is adversary compromise of already-valid accounts via brute-force or phishing, which the control does not address.
T1080detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous changes or tainted files in managed assets (including shared storage), but does not broadly instrument for the technique's execution vectors such as binary infection, .LNK pivots, or user-triggered execution on unmonitored shares.
T1080prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, baseline monitoring with deviation correction) can block common vectors for tainting shared content such as insecure defaults, excessive write permissions, or unmonitored changes on network shares/repositories, but this is only a slice of the technique's attack surface (e.g., does not stop deliberate admin-level binary infection or shortcut-based pivots once access exists).
T1082detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing with management tools, addressing deviations) can surface anomalous system-info-gathering activity or unauthorized configuration changes that enable T1082, but only for a minority slice of the technique's platform-specific execution paths (CLI, APIs, privileged tools) rather than the bulk of discovery behaviors.
T1083prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services/utilities, minimizing privileged accounts, restricting powerful tools, and monitoring for deviations) prevent many common discovery utilities and paths on managed systems, but the technique can still run via permitted commands, custom tools, native APIs, or on unmanaged/legacy assets, leaving a genuine slice unaddressed.
T1087detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing password strengths, assessing activities) can surface anomalous account enumeration or misconfigurations that leak account data, but this is limited to configuration drift rather than reliably catching the technique's core methods like built-in commands, file searches, or API calls on diverse platforms.
T1087prevents — A.8.9's templates and enforcement (disable unnecessary accounts/identities, minimize privileged ones, restrict utilities, change defaults) directly stop several discovery vectors that rely on misconfigurations or exposed accounts, but not those using built-in commands, PowerShell, file searches, or cloud IAM APIs on already-enumerated identities.
T1087.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength and deviations) can surface anomalous enumeration of local accounts when it deviates from expected secure baselines, but this is indirect, not purpose-built for the technique, and limited to monitored/configured assets.
T1087.001prevents — A.8.9's standard templates and enforcement (minimizing/disabling unnecessary accounts, restricting privileged access and utilities, changing defaults) directly stop many of the local-account enumeration vectors named in the technique, but cannot remove all discovery paths (e.g. /etc/passwd reads, id/groups, or dscl on permitted accounts) so the coverage is a genuine slice rather than bulk-with-bounded-remainder.
T1087.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength and deviations) can surface anomalous enumeration commands or unexpected account-listing activity when it deviates from the approved baseline, but this is limited to monitored/configured assets and does not broadly instrument or alert on the technique itself.
T1087.002prevents — A.8.9's standard templates and enforcement of secure configurations (minimizing privileged identities, disabling unnecessary accounts/services, restricting utilities, changing defaults) directly stop many discovery vectors for domain accounts, but the technique can still succeed against required accounts and via legitimate admin tools on managed systems.
T1087.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous configuration changes or privileged access used to run commands like Get-GlobalAddressList, but this is indirect, post-facto, and limited to monitored configuration drift rather than reliably catching the account enumeration technique itself.
T1087.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting powerful utilities and admin access, following change management) can prevent the authenticated PowerShell/cmdlet execution needed to dump GALs on managed Exchange/Office systems, but this is only a slice: the technique works against any reachable authenticated session (including non-managed clients, cloud directories, or accounts with minimal rights) and the control does not govern the information disclosure itself.
T1087.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized account enumeration in managed cloud assets, but this is limited to configuration drift or logged changes rather than directly detecting the discovery technique itself.
T1087.004prevents — A.8.9's secure-configuration templates and enforcement (minimizing privileged identities, disabling unnecessary accounts/services, changing defaults, restricting utilities) directly stop many discovery vectors for cloud accounts, but only for those reachable via misconfigured resources; the technique still succeeds against legitimately enumerated identities under authenticated access.
T1090detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous proxy-related settings or unauthorized proxy tools on managed assets, but this is limited to configuration drift on covered systems and does not broadly detect proxy usage or chaining in network traffic.
T1090.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous proxy setups or unauthorized configuration changes enabling internal proxies, but this is limited to configuration drift rather than reliably detecting the proxy technique in operation across all platforms and use cases.
T1090.001prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close several named slices of the technique (disabling unnecessary services/ports/identities, restricting powerful utilities, removing default credentials, and detecting configuration deviations that would enable proxy tools), but leave the bulk of the class (adversary-installed proxies on already-compromised hosts using common protocols like SMB) untouched.
T1090.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous proxy-related settings or unauthorized port redirects on managed assets, but this is limited to configuration state on inventoried systems and does not broadly detect the external proxy technique in network traffic or on compromised external infrastructure.
T1090.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/ports, restricting utilities, minimizing privileged access, and monitoring for deviations) can prevent many common external proxy setups on managed victim systems, but leaves open adversary use of purchased/compromised external infrastructure outside the organization's configuration domain.
T1091detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes to removable media autorun settings, firmware, or related defaults, but this is limited to post-insertion configuration drift on monitored systems and does not broadly detect the replication technique itself (e.g. media modification off-system or manual copying).
T1091prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, changing defaults, minimizing privileged access, monitoring for deviations) can prevent Autorun abuse and insecure removable-media handling on managed systems, but this is only a slice: the technique also covers physical media manipulation, firmware modification, mobile-to-PC USB infection vectors, and air-gapped networks outside configuration enforcement.
T1095detects — A.8.9's monitoring of configurations and comparison against secure templates (including disabling unnecessary functions/services, restricting utilities, and reviewing deviations) can surface anomalous non-application-layer protocol usage or misconfigurations enabling it (e.g. enabled VMCI or ICMP), but this is limited to configuration state rather than runtime traffic or the technique's full scope across platforms.
T1098detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some account manipulations (e.g. changed permissions, disabled identities, or altered defaults) but does not broadly instrument or detect the full range of T1098 actions across all listed platforms and vectors.
T1098prevents — A.8.9's defined processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close the bulk of T1098 by prohibiting or removing the unnecessary accounts, default credentials, excessive privileges, and insecure settings that adversaries manipulate or preserve (items a–g map tightly to the technique's core actions); the bounded remainder is post-compromise manipulation that still requires initial privileged access the control does not itself gate.
T1098.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized credential additions that alter recorded configurations, but this is limited to post-change detection within monitored assets and does not broadly cover all T1098.001 vectors (e.g., temporary credentials or unmonitored IaaS changes).
T1098.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the bulk of the technique that relies on leaving insecure defaults (e.g. unchanged vendor passwords, unnecessary identities/services, unrestricted utilities, or un-reviewed parameters) that allow credential addition; the named remainder is post-compromise use of already-sufficient permissions on a correctly hardened baseline, which the control does not stop.
T1098.002detects — A.8.9 requires monitoring and regular review of configurations (including comparison to secure templates) to detect deviations such as unauthorized permission changes on email services; this surfaces the technique after it runs on managed assets but is limited to configuration drift rather than real-time detection of the permission-granting action itself or all folder-level variants.
T1098.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary identities/permissions, restricting powerful utilities and default auth changes, and enforcing baselines on services (including cloud/Office 365), which stops the adversary from successfully granting the extra delegate or folder permissions in the first place; the remainder is that the technique can still be executed by an already-privileged account that the baseline did not strip or by post-install changes that evade detection.
T1098.003detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison to secure templates, and addressing deviations (including privilege-related settings like minimizing admin identities and disabling unnecessary ones), which can surface unauthorized role/permission additions in cloud accounts as configuration drift; however, this is limited to monitored/configured assets within organizational scope and does not inherently cover external adversary-controlled accounts or all real-time IAM policy changes.
T1098.003prevents — A.8.9 mandates processes, standard secure-configuration templates and ongoing monitoring/enforcement that explicitly include disabling unnecessary privileges, minimizing admin identities, restricting powerful utilities and changing defaults, which directly stops many of the IAM-policy and role-addition actions named in T1098.003; the remainder is post-compromise use of already-elevated permissions that the control does not reach.
T1098.004detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations (including on SSH/sshd_config and authorized_keys files as part of secure configuration baselines), which surfaces unauthorized modifications after they occur; partial because the clause sets scope by organizational requirements rather than mandating universal instrumentation depth for every possible modification vector (e.g. cloud API, network device CLI).
T1098.004prevents — A.8.9 mandates secure configuration templates, enforcement processes, disabling of unnecessary/insecure identities and functions, immediate change of vendor defaults, and ongoing monitoring/correction of deviations; this directly stops unauthorized modification of authorized_keys and sshd_config on managed Linux/macOS/ESXi/IaaS assets, with the bounded remainder being network-device CLI variants and post-compromise changes outside the configuration baseline.
T1098.005detects — A.8.9 requires monitoring configurations with tools, regular reviews, and deviation detection against secure templates (including privileged access, unnecessary services, and default settings), which can surface unauthorized device registrations as configuration drift in MFA/Intune/Entra ID environments, but this is limited to post-registration discovery within monitored assets rather than reliably catching the enrollment act itself.
T1098.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, and enforcing baselines (including in cloud/device-management services such as Intune/Entra ID); this stops many of the registration paths and bypasses named in the technique, but leaves a genuine remainder when enrollment uses only compromised credentials on an already-authorized account or when the organization's chosen templates still permit self-registration.
T1098.006detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including privilege-related settings like minimizing admin identities and disabling unnecessary ones), which can surface unauthorized role/permission additions in container clusters as configuration drift; this is only a slice of the technique because it is scoped to monitored/configured assets, does not guarantee real-time or comprehensive coverage of all RBAC/ABAC changes (especially cloud-integrated ones), and relies on post-change detection rather than blocking the act itself.
T1098.006prevents — A.8.9's processes, standard secure-configuration templates (minimizing privileged identities, disabling unnecessary functions/services, restricting utilities and defaults), enforcement, change management, and monitoring directly block many of the unauthorized permission/role additions that realize T1098.006; the remainder is the adversary who already holds sufficient privileges to perform the binding or policy change, which the control does not reach.
T1098.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized group additions that deviate from hardened baselines (e.g. no unnecessary privileged groups), but this is limited to post-change detection within monitored assets and does not broadly instrument the adversary technique itself
T1098.007prevents — A.8.9's standard templates and enforcement of secure baselines (minimizing privileged groups, disabling unnecessary ones, restricting powerful utilities, changing defaults) directly stop many of the group-addition actions the technique relies on when applied at install and over lifetime, but the control is silent on runtime change detection or blocking of usermod/net localgroup by an already-privileged adversary account, leaving a genuine residual slice.
T1102detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous use of web services (e.g. unexpected cloud service configs or privileged access), but this is limited to configuration drift rather than reliably detecting the T1102 C2 technique in network traffic or binaries.
T1102.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized changes (e.g. to enable dead drop resolver use on managed assets), but this is limited to configuration state on covered assets and does not broadly detect the technique's use of external legitimate web services for C2 redirection.
T1102.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized configuration changes (e.g. addition of web-service C2 enablers), but does not broadly detect the live bidirectional C2 technique itself once established.
T1102.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized changes that enable one-way C2 (e.g. altered firewall rules, unexpected services, or clock skew), but this is limited to configuration state rather than directly observing the C2 technique in flight or its network behavior.
T1105prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services/utilities, restricting powerful tools, changing defaults, minimizing privileged access) directly prevent abuse of many listed transfer utilities (e.g. tftp, finger, wget, curl, certutil, PowerShell web cmds, package managers) on managed systems, but leave open-ended remainder for C2 channels, web services, cloud sync, lateral transfer, and unconfigured platforms.
T1106prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and privileged access, hardening defaults) can prevent some common/abusable native API surfaces or default exposures on Linux/macOS/Windows, but the technique's core (invoking thousands of legitimate low-level syscalls that remain available and required for normal OS operation) is not blocked.
T1110detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength evaluation) can surface brute-force attempts or related misconfigurations like weak/default passwords, but this is limited to configuration drift and observable activities within monitored systems rather than reliably detecting the guessing technique itself across all platforms and scenarios.
T1110prevents — A.8.9's templates and enforcement disable default/weak passwords, minimize privileged accounts, disable unnecessary services/identities, and monitor for deviations, which stops many brute-force vectors (especially defaults, weak configs, and exposed services); however, it does not mandate strong per-account password policies, lockouts, or MFA that would stop guessing against remaining valid accounts.
T1110.001detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing password strengths, assessing activities) can surface deviations or brute-force attempts on services but is scoped only to configuration drift and selected management tools, not general detection of password guessing across all listed protocols, platforms, or network layers.
T1110.001prevents — A.8.9 mandates standard secure-configuration templates that explicitly include changing default passwords immediately, disabling unnecessary accounts/services, minimizing privileged identities, restricting powerful utilities, and enforcing those templates over the asset lifetime; this directly stops the most common password-guessing vectors (defaults, weak service accounts, exposed management ports) while leaving only the bounded remainder of strong, custom, non-default credentials that still must be guessed.
T1110.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of password strengths can surface weak or default credentials that enable cracking (or already-cracked hashes pulled from config repositories), but this is only a minority slice of the technique's core offline guessing/rainbow-table activity performed on adversary systems.
T1110.002prevents — A.8.9's templates and enforcement directly implement several items (change default passwords, disable insecure identities/functions, minimize privileged accounts, timeout facilities) that stop many common weak or default credentials from ever being present to crack, but leave the bulk of strong-password selection, hashing strength, rate limiting, and post-compromise hash cracking untouched.
T1110.003detects — A.8.9 requires monitoring configurations with tools that review settings, evaluate password strengths, and assess activities performed, which can surface password spraying attempts (especially on managed services/ports) as deviations or anomalous activity, but this is scoped only to configuration-related monitoring rather than general auth or network event detection.
T1110.003prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/ports, change defaults immediately, minimize privileged accounts, restrict utilities) directly stop spraying against many listed management services (Telnet/FTP/SSH/RDP/VNC/MySQL/etc.) and default creds, but leave the bulk of modern SSO/cloud/federated/Office-365 vectors and throttled LDAP/Kerberos attempts untouched.
T1110.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength) can surface anomalous login attempts or deviations on managed services, but this is limited to configured assets under monitoring scope and does not broadly detect credential stuffing across unmonitored services, SSO, or cloud apps.
T1110.004prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/ports, change defaults immediately, minimize privileged accounts, restrict utilities) stop credential stuffing against many of the listed management services and default accounts, but leave the bulk of the technique (replay of valid stolen creds against SSO, cloud, federated, or properly-configured services) untouched.
T1111detects — A.8.9's monitoring of configurations, comparison to templates, and review of activities (including password strength) can surface deviations that enable MFA interception such as keyloggers or altered token configs, but this is limited to configuration-state anomalies rather than reliably catching the technique's core actions like token capture, SMS compromise, or runtime proxying across its full described scope.
T1112detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) to detect deviations, which surfaces unauthorized Registry modifications when they alter monitored security-relevant settings, but this is limited to post-change detection of deviations rather than all Registry interactions or hiding techniques, and depends on what the organization chooses to baseline and monitor.
T1112prevents — A.8.9's standard templates, baseline enforcement, disabling of unnecessary functions/services/utilities, and monitoring/deviation correction constrain many Registry-modifying actions that alter insecure defaults or enable evasion/persistence, but do not stop all legitimate admin-level or authorized changes that adversaries can still abuse post-compromise.
T1114.002detects — A.8.9's monitoring of configurations, deviation detection, and review of activities can surface anomalous access or changes to email service configs that enable remote collection, but this is indirect, limited to configuration drift rather than the technique's credential use or keyword searches themselves.
T1114.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous forwarding rules (especially admin/org-wide ones or post-change), but does not broadly instrument or detect user-created/hidden rules across email clients or MAPI abuse on all platforms.
T1114.003prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services, and monitoring/deviation correction can prevent many common ways of creating or hiding forwarding rules (e.g. via defaults, unnecessary client features, or detectable deviations), but this is only a slice: the technique can still be performed by any authorized user or admin through legitimate interfaces on required email services, which the control does not prohibit.
T1120detects — A.8.9's monitoring of configurations and comparison against secure templates (including disabled unnecessary functions/services, restricted utilities, and device-related parameters) can surface anomalous peripheral discovery activity on managed systems, but this is only a minority slice of the technique's possible implementations across platforms and does not mandate detection of the reconnaissance itself.
T1123detects — A.8.9's monitoring of configurations, deviation detection from secure templates, and review of activities can surface unauthorized changes or anomalous use of audio-capture APIs/devices that violate the hardened baseline, but this is limited to configuration drift or logged activity rather than reliably detecting the technique in execution or the resulting audio artifacts.
T1124prevents — A.8.9 explicitly requires defining, enforcing and monitoring secure configuration templates that include synchronizing clocks and changing default parameters, which directly stops the adversary from freely querying or reading unaltered system time settings via the listed discovery commands and calls.
T1127detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous use of developer utilities or unexpected configuration changes that enable T1127, but this is limited to post-execution deviation detection rather than reliably catching the technique in flight or all variants.
T1127prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, changing defaults) directly remove or lock down many of the signed developer utilities (MSBuild, csc, regsvr32, etc.) that T1127 abuses for proxy execution, but cannot reach every possible utility or all developer workflows an organization may require, leaving a bounded remainder.
T1127.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous or unauthorized use of MSBuild (a build utility whose abuse is a configuration deviation on managed Windows assets), but this is limited to systems under active configuration monitoring and does not broadly instrument or detect the inline-task execution technique itself
T1127.001prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities and host parameters, minimizing privileged access) can prevent abuse of MSBuild as an execution proxy on managed systems, but this is only a slice — the technique can still be used via allowed build processes, unmanaged systems, or configurations that do not fully restrict inline tasks.
T1127.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized ClickOnce usage (e.g. unexpected .application files or changes), but this is limited to configuration drift rather than reliably catching the technique's runtime abuse vectors like proxy execution or startup folder placement.
T1127.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, baseline monitoring with deviation correction) can block many abuse vectors for ClickOnce proxying (e.g. via startup folder persistence, unnecessary .NET components, or weak defaults), but leaves open user-driven execution, web-based delivery, and rundll32 abuse that do not rely on misconfigured services or functions.
T1127.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous use of JamPlus (or .jam files) as a deviation from secure baselines that disable unnecessary tools, but this is limited to monitored/configured assets and does not broadly instrument or detect the proxy execution technique itself.
T1127.003prevents — A.8.9's processes, standard secure-configuration templates and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and enforcing baselines on newly installed and operational systems; this reaches the subset of JamPlus abuse that relies on an enabled, unsandboxed build utility with default or overly permissive settings, but leaves a nameable remainder (JamPlus legitimately required by the build environment, or abuse via .jam files that do not deviate from a hardened baseline).
T1129detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous shared module loads or unauthorized configuration changes enabling them, but this is limited to configuration drift rather than reliably detecting in-process module execution or arbitrary payload loading at runtime.
T1129prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and parameters, minimizing privileged access) can prevent some loading paths or default behaviors that enable arbitrary shared module execution, but the technique's core reliance on legitimate OS APIs (dlopen/LoadLibrary) and arbitrary local/UNC paths is not blocked by configuration management alone.
T1133detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes that enable or expose external remote services (e.g. altered VPN configs, exposed APIs, or new Tor hidden services), but this is limited to configuration drift after the fact and does not broadly detect the technique's use of valid accounts or unauthenticated exposure.
T1133prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the bulk of preventable exposure vectors (unnecessary services, default credentials, excessive privileges, insecure remote-service settings) on newly installed and operational systems; the named remainder is post-compromise adversary configuration of a Tor hidden service (or equivalent) on an already-owned asset, which the control's change-management and deviation-handling mechanisms do not stop.
T1134detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous token-related changes or privilege escalations on managed systems, but this is limited to configuration drift rather than reliably catching in-process token manipulation techniques or non-configuration artifacts like API calls or AD field modifications.
T1134prevents — A.8.9's standard templates and enforcement of secure configurations (minimizing privileged identities, disabling unnecessary functions/services, restricting powerful utilities, changing defaults) directly constrain several common prerequisites and mechanisms for token manipulation on Windows, but leave open other vectors such as runas, AD field manipulation, and post-compromise privileged token theft that the control does not address.
T1134.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous token-related changes or privilege escalations on managed systems, but this is limited to configuration drift or logged activity within the organization's defined scope rather than reliably detecting the in-memory technique itself.
T1134.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting powerful utilities and parameter settings, minimizing privileged access) directly block many common prerequisites and vectors for token theft/impersonation on Windows, but leave open a bounded remainder of legitimate admin processes and tokens that adversaries can still target.
T1134.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous token creation or privilege-impersonation artifacts on managed systems, but this is only a slice (not the bulk) of the technique's possible executions, which are not inherently configuration deviations.
T1134.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary identities/services, restricting powerful utilities and default credentials, minimizing privileged access) close some vectors for creating/using tokens to impersonate but leave intact the core Windows APIs (LogonUser/SetThreadToken) and many legitimate admin scenarios that adversaries can still abuse.
T1134.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous process-spawning or PPID-related configuration changes on managed systems, but this is indirect, limited to configuration drift rather than runtime technique execution or the API abuse itself.
T1134.005detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous SID-History changes on Windows systems under management, but only where those changes are treated as configuration deviations within the monitored scope and tooling; the technique's core (privileged AD attribute manipulation) is not inherently a configuration setting the control mandates detecting.
T1134.005prevents — A.8.9's secure configuration templates and enforcement (minimizing privileged identities, disabling unnecessary functions/services, restricting powerful utilities, changing defaults) constrain the attack surface and make unauthorized SID-History injection harder to achieve or succeed, but do not block the core technique when Domain Admin rights are already present.
T1135detects — A.8.9's monitoring of configurations and comparison against secure templates (including disabling unnecessary services/ports and restricting utilities) can surface anomalous share-enumeration activity or deviations that enable it, but this is limited to configuration-state checks rather than runtime detection of the discovery technique itself.
T1135prevents — A.8.9's templates and enforcement can disable or restrict unnecessary functions/services (including SMB shares) and minimize privileged access that enables discovery, but this is a configurable slice rather than a universal block on the technique across all platforms and legitimate sharing needs.
T1136detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews to evaluate password strengths and assess activities, and comparison against target templates, which surfaces unauthorized account creation as a deviation (especially for privileged, unnecessary or default accounts addressed in the templates).
T1136prevents — A.8.9's processes, standard templates and monitoring explicitly require minimizing privileged identities, disabling unnecessary/insecure ones, restricting powerful utilities and enforcing secure baselines (including after install and over lifetime), which directly stops most Create Account techniques that rely on default or excessive privileges; the bounded remainder is stealthy low-privilege service accounts an adversary can still create within allowed policy.
T1136.001detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) that can surface unauthorized local account creation as a deviation, but this is limited to post-change detection via config tools rather than real-time detection of the technique itself across all platforms and vectors.
T1136.001prevents — A.8.9 mandates standard secure-configuration templates and enforcement processes that explicitly include minimizing privileged identities, disabling unnecessary accounts, changing defaults immediately, and restricting powerful utilities — directly stopping most adversary creation of local accounts via the listed commands and mechanisms.
T1136.002detects — A.8.9 requires monitoring and regular review of configurations (including comparison to secure templates) that can surface unauthorized domain account creation as a deviation, but this is only one narrow slice of the technique's possible vectors and does not broadly instrument or alert on the act itself.
T1136.002prevents — A.8.9's processes, standard templates and monitoring explicitly require minimizing privileged identities, disabling unnecessary accounts, changing defaults immediately, and enforcing secure configurations over the lifetime of systems, which stops many (but not all) unauthorized domain account creations at the policy and enforcement layer.
T1136.003detects — A.8.9 requires monitoring of configurations (including comparison against secure templates) and review of activities performed, which can surface unauthorized cloud account creation as a configuration deviation or anomalous activity, but only for monitored assets and within the scope of configuration-focused tools rather than comprehensive behavioral detection of stealthy or low-privilege account creation.
T1136.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary identities, minimizing privileged ones, changing defaults, and enforcing baselines on cloud services, which stops many (but not all) unauthorized account-creation paths that adversaries use for persistence.
T1137detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized Office add-ins, templates, or registry changes used for T1137 persistence, but this is limited to configuration drift rather than reliably catching all in-memory or Office 365 abuse mechanisms.
T1137prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, changing defaults, minimizing privileged access) can block several Office persistence vectors such as add-ins, template macros, and abused Outlook features when those are treated as insecure defaults or unnecessary services, but this is only a slice because the control is not specific to Office mechanisms, does not reach all documented vectors (e.g. rules, forms, Home Page in O365), and depends on how rigorously templates are defined and enforced.
T1137.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including registry and file changes) can surface abuse of Office template locations or unauthorized macro-enabled templates, but only for monitored assets and does not guarantee detection of all search-order hijacks or remote template pulls.
T1137.001prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, change defaults, minimize privileged identities, monitor for deviations) can block common vectors such as unmodified vendor defaults or unauthorized registry/template changes, but leaves a genuine remainder: the technique can still be realized by an authorized admin or via macro policy that deliberately permits execution.
T1137.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including registry-driven changes) can surface the unauthorized Office Test registry key when it deviates from the hardened baseline, but this is limited to monitored assets and does not guarantee detection of the persistence artifact itself.
T1137.002prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities and default parameters, minimizing privileged access) can block the unauthorized Office Test registry addition on managed systems, but this is only a slice: the technique is a post-compromise persistence method that can still be introduced via other vectors, unmanaged Office installs, or before templates are applied.
T1137.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized Outlook form changes or non-standard mailbox customizations as configuration drift, but this is limited to systems under active config monitoring and does not broadly detect the runtime form-loading or crafted-email execution technique itself.
T1137.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting changes, monitoring for deviations) can block the addition or activation of malicious Outlook forms as an unauthorized configuration change on managed systems, but this is only a slice: the technique can still be introduced via user-level mailbox changes, unmonitored clients, or before templates are applied.
T1137.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous Outlook registry or mailbox settings that implement a malicious Home Page, but this is limited to configuration drift detection rather than reliably catching the technique's execution or the malicious HTML itself.
T1137.004prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and enforcing baselines on software (including Office/Outlook); this stops the legacy Home Page feature from being left enabled or altered to load malicious URLs on many but not all deployments, as the control is a process rather than a universal mechanism and Outlook-specific legacy settings sit in a minority slice.
T1137.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous Outlook rules as configuration drift on Windows/Office systems, but this is limited to monitored assets and does not broadly instrument rule loading or crafted-email triggers.
T1137.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, and monitoring for deviations) can block the addition or persistence of malicious Outlook rules on managed systems, but this is only a slice: the technique can still be introduced via user-level mailbox changes, unmanaged clients, or post-compromise actions that do not alter the baseline configuration template.
T1137.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized add-ins used for persistence (as a config change or deviation), but this is limited to monitored/configured Office assets and does not broadly detect the technique's execution or abuse vectors.
T1137.006prevents — A.8.9 requires secure configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities, and minimizing privileged access; this can prevent many (but not all) Office add-in persistence mechanisms when the add-in is treated as an unnecessary or insecure extension, yet leaves a slice where the add-in is a required business function or introduced post-baseline via authorized change.
T1176detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized or anomalous extensions that deviate from approved baselines, but this is limited to configured/monitored assets and does not broadly address marketplace trust, social engineering installs, or blending into workflows as described in the T1176 prose.
T1176prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, changing defaults) can block many extension installation vectors and reduce the attack surface on host applications, but this is only a slice: it does not stop social engineering, compromised marketplaces, manual loading by authorized users, or abuse of already-installed benign extensions, and the control's scope is general configuration rather than extension-specific policy.
T1176.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including via system management tools) can surface unauthorized browser extension installations or config-file tampering that deviates from the defined secure baseline, but this is limited to monitored/configured assets and does not broadly detect all social-engineering, app-store, or runtime abuse vectors in the technique.
T1176.001prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, change defaults, minimize privileged identities) directly block several installation vectors and persistence mechanisms for malicious browser extensions, but leave open social-engineering, already-compromised-system, and app-store masquerading paths that the technique explicitly relies on.
T1176.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized or anomalous IDE extensions (especially those altering configs or using privileged access), but this is limited to configured/monitored assets and does not broadly detect all installation vectors, side-loading, or benign-extension abuse described in the technique.
T1176.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and enforcing baselines on software (including IDEs and their extensions) over the asset lifetime, which stops many malicious or abused IDE extensions from being installed or remaining active; partial because the control is a general process (not an IDE-specific mechanism), does not reach side-loaded extensions bypassing the marketplace, and leaves residual risk from approved/benign extensions that adversaries can still abuse for persistence.
T1185detects — A.8.9 requires monitoring of configurations with tools that compare actual settings against secure templates and flag deviations (including insecure functions/services, privileged access, and parameter changes), which surfaces some hijacking enablers such as unnecessary browser extensions or altered proxy/privilege settings but does not broadly detect the injection, session inheritance, or runtime pivoting behaviors described in T1185.
T1185prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting privileged access and utilities, minimizing admin rights, changing defaults) directly block several common prerequisites for T1185 such as insecure browser extensions, excessive process privileges (e.g. SeDebugPrivilege), and vulnerable default settings that enable injection or proxy pivoting, but leaves a remainder of memory-corruption or logic vulnerabilities in the browser itself that require patching rather than configuration.
T1187detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous forced-authentication artifacts (e.g. unexpected SMB/WebDAV connections or config changes enabling them) but does not broadly instrument for or guarantee detection of the technique itself.
T1187prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, minimizing privileged access, changing defaults) can block common vectors like .SCF/.LNK files or unnecessary SMB/WebDAV exposure on many systems, but the technique's core (automatic credential send on untrusted resource access) and EFSRPC abuse remain possible on required services or via spearphishing without full prevention.
T1189detects — A.8.9 requires monitoring of configurations with tools that compare actual settings against secure templates and address deviations; this can surface anomalous configuration changes (e.g. unauthorized browser/plugin settings or injected scripts on client endpoints) after the fact, but does not broadly instrument or surface the drive-by delivery, browser exploitation, or initial code execution described in T1189.
T1189prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary functions/services, minimize privileged access, change defaults, restrict utilities, timeout facilities) harden client browsers/endpoints against several exploitation vectors in the drive-by process, but leave open browser/plugin vulnerabilities, user-assisted execution, watering-hole targeting of unhardened clients, and web-content compromises that the control does not address.
T1190detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password strength and activities) can surface misconfigurations that are the exploitable weakness named by T1190, but does not broadly detect exploitation attempts, software bugs, or non-configuration flaws.
T1190prevents — A.8.9's defined secure-configuration templates, enforcement processes, monitoring for deviations, and explicit items (disable unnecessary services/ports, change defaults, minimize privileged accounts, restrict utilities) directly stop many misconfigurations that adversaries exploit in internet-facing apps, but leave software bugs, unpatched vulnerabilities, and certain cloud/container/edge-device exposures outside its scope.
T1195.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous or malicious changes in managed software/configurations (including some supply-chain dependencies once installed), but does not address pre-receipt manipulation of external open-source packages, abandoned packages, typosquatting, or upstream CI/CD components before they reach the organization.
T1195.001prevents — A.8.9's secure-configuration templates, baseline enforcement, change control, and monitoring directly close the slice of T1195.001 that occurs inside the organization's own build/CI-CD environment or on its managed assets (e.g. locking down GitHub Actions, disabling insecure defaults, enforcing approved dependency versions); they do not reach upstream public-package or abandoned-package manipulation that occurs before the organization receives the dependency.
T1195.002prevents — A.8.9's processes, secure baseline templates, change control, and monitoring directly block unauthorized or incorrect changes to software (including source, builds, and distribution mechanisms) in the organization's own supply chain and operational environment, but do not reach upstream third-party manipulation before the software reaches the organization.
T1197detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous BITS job creation or persistence but is scoped only to configuration drift rather than general technique execution or the full set of BITS abuse indicators.
T1197prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can prevent abuse of BITS as an unnecessary background service on many systems, but BITS is a built-in Windows component often required for legitimate updates, leaving a substantial remainder where the technique remains available.
T1199detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous privileged access or unauthorized configuration changes that realize a trusted-relationship breach, but this is limited to post-compromise configuration drift rather than reliably detecting the initial abuse of the third-party relationship itself.
T1199prevents — A.8.9's processes, standard secure-configuration templates, privileged-access minimization, disabling of unnecessary identities/functions, and monitoring of deviations directly constrain the overly-broad or default-elevated third-party accounts and network exposure that enable T1199, but do not govern the upstream business decision to grant the trusted relationship itself or the third party's own internal compromise vector.
T1200detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized hardware additions that alter recorded configurations or introduce new devices/functions, but this is limited to post-introduction detection within managed assets and does not broadly cover physical insertion vectors or all hardware additions (e.g., passive taps or DMA readers).
T1201prevents — A.8.9 requires defining, enforcing and monitoring secure configuration templates that include changing vendor defaults, disabling insecure identities/functions, restricting utilities, and setting timeout/lockout parameters; this directly stops many of the discovery vectors (default creds, weak policy settings, open utilities) on managed systems, but leaves a named remainder (cloud API calls, network-device CLI, and policies set outside the enforced templates) untouched.
T1202detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some misuse of utilities or unauthorized config changes that enable indirect execution, but this is limited to post-facto config drift rather than real-time detection of the technique's stealthy abuse of utilities like Forfiles or ssh.exe.
T1202prevents — A.8.9's defined secure-configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) directly constrain many of the living-off-the-land binaries and config changes that T1202 abuses, but cannot remove all of them (e.g. built-in Windows utilities like forfiles/pcalua.exe or ssh.exe that remain required for legitimate operation).
T1203detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some post-exploitation anomalies or unauthorized changes from T1203 but does not systematically detect the client-application exploit or vulnerability itself
T1203prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, minimizing privileges, changing defaults, restricting utilities) directly close many client-application vectors that rely on insecure defaults or enabled attack surfaces, but leave the dominant slice of T1203 (memory-safety or logic flaws in otherwise-correctly-configured code) untouched.
T1204.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, etc.) can block several execution vectors for malicious files (e.g. .reg, .lnk, .scr, .cpl, .pif, or via unsafe defaults), but leaves the dominant user-driven vectors (.doc, .pdf, .xls, .exe) and social-engineering/masquerading aspects untouched.
T1204.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface malicious or anomalous images/containers that deviate from approved baselines, but this is limited to post-deployment detection within the organization's managed environment and does not broadly detect the upstream upload or naming tricks in public repos.
T1204.003prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services, and monitoring/deviation correction for IaaS/containers directly stop many malicious/backdoored images from being deployed or persisting in operation, but do not address user-driven download of a maliciously named image from a public repo or the upstream upload step.
T1204.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous/malicious libraries present in the environment (especially those altering configs or introducing insecure functions), but this is limited to post-installation detection on managed assets and does not broadly cover library installation or supply-chain compromise itself.
T1204.005prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, minimize privileged identities, change defaults, monitor for deviations) can block many malicious-library installation vectors when the library would require altering a baseline (e.g. new package manager, elevated rights, or non-standard service), but leaves open user-initiated installs of seemingly-benign packages via standard tools that stay inside approved templates.
T1205detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and comparison against target templates to detect deviations (including in network/services/firewall rules that could implement or expose traffic signaling), but this is indirect, does not target the signaling packets/behavior itself, and leaves most of the technique (magic values, port knocking, custom sniffers) outside its scope.
T1205prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/ports, restrict powerful utilities, minimize privileged access, change defaults, monitor for deviations) directly close the common port-knocking / magic-packet listener and the custom software or firewall rules that implement it on managed systems; the named remainder is the adversary's use on unmanaged/embedded devices that first require T1601.001 or on already-open legitimate services that only trigger on a magic value.
T1205.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous port-opening behaviors or firewall changes indicative of port knocking, but this is limited to configuration drift rather than reliably catching the packet sequence, custom sniffers, or raw-socket implementations described in the technique.
T1205.001prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close the common case of unnecessary listening ports, default services and firewall rules that port-knocking abuses, but cannot remove every custom or third-party implementation that listens on already-open ports or uses raw sockets.
T1205.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized socket filter attachments or raw socket changes on managed assets, but the technique's passive/low-activity nature, raw socket usage, and limited visibility (as noted in the source prose) leave substantial undetected cases outside routine config checks.
T1205.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can prevent installation of socket filters on many systems by removing the capability or blocking the elevated changes, but this is only a slice: the technique can still be used on systems that legitimately require raw sockets/libpcap (e.g., network tools, monitoring), where the control's templates do not prohibit it and the adversary has the needed permissions.
T1207detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including privileged identities, unnecessary services, and changes) can surface rogue DC registrations or schema alterations in managed AD assets, but only where they deviate from recorded baselines; the technique's stealth, use of KRBTGT hash, and bypass of logging/SIEM leave substantial portions undetected.
T1207prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and monitoring for deviations) constrain the surface for rogue DC registration in AD environments, but do not block the core requirements of domain/local admin privileges or KRBTGT access that the technique explicitly depends on.
T1210detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface misconfigurations or unpatched remote services that enable T1210, but this is limited to configuration drift rather than reliably detecting active exploitation attempts or the underlying software vulnerabilities themselves.
T1210prevents — A.8.9's secure-configuration templates, enforcement, change control, and monitoring directly close many exploitable misconfigurations and unpatched defaults in remote services (e.g., disabling unnecessary services, changing vendor defaults, minimizing privileged access), but do not address the core programming-error vulnerabilities (e.g., in SMB, RDP, MySQL) whose exploitation is the technique's primary mechanism.
T1211detects — A.8.9's monitoring of configurations (comparing against templates, reviewing deviations, evaluating password strengths, assessing activities) surfaces some stealth-exploitation artifacts that alter configs or leave detectable deviations, but does not address the core technique of exploiting unmonitored components, logging pipeline flaws, or cloud/SaaS vulns that generate no telemetry.
T1211prevents — A.8.9's secure configuration templates, enforcement, monitoring for deviations, and hardening steps (disable unnecessary services/functions, minimize privileged accounts, change defaults) close many exploitable flaws that would otherwise allow stealthy exploitation to hide activity or suppress logging, but do not address unknown vulnerabilities, custom code flaws, or all cloud/SaaS vectors.
T1212detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some exploitation artifacts (e.g. unexpected credential-related config changes or anomalous auth settings), but this is limited to post-exploitation configuration drift rather than reliably detecting the vulnerability exploitation technique itself across its full scope (e.g. in-memory credential dumping, replay attacks, or cloud token forgery).
T1212prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, change defaults, minimize privileges, restrict utilities) stop many exploitable misconfigurations that would let credential-access bugs be introduced or remain live, but do not address the programming errors or validation flaws the technique actually exploits.
T1213prevents — A.8.9's secure-configuration templates, enforcement, and monitoring directly close the 'improperly secured with overly-broad or public access' root cause named in the T1213 description for repositories under organizational control; it does not stop an adversary who already has valid access from mining the stored data.
T1213.003detects — A.8.9 requires monitoring of configurations (including comparison against secure templates) and review of activities performed, which can surface unauthorized access or changes to a code repository's configuration/settings but does not broadly instrument or detect the post-access data collection technique itself.
T1213.003prevents — A.8.9's secure configuration templates, enforcement of baselines (e.g. disabling unnecessary services/identities, restricting utilities, changing defaults), change management, and monitoring directly prevent many misconfigurations that allow initial unauthorized access to internal/private code repositories or extraction of sensitive data from them; however, the control does not address the distinct post-access collection step, SaaS-specific auth bypasses, or all repository-level access controls.
T1213.005detects — A.8.9's monitoring of configurations, deviation detection, and review of activities (including on SaaS/cloud services) can surface anomalous access or changes to messaging apps that expose mined data, but this is indirect, scope-limited by what the org chooses to baseline/monitor, and does not address the core technique of simply reading legitimate chat content.
T1213.006detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous database access or configuration changes that enable mining, but this is indirect, limited to monitored assets, and does not broadly detect the data-querying technique itself.
T1213.006prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary services/identities, restricting utilities and defaults, minimizing privileged access), monitoring for deviations, and change control directly prevent many database misconfigurations that enable unauthenticated or over-privileged access for mining, but do not address all post-authentication queries, application-level logic flaws, or SaaS/PaaS configurations outside organizational control.
T1216detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous or unauthorized changes that enable or indicate use of system script proxies, but this is indirect, post-facto, and limited to monitored assets rather than reliably catching the proxy execution technique itself.
T1216prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) can prevent many signed-script proxies from being available or usable on the system, but this is only a slice: the technique's dominant abuse of default Microsoft-signed LOLBAS scripts that remain required for legitimate Windows functions is not removed.
T1216.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of PubPrn.vbs (e.g. script: protocol abuse), but this is only a slice of possible detection vectors for the technique and not the control's defined purpose.
T1216.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, changing defaults, monitoring for deviations) can prevent abuse of PubPrn.vbs on managed systems by removing or locking down the script and related execution vectors, but this is only a slice: the technique relies on a signed Microsoft script present by default on Windows, later versions already block the remote script: moniker, and the control does not reach all unmanaged endpoints or bypasses that do not alter the configuration itself.
T1216.002detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates; this can surface anomalous use of SyncAppvPublishingServer.vbs (a living-off-the-land signed script) when it deviates from approved baselines, but the clause is scoped to configuration state rather than runtime command-line abuse or PowerShell proxying, leaving most of the technique unseen.
T1216.002prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of baselines (including disabling unnecessary functions/services, restricting powerful utilities, and minimizing privileged access) can prevent the availability or abuse of SyncAppvPublishingServer.vbs on managed systems, but this is only a slice of the technique's attack surface given its legitimate signed status, common presence in Windows, and reliance on other unaddressed factors like PowerShell restrictions.
T1218detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized use of proxy binaries (e.g. via unexpected changes or execution patterns), but this is limited to configuration drift rather than reliably detecting in-flight proxy execution of malicious content.
T1218prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and powerful programs, minimizing privileged access, changing defaults) directly block many LOLBIN/LOLBAS abuse vectors on both Windows and Linux, but not all (some signed proxies remain required for legitimate functions or fall outside the named hardening steps).
T1218.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized .chm-related changes (e.g. unexpected hh.exe use or altered templates), but this is limited to configuration drift rather than reliably catching in-flight or delivered CHM abuse payloads.
T1218.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, and monitoring for deviations) can prevent abuse of hh.exe and CHM execution on managed systems by removing or locking down the attack surface, but this is only a slice: the technique can still succeed via user-delivered CHM on unpatched/legacy systems, unmanaged endpoints, or where the required hardening is not applied.
T1218.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous Control Panel item registrations or .cpl abuse as configuration drift, but this is limited to monitored assets and does not broadly instrument for the technique's execution paths (e.g., command-line/API/proxying).
T1218.002prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, change defaults, minimize privileged access) can block many abuse vectors for control.exe / .cpl proxying, but the technique can still succeed via registered malicious items, renamed DLLs, or phishing delivery that does not violate the enforced baseline.
T1218.003detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities performed can surface anomalous or unauthorized changes (including those that enable CMSTP abuse), but this is limited to configuration deviations rather than reliably detecting the runtime technique of supplying malicious INF files or the resulting proxy execution.
T1218.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, baseline monitoring with deviation correction) can block many CMSTP abuse vectors on managed Windows systems, but leaves open the remainder of signed-trusted binaries, INF-driven COM interfaces, and UAC bypasses that do not violate a hardened baseline.
T1218.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized use of InstallUtil (a powerful utility often restricted in secure baselines), but this is limited to configuration drift or specific monitored events rather than reliably detecting the proxy execution technique itself.
T1218.004prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close the attack surface of unnecessary functions/services, privileged access, and default settings that allow InstallUtil abuse as a signed proxy; the named remainder is that the technique can still be used legitimately for its intended .NET install function on systems that require it.
T1218.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of mshta.exe (e.g. as a deviation from disabled unnecessary functions or restricted utilities), but this is limited to configuration drift rather than reliably catching in-flight proxy execution or malicious HTA payloads.
T1218.005prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can block many mshta.exe abuse paths on managed systems, but the control does not mandate removal of the built-in Windows binary or universal application allowlisting that would stop all instances of this signed, trusted utility.
T1218.007detects — A.8.9 requires monitoring of configurations with tools that review settings, compare against templates, evaluate password strengths and assess performed activities; this can surface anomalous or unauthorized use of msiexec (especially via configuration drift or privileged policy changes like AlwaysInstallElevated), but the clause is scoped to configuration state rather than runtime command-line abuse or proxy execution of arbitrary payloads.
T1218.007prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the AlwaysInstallElevated policy vector and disable unnecessary functions/services that enable msiexec.exe abuse, but leave open the signed-binary bypass of application control that does not depend on insecure defaults or configuration drift.
T1218.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of odbcconf.exe (a living-off-the-land binary) when it deviates from approved baselines, but this is limited to configuration-aware tools and does not broadly instrument or detect the REGSVR abuse technique itself.
T1218.008prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close the technique by disabling or restricting unnecessary functions/services/utilities (including signed binaries like odbcconf.exe that can proxy DLL execution) and by hardening defaults, but the control's scope is limited to what the organization chooses to template and the technique can still run on unmanaged systems or via unsuppressed legitimate use.
T1218.009detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) using system management tools, which can surface anomalous or unauthorized changes to utilities like Regsvcs/Regasm or their invocation, but does not mandate detection of the in-process technique or its proxy execution.
T1218.009prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and enforcing baselines on operational systems, which removes or constrains the attack surface for abusing signed Windows utilities like Regsvcs/Regasm on managed Windows assets (a named slice of the technique); it does not prevent the technique on unmanaged systems, non-Windows platforms, or where an implementer elects not to apply the template to those binaries.
T1218.010detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized use of regsvr32.exe (or deviations enabling its abuse) on managed systems, but this is limited to configuration drift rather than reliably catching in-flight proxy execution, Squiblydoo, or COM hijacking.
T1218.010prevents — A.8.9's standard templates and enforcement of secure baselines (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, changing defaults) can block many abuse vectors for regsvr32.exe (e.g. via application allowlisting or disabling COM/scriptlet loading), but cannot prevent all signed-binary proxy execution or Squiblydoo-style network loads on required Windows components.
T1218.011detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous or unauthorized changes that enable or accompany rundll32 abuse (e.g. altered DLLs, new scripts, or masquerading), but does not broadly instrument or detect the runtime proxy-execution technique itself.
T1218.011prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary functions/services, restrict utilities, minimize privileged access, baseline monitoring) can block many common rundll32 abuse vectors on managed Windows systems, but the technique's legitimate ubiquity, signed LOLBins, script/ordinal/masquerading variants, and reliance on allow-listing leave a large residual slice unaddressed.
T1218.012detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous use of verclsid.exe or unauthorized changes enabling its abuse, but this is limited to configuration drift or specific monitored activities rather than reliably detecting the technique in execution.
T1218.012prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can prevent abuse of verclsid.exe as a living-off-the-land binary on managed systems, but this is only a slice because the technique can still be used via allowed COM/CLSID registrations or on unmanaged/newly-installed systems before enforcement.
T1218.013detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized use of mavinject.exe (a powerful utility) on monitored systems, but this is limited to configuration drift or post-execution indicators rather than reliably detecting the technique in flight or its proxying intent.
T1218.013prevents — A.8.9's standard templates and enforcement of secure configurations (disabling unnecessary functions/services, restricting powerful utilities and host parameter settings, minimizing privileged access) can prevent mavinject.exe abuse on managed systems by removing or locking down the signed LOLBin, but this is only a slice: the technique remains available on unmanaged systems, legacy App-V deployments, or where the utility is required.
T1218.014detects — A.8.9 requires monitoring of configurations with management tools, regular reviews, and deviation detection from secure templates; this can surface anomalous MMC usage or .msc deviations on managed Windows systems but does not broadly instrument for the full range of proxy-execution, CLSID abuse, or command-line variants described.
T1218.014prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services/utilities, and monitoring/deviation correction directly constrain the attack surface of MMC abuse (e.g. restricting snap-ins, .msc execution, privileged use, and custom CLSID registration), but only for managed systems under the templates; unmanaged, legacy, or exempted components remain reachable.
T1218.015detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous Electron app behavior or unauthorized changes (e.g. planted JS or command-line abuse), but this is limited to configuration drift rather than reliably catching in-flight technique execution or malicious content across all Electron-based apps.
T1218.015prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, monitoring for deviations) can block common Electron abuse vectors like arbitrary command execution or planted JS in misconfigured apps, but this is only a slice: the technique's core relies on inherent framework mechanics in legitimate Electron apps (e.g. teams.exe, chrome.exe) that remain allowed and unremovable under the control.
T1219detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized remote access tool installations or changes as configuration drift, but this is limited to post-installation detection of managed assets and does not broadly instrument runtime use or abuse of legitimate remote tools as described in the T1219 prose.
T1219prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close many installation/usage vectors for unauthorized remote access tools (e.g. by disabling unnecessary services/functions, changing defaults, minimizing privileged identities, and detecting deviations), but cannot stop post-compromise abuse of already-permitted legitimate tools or EDR response features that are required for management.
T1219.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous IDE tunneling setups or unauthorized remote-development changes on managed assets, but only for those inside the monitored scope and only after installation — it does not broadly instrument or detect the live tunneling technique itself.
T1219.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the bulk of the technique by disabling unnecessary functions/services, restricting powerful utilities, changing defaults, minimizing privileged access, and enforcing templates that would block IDE remote-tunneling features and auto-launch persistence; residual slice remains for developer-approved IDEs that legitimately require remote capabilities.
T1219.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized or anomalous use of remote desktop software (e.g. unexpected installs or config changes), but this is limited to configuration drift rather than reliably detecting in-flight adversary use of allowed legitimate tools for C2.
T1219.002prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close many avenues for unauthorized installation or insecure use of remote-desktop tools (e.g. disabling unnecessary services, changing defaults, restricting utilities, minimizing privileged accounts), but cannot stop every legitimate RMM tool that is explicitly allowed by policy or required for support functions, leaving a genuine minority slice of the technique reachable.
T1219.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized remote access hardware (e.g. via asset records, clock sync, or peripheral configs) but does not broadly instrument for post-compromise hardware C2 use or bypass of software defenses.
T1219.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling/restricting unnecessary functions/services, minimizing privileged access, changing defaults, and enforcing templates on hardware/software/services (including newly installed and operational systems), which directly stops many legitimate remote-access hardware devices from being introduced or remaining active as C2 channels; partial because the control is scoped to defined/configured assets under organizational management and does not address post-compromise physical installation of unmonitored rogue peripherals that bypass policy.
T1220detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) using system management tools, which can surface anomalous or unauthorized changes such as the introduction of msxsl.exe, non-standard XSL files, or WMI abuse, but this is indirect, post-execution, and limited to what the chosen tools actually instrument on Windows systems.
T1220prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, baseline monitoring) can prevent the msxsl.exe or wmic abuse vectors on managed systems, but the technique's core (XSL scripting standard + living-off-the-land binaries) is not eliminated by configuration management alone.
T1221detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous template references or unauthorized changes in document-handling software/settings on managed systems, but this is limited to configuration state on Windows endpoints under management and does not address the technique's core (adversary-modified document content or runtime fetching).
T1221prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, changing defaults, monitoring for deviations) can prevent some vectors of template injection in managed Office/RTF environments, but the technique primarily abuses document content and external references rather than system configuration, leaving the bulk of the attack surface (user documents, shared content, phishing delivery) untouched.
T1222detects — A.8.9 requires monitoring configurations with tools, regular reviews, and comparison against secure templates to detect deviations (including permission-related changes on files/directories), but this is limited to monitored/config-managed assets and does not broadly surface the T1222 technique in execution or on unmonitored paths.
T1222prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) constrain many of the permission-modification vectors T1222 relies on, but do not stop an already-privileged adversary or malware from issuing the actual ACL-changing commands on managed platforms.
T1222.001detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including via manual analysis), which can surface unauthorized permission/ACL changes on Windows files/directories as configuration drift; this is a genuine but minority slice of the broad technique (most instances occur in-memory, via non-persistent tools like icacls/PowerShell without leaving monitored config artifacts, or outside the scope of configuration-focused tooling).
T1222.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities like icacls/takeown/attrib, minimizing privileged access, and monitoring for deviations) stop many Windows permission modification vectors at the source, but leave open adversary use of allowed tools under already-elevated rights or post-compromise scenarios.
T1222.002detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including permission-related settings like disabling unnecessary identities, restricting utilities, and changing defaults), which can surface adversarial permission changes on Linux/macOS; however, this is scoped to configuration baseline conformance rather than real-time detection of all T1222.002 abuse (e.g., transient or non-baseline chmod/chown), making it a genuine but limited slice.
T1222.002prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, minimize privileged accounts, change defaults, monitor for deviations) stop many of the permission-altering commands an adversary would need to run, but do not block all legitimate chown/chmod use by authorized processes or users, leaving a genuine residual slice of the technique reachable.
T1482detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous enumeration (e.g. nltest or LDAP queries that deviate from baseline) but does not mandate or guarantee detection of the discovery technique itself
T1484detects — A.8.9 explicitly requires monitoring of configurations, comparison against target templates, and review of deviations (including via system management tools and logs of changes), which surfaces unauthorized or anomalous modifications to domain/tenant policy settings such as GPOs or trust relationships; however, this is limited to post-change detection on managed assets and does not address pre-modification reconnaissance, temporary changes that are reverted, or modifications outside the organization's monitored estate.
T1484prevents — A.8.9 mandates processes, standard secure templates, change control, recording and monitoring to enforce correct configurations (including minimizing privileged identities, disabling unnecessary functions/services, changing defaults, and addressing deviations), which stops many unauthorized domain/tenant policy modifications at source in managed environments; however, it is silent on the specific high-privilege vectors (GPO alteration, trust/federation changes, rogue DC setup) that T1484 requires, leaving a genuine minority slice prevented.
T1484.001detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing of deviations; this surfaces unauthorized GPO modifications after they occur on Windows/AD assets under the monitored scope, but only as a minority slice because the clause is scoped to general configuration drift rather than specifically to GPO ACL abuse or the many downstream behaviors it enables.
T1484.001prevents — A.8.9 mandates secure configuration templates, enforcement processes, privileged-access minimization, disabling of unnecessary functions/services, change logging, and ongoing monitoring/comparison against baselines; this directly constrains unauthorized or incorrect GPO changes on Windows/AD systems (a core configuration item), but leaves open the remainder of delegated write permissions, insider abuse of legitimate GPO rights, and post-compromise modification paths that the control's own guidance does not fully close.
T1484.002detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) with tools that can surface deviations such as unauthorized trust modifications in AD, cloud identity tenants or federation settings; this is genuine detection of the technique but only a slice, as the clause's scope is set by what the organization chooses to baseline and monitor rather than mandating coverage of all trust objects or federation changes.
T1484.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the named slice of T1484.002 that consists of unauthorized or incorrect changes to trust settings on managed systems (e.g., default auth info, unnecessary services, privileged identities, clock sync); the remainder is the adversary's ability to add or manipulate trusts via legitimate administrative APIs after gaining initial privileged access, which the control does not stop.
T1485prevents — A.8.9's secure configuration templates, enforcement of baselines, disabling of unnecessary functions/services/utilities, and monitoring for deviations directly prevent many classes of data-destruction malware (e.g., those relying on default credentials, excessive privileges, enabled remote shells, or misconfigured cloud resources) from being able to run or propagate, but do not stop every vector such as those using already-valid high-privilege accounts or custom zero-day exploits.
T1485recovers — A.8.9's monitoring, recording, and corrective-action mechanisms (including backup/restore tooling in the monitoring paragraph) enable recovery of destroyed data from known-good configuration templates or backups once the destruction event has occurred.
T1485.001detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized lifecycle policy changes on cloud storage (a configuration item), but only where those changes fall inside the monitored scope and tools; the clause does not mandate detection of the downstream deletion or the technique itself.
T1485.001prevents — A.8.9 mandates secure configuration templates, enforcement processes, change control, and monitoring that can block unauthorized lifecycle policy changes on cloud storage (e.g. via least-privilege identities, disabled unnecessary functions, and deviation detection), but this is only a slice of the technique's attack surface given its reliance on valid high-privilege credentials that the control does not universally eliminate.
T1486detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized encryption changes or ransomware-induced configuration alterations on managed assets, but this is limited to post-impact config drift rather than reliably detecting the encryption technique itself or its propagation.
T1486recovers — A.8.9 requires recording configurations, monitoring for deviations, and addressing them via automatic enforcement or corrective actions (including backup/restore tools listed under monitoring), which restores correct configurations and data availability after ransomware encryption in most cases, with the named remainder being data written since the last backup.
T1489detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations, which surfaces unauthorized service-stop actions that alter configurations but only for covered assets and not the full breadth of T1489 (e.g., non-config-impacting stops, cloud API disables outside monitored scope).
T1489prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of baselines (including disabling unnecessary services, restricting powerful utilities, and addressing deviations) stop many common forms of T1489 that rely on altering or disabling services from insecure defaults or unauthorized changes, but leave a genuine remainder: adversary use of legitimate admin credentials or APIs (e.g. DisableAPIServiceAccess) that are still authorized under the hardened template.
T1490detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations; this surfaces unauthorized changes that delete/disable recovery features (e.g. vssadmin, bcdedit, snapshot removal) after they occur, but only for monitored/configured assets and not the full breadth of T1490 vectors (e.g. cloud policy changes, offline backups, or non-configuration recovery deletions).
T1490recovers — A.8.9 explicitly requires recording established configurations (including backups/recovery features), monitoring for deviations from secure templates, and addressing deviations via automatic enforcement or corrective actions, which restores proper recovery-oriented settings after an adversary has altered them.
T1491detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes that realize T1491 (e.g. altered web content or defaced resources under management), but this is limited to monitored/configured assets and does not broadly detect the technique's execution vectors like external website compromises or non-configuration-based defacement.
T1491.001detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized changes that realize internal defacement (e.g. altered login messages, wallpapers, or web content), but this is limited to configuration drift on monitored assets and does not broadly detect the technique's execution or all its forms.
T1491.001prevents — A.8.9's processes, standard secure templates, and monitoring/enforcement of configurations (e.g. restricting unnecessary functions/services, minimizing privileged access, locking down defaults and parameter settings) directly stop many of the unauthorized configuration changes that internal defacement requires, but only for a slice of the technique (post-compromise changes to web content, login messages, or desktop wallpaper on managed systems) while leaving other vectors (e.g. direct file writes via existing privileged access or unmonitored assets) untouched.
T1491.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes that realize external defacement on managed assets, but this is limited to configuration drift detection rather than reliably catching the defacement technique itself (especially on external/unmanaged web properties or non-configuration vectors).
T1495detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations can surface unauthorized firmware changes after they occur (especially on managed devices), but this is limited to systems under active configuration management and does not broadly instrument low-level flash/BIOS corruption across all platforms or pre-boot stages.
T1495prevents — A.8.9's secure configuration templates, enforcement processes, disabling of unnecessary functions/services, changing of defaults, and monitoring/deviation correction directly prevent many classes of firmware corruption (e.g. via insecure defaults, unnecessary services, or unauthorized changes on managed devices), but leave a genuine remainder on low-level BIOS/flash writes, out-of-band attacks, and devices outside the configuration-management boundary.
T1496detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations (including via management tools) surfaces unauthorized changes or anomalous resource use that enable hijacking such as cryptomining or proxying.
T1496prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) directly block common hijacking vectors such as unauthorized cryptominers, proxy services, or spam relays on managed systems, but leave open vectors that do not rely on configuration changes (e.g., supply-chain compromise of approved software or abuse of legitimately enabled cloud resources).
T1496.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous resource consumption or unauthorized config changes tied to mining (e.g. new processes, altered services), but this is limited to configuration drift rather than directly detecting in-flight compute hijacking or resource abuse across all platforms and vectors in the technique.
T1496.001prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary services/functions, restricting utilities, minimizing privileged access, changing defaults), change management, and monitoring/deviation correction directly prevent many common installation vectors and runtime footholds for compute hijacking malware (e.g. exposed APIs, unnecessary services, default creds in cloud/containers), but do not stop all post-compromise execution or resource abuse once a system is already breached.
T1496.002detects — A.8.9's monitoring of configurations, deviation detection from secure templates, and review of activities can surface anomalous bandwidth consumption or unauthorized network-related config changes that enable hijacking, but this is limited to configuration drift rather than directly detecting the bandwidth abuse technique itself across all its forms (botnets, proxyjacking, scanning).
T1496.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting utilities, minimizing privileged access, monitoring for deviations) can block common bandwidth-hijacking vectors such as unauthorized malware installation or botnet C2 on managed systems, but this is only a slice: the technique also covers post-compromise abuse of already-authorized bandwidth, proxyjacking of legitimate services, scanning from already-compromised hosts, and IaaS/container scenarios outside the configuration baseline.
T1496.003detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection against secure templates (including for cloud services), which can surface anomalous SMS traffic or configuration abuse in SaaS messaging services, but this is only a minority slice of the technique's core indicators (web form abuse, unexpected SMS volume, billing spikes) rather than dedicated detection.
T1496.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized enabling or changes to SaaS services that enable hijacking, but this is limited to configuration drift rather than runtime abuse or resource-intensive usage after compromise.
T1496.004prevents — A.8.9's processes, standard secure templates, and monitoring/enforcement of configurations (including for cloud services) directly block unauthorized enabling of unused SaaS services or insecure defaults that enable hijacking, but only for the subset of cases where the technique begins with a configuration change rather than credential compromise or already-enabled services.
T1497.003prevents — A.8.9 requires defining, enforcing and monitoring secure configuration templates that explicitly include synchronizing clocks and reviewing/changing other important default security-related parameters; this directly constrains the specific time-property enumeration (uptime, system clock, GetTickCount/GetSystemTimeAsFileTime) used by T1497.003 on managed systems, but leaves a nameable remainder (unmanaged systems, non-clock time sources, or sandbox-specific timing tricks outside the organization's configuration scope).
T1498detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous network configurations or changes that enable or indicate an impending/ongoing Network DoS (e.g. unexpected open services, weakened ACLs, or clock skew aiding reflection), but this is limited to configuration state rather than directly detecting the bandwidth-exhausting traffic itself, and does not cover the bulk of the technique's execution or botnet/spoofing aspects.
T1498.001detects — A.8.9's monitoring of configurations and comparison against secure templates (including disabling unnecessary services/ports and reviewing deviations) can surface anomalous high-volume traffic patterns or misconfigurations that enable flooding, but this is limited to configuration drift rather than reliably detecting the technique in flight across all protocols, botnets, or volumetric scale.
T1498.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface misconfigurations (e.g. open NTP/DNS/memcache reflectors) that enable the technique, but this is only a slice of detection as the technique itself is an in-flight network attack not addressed by config monitoring tools.
T1498.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities, changing defaults, minimizing privileged access) directly close many common reflectors/amplifiers (e.g. open DNS/NTP/memcache on IaaS or Linux), but cannot reach all protocols/vectors or guarantee complete removal of every possible amplifier in all contexts.
T1499detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous resource exhaustion or crash conditions on managed endpoints (especially IaaS/containers), but this is limited to configuration drift or logged changes rather than reliably detecting the full range of endpoint DoS techniques (e.g. botnet-driven, spoofed, or application-layer attacks).
T1499prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary services/functions, restricting utilities/privileges, removing defaults), change control, and monitoring/deviation correction directly prevent many endpoint resource-exhaustion or crash-condition DoS techniques that rely on misconfigured or overly permissive OS/application settings, but leave open the remainder of volumetric botnet, spoofing, or application-layer logic attacks that do not depend on those configuration weaknesses.
T1499.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous resource-exhaustion symptoms or config drift that enables the technique, but this is indirect, not purpose-built for real-time DoS detection, and limited to monitored/configured assets.
T1499.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/ports, restricting functions, minimizing privileged access, following change management) can prevent some OS-exhaustion vectors such as SYN/ACK floods by hardening network stack defaults and limiting exposed listeners, but this is only a slice — the technique's core (exhausting OS-imposed limits like TCP state tables) can still succeed against required services without boundary protections or rate limiting that live in other controls.
T1499.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous resource consumption or unauthorized changes that enable service exhaustion (e.g. enabled renegotiation or excessive functions), but this is indirect, post-facto, and limited to configuration drift rather than the flood/renegotiation traffic itself or most DoS vectors.
T1499.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting access, minimizing privileges, changing defaults) can prevent some exhaustion vectors on managed services, but the technique's core (volumetric HTTP floods or SSL renegotiation on exposed, required web/DNS services) is not addressed by configuration management.
T1499.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous resource-exhaustion patterns tied to misconfigured or altered services, but this is indirect, limited to configuration drift rather than general application-layer flood detection, and depends on the scope of chosen management tools.
T1499.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, etc.) can prevent some resource-intensive features from being available or exposed to abuse, but this is only a slice of the technique's surface (e.g., custom app logic or unavoidable intensive endpoints remain reachable).
T1499.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous crashes or configuration states tied to exploitation on managed assets, but this is limited to post-crash detection of deviations rather than reliably identifying the exploit technique itself (especially zero-days), with many exploitation vectors outside its configuration focus.
T1499.004prevents — A.8.9's secure-configuration templates and enforcement (disabling unnecessary services/functions, minimizing privileges, changing defaults, etc.) stop many exploitable vulnerabilities from existing in the first place, but do not reach zero-day or unknown flaws that still allow application/system crashes.
T1505detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized installed server components as configuration drift or anomalous changes, but this is limited to post-installation detection within monitored assets and does not broadly instrument for the technique's abuse of extensible features.
T1505prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and enforcing baselines on operational systems (including servers), which stops many extensible-component installation vectors; it does not reach every custom or third-party server extension on every platform, leaving a genuine minority slice unaddressed.
T1505.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface malicious stored procedures or unauthorized changes to them (especially via change logs or config drift), but this is limited to configuration-visible artifacts on managed assets and does not broadly detect the technique's invocation or runtime use.
T1505.001prevents — A.8.9's secure configuration templates, change control, and monitoring directly close the common vectors (disabling xp_cmdshell, restricting CLR, removing unnecessary stored procs, enforcing baselines on DB servers) but cannot stop an authorized DBA from intentionally creating a malicious stored procedure under the change-management process.
T1505.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including changes to services/software) can surface a maliciously registered transport agent as a configuration deviation, but this is limited to post-installation detection on monitored Exchange systems and does not broadly cover the technique's registration or runtime invocation.
T1505.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the bulk of the technique by enforcing baselines that disable unnecessary functions/services, restrict powerful utilities and parameter changes, minimize privileged identities, and detect deviations from approved configs on Exchange and related services; the named remainder is custom/developer-registered agents that can still be introduced via authorized change-management paths or on unmonitored instances.
T1505.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous web server files or changes that match a web shell, but this is limited to configuration drift detection rather than reliably identifying the full range of web shell behaviors or placements across all platforms.
T1505.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, changing defaults, minimizing privileges) directly stop many common web shell installation vectors on web servers, but leave open vectors such as authorized-but-abused file upload paths, unpatched application code, or misconfigured permissions that still allow a web shell to be written.
T1505.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including via system management tools) can surface unauthorized IIS component installations as config drift on Windows web servers, but this is limited to post-installation detection within monitored assets and does not broadly instrument for the technique's runtime behaviors or non-config indicators.
T1505.004prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling/restricting unnecessary functions/services, minimizing privileged identities, changing defaults, and enforcing templates on operational systems (including web servers), which stops most malicious IIS component installation vectors; residual slice remains for post-compromise or zero-day bypass of the enforcement itself.
T1505.005detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized changes to termsrv.dll, ServiceDll registry values, or related RDP service settings, but only for monitored assets and only after the fact; it does not broadly instrument the in-memory abuse or payload execution itself.
T1505.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address disabling unnecessary services/identities, restricting powerful utilities, changing defaults, and enforcing baselines on the TermService and its Registry entries, stopping the modification/replacement in many cases; however, it is a process-oriented requirement whose completeness depends on the implementer's templates and does not guarantee coverage of every possible termsrv.dll abuse vector or post-compromise change.
T1505.006detects — A.8.9 requires monitoring of configurations with tools that compare actual settings against secure templates and address deviations; this surfaces unauthorized VIB installations or changes that deviate from the approved baseline on ESXi, but only where the monitoring scope and tooling explicitly cover hypervisor-level VIB records rather than general OS configs.
T1505.006prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address disabling unnecessary functions/services, restricting powerful utilities (e.g. esxcli), enforcing acceptance levels, and detecting deviations that enable malicious VIB installation and persistence; this stops the technique in many cases but leaves a slice for privileged/admin changes or custom templates that still permit it.
T1518detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous software enumeration or unexpected installed software on managed assets, but this is limited to configured/monitored systems and does not broadly target adversary discovery behaviors across all platforms or unmonitored discovery methods.
T1518prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, minimizing privileged identities, changing defaults, monitoring for deviations) prevent many common discovery vectors and reduce attack surface for enumeration, but do not block all legitimate admin or tool-based software queries once access is obtained.
T1518.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous discovery behaviors (e.g. unusual queries for security tools) as deviations from expected config, but this is indirect, not purpose-built for the technique, and limited to monitored/configured assets.
T1518.001prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary services/identities/utilities, changing defaults, minimizing privileges), monitoring for deviations, and change control directly stop many common discovery vectors (e.g. default tools, exposed utilities like netsh/tasklist/reg query, or insecure configs that allow easy enumeration of AV/agents), but leave a real remainder: adversaries can still run the listed commands or Cloud API calls against hardened, non-default security tools that are intentionally present and visible.
T1518.002detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing with management tools, addressing deviations) can surface anomalous backup-software discovery activity when it alters or probes recorded configurations, but this is limited to configuration-specific deviations rather than general process/command-based discovery of backup tools.
T1525detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized changes to images in a registry (especially if those images are treated as configuration-managed assets), but this is limited to post-implant detection within monitored scope and does not broadly cover image registries or provisioning workflows.
T1525prevents — A.8.9's processes, standard secure-configuration templates (including for cloud services), disabling of unnecessary functions/services/identities, and ongoing monitoring/enforcement of defined baselines directly stop many forms of unauthorized image modification or backdooring that would violate those templates, but do not reach every vector (e.g., an already-compromised privileged identity that can push a new malicious image version before enforcement or monitoring catches it).
T1526detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous enumeration of cloud services (especially security/logging ones) as a config or activity deviation, but this is limited to monitored/configured assets and does not broadly instrument discovery behaviors across IaaS/SaaS/identity platforms.
T1526prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of services (incl. cloud) directly block many discovery vectors by disabling unnecessary services/functions, restricting privileged access, and hardening defaults, but cannot prevent all enumeration of intentionally enabled services that an already-authenticated adversary is authorized to query.
T1528detects — A.8.9 requires monitoring configurations with tools to detect deviations from secure templates (including privileged identities, unnecessary services, default credentials, and access rights), which surfaces some token-theft vectors such as exposed service-account tokens or insecure defaults in cloud/container configs, but leaves the majority of T1528 vectors (OAuth phishing, runtime token extraction from memory, IMDS requests after initial compromise) outside configuration monitoring.
T1528prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, minimize privileged access, change defaults, restrict utilities, monitor for deviations) directly block several T1528 vectors such as exposed service-account tokens in containers, insecure CI/CD pipeline configs, and unmanaged cloud identities, but leave social-engineering OAuth flows, post-compromise IMDS token requests, and refresh-token theft untouched.
T1529detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous shutdown/reboot commands or privilege use on managed assets, but this is limited to configuration drift or logged changes rather than reliably catching the full range of in-memory API abuse, remote CLI, or post-impact uses across all platforms.
T1529prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting privileged access and utilities, changing defaults, timeout facilities) block many common command-line or privilege-based shutdown vectors on managed platforms, but leave direct hypervisor/cloud console paths, physical access, and post-compromise API/BSOD techniques (often after other impacts like T1490) unaddressed on the full platform set.
T1530detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface misconfigurations (e.g. overly-broad access) that enable T1530, but this is limited to configuration drift rather than directly detecting the data-access technique itself or credential abuse vectors.
T1530prevents — A.8.9 directly defines, templates, enforces, records, and monitors secure configurations (including IAM, disabling unnecessary access/identities/services, changing defaults, and least-privilege) for cloud services over their lifetime, which stops the misconfigurations that enable unauthenticated or overly-broad access to cloud storage objects.
T1531detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized account manipulations or changes (e.g. via logs or config diffs), but this is limited to configuration-state detection rather than real-time or comprehensive coverage of all T1531 vectors like direct passwd/esxcli use or post-change logoffs.
T1531prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary accounts/identities, restrict powerful utilities, change defaults, monitor for deviations) stop many of the account-manipulation vectors the technique relies on, but cannot block every legitimate administrative path (e.g. Group Policy, esxcli, or SaaS admin APIs) an adversary with valid high-privilege access can still use.
T1535detects — A.8.9 requires monitoring of configurations (including for cloud services) against defined secure templates and addressing deviations, which can surface unauthorized instances in unused regions; however, this is limited to configuration drift detection within scoped assets rather than reliably catching the creation or presence of instances in unmonitored regions as the core of the technique.
T1535prevents — A.8.9 requires defining, enforcing and monitoring secure configuration templates (including disabling unnecessary functions/services, restricting privileged access, and using standard templates reviewed for new threats), which directly constrains the creation and use of cloud instances in unapproved/unmonitored regions; this stops the technique for governed assets but leaves a slice for unmanaged accounts, shadow resources or incomplete enforcement.
T1537detects — A.8.9's monitoring of configurations, deviation detection from secure templates, and review of activities (including cloud services) can surface anomalous configuration changes or privileged actions that enable T1537 transfers, but this is indirect, not a comprehensive or primary detector of the data movement technique itself.
T1537prevents — A.8.9's secure configuration templates, enforcement of least-privilege identities, disabling of unnecessary services/functions, and monitoring for deviations directly close many vectors for an adversary to obtain the cloud-account privileges or API access needed to perform intra-cloud transfers, backups, or sharing links; residual paths remain via misconfigurations outside the enforced templates, compromised legitimate high-privilege accounts, or approved services that still allow sharing.
T1538detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations, which surfaces unauthorized or anomalous dashboard access and configuration-driven information exposure in cloud environments.
T1538prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of settings (including minimizing privileged identities, disabling unnecessary functions/services, restricting utilities, and changing defaults) directly constrain the cloud dashboard's exposure surface and the reach of stolen credentials, but only for a slice of the technique (configuration-dependent enumeration) rather than the bulk with a bounded remainder.
T1539detects — A.8.9's monitoring of configurations, deviation detection from secure templates, password strength evaluation, and change logging can surface anomalous cookie-related files, processes, or settings on managed endpoints (e.g., insecure browser configs or unexpected changes), but this is limited to configuration state rather than runtime theft techniques like JS injection, proxy MITM, or memory scraping across the technique's full scope.
T1539prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, timeout facilities, monitoring for deviations) can prevent some local vectors for stealing cookies from disk/memory/browser configs on managed systems, but do not address JS injection, malicious proxy/AiTM, phishing-driven execution, or SaaS-side session issues.
T1542detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including firmware/BIOS/UEFI settings where part of managed hardware configs) can surface unauthorized pre-OS changes after the fact, but this is limited to what the organization's defined scope and tools reach and does not address the technique's noted difficulty of detection below the OS.
T1542prevents — A.8.9's secure configuration templates, enforcement processes, disabling of unnecessary functions/services, changing of defaults, and monitoring of deviations directly address many pre-OS boot abuse vectors (e.g. UEFI/BIOS settings, boot drivers, unnecessary services) on managed systems, but this is only a slice: the technique can still be introduced via supply-chain compromise, physical access, or unmonitored firmware that falls outside the control's operational lifetime enforcement.
T1542.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations can surface unauthorized firmware changes on managed systems, but this is limited to post-installation operational monitoring of the OS-visible layer and does not address the pre-boot or hardware-level nature of firmware modification on all platforms.
T1542.001prevents — A.8.9's secure configuration templates and enforcement (including minimizing privileged access, disabling unnecessary functions/services, changing defaults, and monitoring for deviations) directly constrain many vectors for unauthorized firmware modification on managed systems, but firmware flashing often occurs outside the OS via physical or pre-boot mechanisms that the control's lifetime processes do not fully reach.
T1542.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized firmware changes on managed components when they deviate from recorded baselines, but this is limited to components under active configuration management and does not broadly instrument or detect sophisticated firmware modification techniques at the component level.
T1542.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, changing defaults, and enforcing baselines on hardware/software/components over their lifetime; this stops many (but not all) component-firmware modification vectors that rely on exposed services, default credentials, or unmanaged settings, while sophisticated supply-chain or pre-installed compromises remain outside its reach.
T1542.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized boot-sector or ESP changes after they occur (especially on managed systems), but this is limited to post-boot observable deviations rather than reliably catching the pre-OS technique itself, with many bootkits evading standard config tools.
T1542.003prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary functions/services, restricting utilities and parameter changes, immediate default password changes, minimizing privileged access), monitoring for deviations, and change management directly block many unauthorized boot-sector/ESP modifications on managed systems, but cannot prevent all raw boot-drive access vectors (especially pre-OS or physical) or unmonitored assets, leaving a genuine minority slice unaddressed.
T1542.004detects — A.8.9 requires monitoring configurations with tools, regular reviews, and comparison against secure templates to detect deviations (including unauthorized firmware changes), but this is limited to post-boot operational monitoring of network devices and does not reliably surface low-level ROMMON firmware overwrites that occur at boot and are designed to be difficult to detect.
T1542.004prevents — A.8.9 requires secure configuration templates, enforcement of defined settings (including disabling unnecessary functions/services, restricting utilities and default credentials), change management, and monitoring/deviation correction; this directly constrains the ability to load unauthorized ROMMON firmware on managed network devices, but leaves a remainder for unmanaged/legacy devices, out-of-band physical attacks, and configurations not covered by the organization's templates.
T1542.005detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized TFTP server settings or boot changes on managed network devices, but this is limited to in-scope assets under configuration management rather than broadly detecting the technique across all platforms or pre-execution manipulation.
T1542.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address hardening boot sequences, disabling insecure services/protocols (including unauthenticated TFTP), changing defaults, restricting privileged changes, and enforcing approved images/configurations on network devices, stopping the adversary's manipulation of the netboot target; partial because the control is a process/template framework whose effectiveness still depends on whether the implementer explicitly disables TFTP boot or unauthenticated TFTP in the templates.
T1543prevents — Requiring documented, change-controlled configurations for system services and processes limits an adversary’s ability to create or modify persistent system-level processes without detection.
T1543detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against secure templates, and addressing deviations, which surfaces unauthorized or anomalous creation/modification of system processes/services/daemons (the core of T1543) on managed assets.
T1543.001detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous launch agent .plist files or changes (especially via management tools), but this is limited to configured/monitored assets and does not broadly instrument for the technique's execution or disguise methods.
T1543.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly constrain the creation/modification of unauthorized .plist files and launch-agent settings on macOS (e.g. via restricted defaults, disabled unnecessary services, change logging, and deviation enforcement), but only for managed systems and authorized changes; user-level persistence techniques, disguised benign-named agents, and unmanaged endpoints remain outside its reach.
T1543.002detects — A.8.9 requires monitoring of configurations with tools that compare actual settings against secure templates and address deviations; this surfaces unauthorized systemd .service file creations, modifications, or generator-driven changes after they occur, but only for configurations inside the monitored/compared scope rather than all possible service file locations or dynamic generator activity.
T1543.002prevents — A.8.9 mandates processes, standard secure-configuration templates, change control, recording, and monitoring that directly block unauthorized creation or modification of systemd .service files (including defaults, unnecessary services, privileged identities, and generator outputs), closing the bulk of the technique on Linux while leaving a bounded remainder in dynamic generator edge cases or unsynchronized user-level units.
T1543.003detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against secure templates, and addressing deviations, which surfaces unauthorized or anomalous Windows service creations/modifications (including Registry changes) after they occur.
T1543.003prevents — A.8.9's defined secure-configuration templates, enforcement processes, baseline monitoring, and explicit items (disable unnecessary services/identities, restrict powerful utilities, change defaults, minimize privileged access) directly stop most unauthorized service creation/modification paths on Windows; residual slice remains for adversary abuse of legitimately required services or BYOVD of signed drivers.
T1543.004detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized Launch Daemon plist changes or misconfigurations after they occur, but this is scoped only to monitored assets and does not broadly instrument for the technique itself.
T1543.004prevents — A.8.9's processes, standard secure-configuration templates (disabling unnecessary services/identities, restricting utilities and defaults, enforcing baselines on new/operational systems) and monitoring/deviation-correction directly stop many unauthorized Launch Daemon creations or plist modifications on macOS, but the control is silent on macOS-specific plist locations, RunAtLoad semantics, and privilege checks for daemon installation, leaving a genuine slice of the technique unaddressed.
T1543.005detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized modifications to container services like Docker, Podman, or kubelet after they occur, but this is limited to configured assets under management and does not broadly instrument runtime behavior or all possible persistence vectors on the Containers platform.
T1543.005prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly block unauthorized or insecure modifications to container services (Docker/Podman/kubelet configs, defaults, unnecessary functions, privileged access, restart policies) on both new and operational systems, with only a bounded remainder for post-compromise or unmonitored edge cases.
T1546detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some T1546 abuses (e.g. unauthorized trigger modifications or anomalous scheduled tasks), but this is limited to configuration drift rather than runtime event triggers or cloud functions, leaving most of the class (per its broad description across platforms) unreached.
T1546prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services/identities, and monitoring for deviations directly constrain many common T1546 mechanisms (e.g. WMI event subscriptions, logon triggers, scheduled tasks, cloud functions) by preventing their unauthorized creation or alteration, but this is only a slice: the control does not reach all platform-specific triggers, does not guarantee complete enforcement on every asset, and leaves residual abuse possible via permitted mechanisms or post-compromise changes.
T1546.001detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized Registry changes to file associations after they occur, but this is limited to monitored assets and does not broadly instrument for the technique's execution or persistence use.
T1546.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and Registry-accessible parameters, minimizing privileged identities, and enforcing baselines that would block unauthorized default-file-association changes on managed Windows systems; this stops the technique for the covered slice but leaves a remainder for unmanaged endpoints, user-installed software outside templates, or configurations altered before enforcement.
T1546.002detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) using system management tools, which can surface unauthorized registry or screensaver changes indicative of this technique, but only where those changes fall inside the monitored scope and review cadence rather than guaranteeing detection of all instances.
T1546.002prevents — A.8.9 requires standard secure-configuration templates that explicitly include invoking inactivity timeouts and (by extension) disabling insecure defaults such as an unsigned or malicious screensaver binary; this stops the adversary from successfully setting the four registry values that realize T1546.002 on managed systems, but the clause only governs configurations the organization defines and enforces, leaving unmanaged endpoints, personal devices, and post-compromise registry writes outside its reach.
T1546.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous WMI event subscriptions or changes (e.g. via logs or config diffs), but this is limited to configuration-focused tools rather than general behavioral detection of the technique's execution or MOF compilation.
T1546.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, and enforcing baselines that can block WMI event subscriptions as an unnecessary or high-privilege mechanism, but this is only a slice of the technique's attack surface (e.g., it does not reach all possible legitimate subscriptions or post-installation adversary actions).
T1546.004detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized modifications to shell config files (e.g. /etc/profile, ~/.bashrc) after they occur, but this is limited to monitored assets and does not broadly instrument for the technique's execution or runtime effects.
T1546.004prevents — A.8.9 mandates secure-configuration templates, enforcement processes, disabling of unnecessary functions/services/identities, and monitoring+correction of deviations; this directly constrains the ability to insert malicious commands into shell config files (especially system-level ones), but user-level dotfiles in home directories remain reachable under normal user permissions and the control does not mandate content-level integrity checks or universal read-only enforcement on every possible shell script.
T1546.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous trap-based persistence (e.g. unexpected shell changes or privileged alterations) but only as a slice of observable config drift, not a dedicated or comprehensive detector for the technique itself
T1546.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized binary header changes on managed systems, but this is limited to a slice (e.g., monitored assets and detectable deviations) rather than broadly covering the macOS-specific technique.
T1546.006prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities/parameter settings, minimizing privileged access, and monitoring for deviations) constrain many vectors for binary modification on macOS, but leave a genuine minority slice (ad-hoc header edits to already-installed binaries via available tools, especially where templates are not fully enforced on every endpoint or new software version) unreached.
T1546.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized Netsh helper DLL registry changes as configuration drift, but this is limited to post-change detection within monitored assets and does not broadly instrument the technique's execution or persistence trigger.
T1546.007prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and host parameter settings, minimizing privileged access, and enforcing baselines (including registry and network-related settings); this stops many but not all ways an adversary can register a malicious Netsh helper DLL, leaving a genuine minority slice reachable via permitted netsh.exe use or post-install changes.
T1546.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized changes to accessibility binaries, registry pointers, or related settings after they occur, but this is limited to configuration-focused tools and does not broadly instrument the runtime technique or pre-login triggers themselves.
T1546.008prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) directly block the most common binary-replacement and registry-pointer methods of hijacking accessibility features, but do not address all variants such as IFEO debugger injection or signed in-place modifications that can still succeed under a conformant hardened baseline.
T1546.009detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized Registry changes to AppCertDLLs or anomalous DLL loads, but this is limited to configuration drift or post-facto review rather than real-time detection of the technique in flight, and many implementations focus only on approved baselines without covering the full abuse vector.
T1546.009prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations) can block the Registry modification and DLL registration required for this technique on managed systems, but the control is silent on the specific AppCertDLLs key, does not guarantee complete coverage of all processes or unmanaged changes, and leaves a substantial remainder for techniques that abuse already-permitted mechanisms.
T1546.010detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized Registry changes enabling AppInit_DLLs (a configuration item), but this is limited to post-change detection of the mechanism itself rather than reliably catching the technique's execution or malicious DLL behavior across all cases.
T1546.010prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address points b, c, d, and f (disable unnecessary functions/services, restrict powerful utilities and parameter settings, change defaults immediately, minimize privileged identities), which close the registry-based AppInit_DLLs abuse vector on managed Windows systems; the remainder is unmanaged systems, non-Windows platforms, and post-compromise changes that evade the templates.
T1546.011detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized shim installations or registry/file changes, but this is limited to configuration drift rather than runtime technique execution or all abuse vectors (e.g. persistence via legitimate shims).
T1546.011prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, minimize privileged access, change defaults, monitor for deviations) directly block many common vectors for installing or abusing shims (e.g. via default sdbinst paths, registry writes, or unauthorized changes), but cannot prevent all custom shim abuse that still requires admin rights or follows approved change processes.
T1546.012detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized IFEO Registry changes or deviations after they occur, but this is limited to monitored assets and does not broadly instrument for the technique's runtime abuse or silent exit mechanisms.
T1546.012prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services, and monitoring of deviations directly constrain the IFEO Registry abuse vector on managed Windows systems, but the control is silent on the specific debugger/silent-exit keys, does not reach all unmanaged or newly introduced executables, and leaves a nameable remainder of privilege-escalation and persistence paths that can still be planted via other means.
T1546.013detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized changes to PowerShell profile scripts on Windows systems, but this is limited to monitored assets and does not broadly detect the technique's execution or persistence use.
T1546.013prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, change defaults, monitor for deviations) directly close the most common vectors for unauthorized profile.ps1 modification on Windows, but do not reach every profile variant, every administrative override path, or every runtime bypass, leaving a genuine minority slice unaddressed.
T1546.014detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized rule files or plist changes that enable emond abuse, but this is limited to configuration drift rather than runtime detection of the technique itself.
T1546.014prevents — A.8.9's secure configuration templates, enforcement of baselines, disabling of unnecessary services/functions, and monitoring/deviation correction directly constrain the ability to write or alter emond rules in /etc/emond.d/rules/ or the com.apple.emond.plist LaunchDaemon config on macOS, but this is only a slice of the technique (e.g., does not block all persistence vectors or initial rule injection by privileged actors).
T1546.015detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized Registry changes that implement COM hijacking, but this is limited to post-change detection of configuration drift rather than reliably catching the stealthy or remote TypeLib/script variations described.
T1546.015prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and host parameter settings, minimizing privileged identities, changing defaults, and detecting deviations in Registry-stored configurations; this stops many (but not all) COM hijacking Registry changes that replace legitimate references with malicious ones.
T1546.016detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous installer scripts or post-install changes on managed systems, but this is limited to post-execution detection within the organization's configuration scope and does not broadly detect the technique's delivery or pre-install abuse vectors.
T1546.016prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, changing defaults, and monitoring for deviations) constrain many installer-script abuse vectors on Linux/macOS/Windows, but do not block all modified legitimate installers or post-install actions that inherit elevated rights when users explicitly authorize them.
T1546.017detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized udev rule changes (a configuration item), but does not broadly instrument or detect the resulting malicious execution or background process bypass.
T1546.017prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and enforcing baselines on operational systems (including Linux), which would block unauthorized udev rule addition/modification in most cases; however, it is only a slice because the control is governance-oriented, does not mandate specific udev hardening, and cannot stop a root-privileged actor who bypasses the defined templates.
T1546.018detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized .pth or sitecustomize.py files placed in Python paths as config drift, but this is limited to monitored assets and does not guarantee detection of the technique's execution or all placement vectors.
T1546.018prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services/identities, and monitoring/deviation correction can prevent placement or persistence of malicious .pth/sitecustomize.py hooks in managed Python environments, but this is only a slice: the technique can still be introduced via unmanaged Python installs, unmonitored directories, or post-baseline changes outside the configuration management process.
T1547detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including privileged identities, unnecessary services, and changes) can surface some T1547 artifacts such as unauthorized autostart entries or registry/boot changes after they occur, but this is limited to post-placement detection on managed assets and does not cover kernel modifications, pre-compromise adversary setup on network devices, or all platforms/mechanisms in the technique.
T1547prevents — A.8.9's defined secure-configuration templates and enforcement processes directly close the bulk of T1547 by disabling unnecessary autostart mechanisms, restricting privileged access and default parameters, and preventing unauthorized configuration changes that would install boot/logon persistence.
T1547.001detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) which can surface unauthorized changes to run keys, startup folders or related registry values, but this is limited to configuration-focused tools and reviews rather than broad runtime detection of the persistence technique itself.
T1547.001prevents — A.8.9 mandates secure-configuration templates and enforcement that explicitly include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and changing defaults — directly blocking many of the registry/run-key/startup-folder locations and values an adversary would abuse for T1547.001; it does not reach every possible abuse (e.g., policy-driven Run keys or masqueraded legitimate entries) so the coverage is a genuine but minority slice of the technique.
T1547.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized Registry changes to Lsa\Authentication Packages (a configuration item), but this is only one narrow slice of the technique's possible abuse vectors and does not broadly instrument for the persistence behavior itself.
T1547.002prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and registry-adjacent settings, minimizing privileged identities, and enforcing baselines that would block unauthorized LSA Authentication Packages registry changes on managed Windows systems; this is only a slice because the control is governance-oriented, depends on template rigor and enforcement completeness, and does not reach every possible abuse vector or unmanaged asset.
T1547.003detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized registry changes to W32Time\TimeProviders\ (a configuration item), but this is limited to post-change detection of the persistence mechanism rather than reliably catching the technique in flight or all variants.
T1547.003prevents — A.8.9's processes, standard templates, and monitoring explicitly require disabling/restricting unnecessary functions/services, minimizing privileged identities, changing defaults, and enforcing secure configs (including via change management), which directly blocks unauthorized registration of a malicious time-provider DLL at the named registry path; this is only a slice of the full technique because the control is silent on the specific boot-time loading mechanic, on non-Windows platforms, and on post-enforcement detection of sophisticated bypasses.
T1547.004detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) which can surface unauthorized Registry changes to Winlogon keys, but this is only one slice of possible detection vectors and the clause does not mandate instrumentation depth or real-time alerting on the specific abuse.
T1547.004prevents — A.8.9 requires secure configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities and default parameters, and monitoring for deviations; this directly constrains abuse of the listed Winlogon registry keys when they are treated as part of the managed configuration surface, but the control is silent on the specific abuse vector, on user-specific HKCU modifications, and on runtime enforcement of every possible registry write.
T1547.005detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized Registry changes that add SSPs, but this is limited to post-boot configuration drift detection rather than reliably catching in-memory LSA loading or API-driven abuse.
T1547.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, and enforcing baselines that include registry keys; this stops unauthorized SSP additions in the bulk of managed systems but leaves a remainder for unmanaged devices, legacy exceptions, and post-install changes that slip before detection.
T1547.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized kernel module or extension loads that deviate from the defined baseline, but this is limited to monitored/configured assets and does not broadly instrument for malicious LKM/kext rootkit behaviors like hiding or tampering.
T1547.006prevents — A.8.9 mandates secure-configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and monitoring for deviations; this directly stops many malicious LKM/kext loads on Linux/macOS but leaves a bounded remainder (signed/approved modules, runtime loading of permitted drivers, and platform-specific SIP bypasses).
T1547.007detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized plist modifications that enable the technique, but this is limited to monitored assets and does not broadly instrument the login or plist-parsing events themselves.
T1547.007prevents — A.8.9 requires secure configuration templates and enforcement processes that include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and monitoring for deviations; this reaches the macOS plist-based auto-reopen mechanism as a configuration item that can be hardened or reverted, but leaves a remainder for user-driven or post-enforcement modifications outside enforced baselines.
T1547.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized LSASS driver additions or modifications on Windows systems as configuration drift, but this is limited to post-change detection within monitored assets and does not broadly instrument LSASS driver loading or LSA behavior itself.
T1547.008prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address points c, d, f (default creds), and g in its own guidance, which close the most common vectors for adding/replacing LSASS drivers; the remainder is post-compromise driver injection or replacement that bypasses those templates.
T1547.009detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized shortcut changes in startup locations or templates (especially if baselines prohibit them), but this is limited to monitored/configured assets and does not broadly instrument for the technique's execution or abuse vectors like masquerading or LNK modifications.
T1547.009prevents — A.8.9's secure configuration templates, enforcement processes, disabling of unnecessary functions/services/identities, and monitoring/deviation correction directly block many unauthorized shortcut creations or modifications in startup locations and system configs, but do not reach all vectors such as post-compromise in-memory edits, LNK browser extensions, or masquerading-based indirection.
T1547.010detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized port monitor Registry changes or DLL loads at boot, but this is only a slice of what the technique can do and the control's scope is not comprehensive for runtime or non-configuration aspects.
T1547.010prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and host settings, minimizing privileged identities, and enforcing baselines that would block unauthorized registry writes or DLL registration for port monitors at install and over lifetime; this stops the technique for many but not all cases (e.g., custom/required print services or post-baseline privileged changes).
T1547.012detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized print processor additions or registry changes, but this is limited to post-installation detection within monitored scope rather than reliably catching all variants or the initial API-driven installation.
T1547.012prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter changes, enforcing baselines on newly-installed and operational systems, and addressing deviations; this stops many (but not all) of the registry/API/install-directory vectors for malicious print-processor registration at boot.
T1547.013detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) which can surface unauthorized or deviant XDG autostart .desktop entries in /etc/xdg/autostart or ~/.config/autostart, but this is only one slice of possible detection vectors for the technique and depends on the monitoring tools chosen.
T1547.013prevents — A.8.9 requires defining, enforcing and monitoring secure configuration templates (including disabling unnecessary functions/services, restricting privileged access and utilities, and reviewing deviations), which can prevent many unauthorized autostart modifications on Linux but leaves a remainder for user-writable ~/.config/autostart entries, runtime changes, and incomplete enforcement across all XDG-compliant environments.
T1547.014detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized Registry changes to Active Setup keys as configuration drift, but this is limited to post-change detection within the scope of monitored assets and does not broadly instrument for the technique's execution or masquerading aspects.
T1547.014prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter changes, minimizing privileged identities, and enforcing baselines that would block unauthorized Active Setup Registry modifications on managed Windows systems; this is only a slice because the control is governance-oriented, applies mainly to assets under organizational templates, and does not reach unmanaged endpoints, post-install adversary actions, or all possible abuse vectors.
T1547.015detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against target templates, and addressing deviations; this can surface unauthorized login-item additions that alter the approved configuration on macOS, but only for changes within the monitored scope and not the addition technique itself or items added via Service Management Framework that are invisible in standard views.
T1547.015prevents — A.8.9 requires secure configuration templates and enforcement processes that include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and monitoring for deviations; this directly constrains the ability to add unauthorized login items (a form of autostart/persistence configuration) on macOS, but only for systems built and maintained under the templates and does not reach all possible addition vectors or pre-existing items.
T1548detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface some abuse of elevation mechanisms (e.g. unexpected privileged changes or insecure defaults), but this is limited to configuration state rather than runtime technique execution across all listed platforms and methods.
T1548prevents — A.8.9 mandates secure configuration templates and enforcement processes that directly implement the hardening steps (disable unnecessary services/identities, minimize privileged accounts, change defaults, restrict utilities, enforce timeouts) that close the most common elevation-control bypass vectors named in T1548; the bounded remainder is platform-specific or logic-flaw abuses that templates do not address.
T1548.001detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized setuid/setgid bits or changes (via logs, tools, or deviation detection), but this is limited to configured/monitored assets and does not broadly detect in-flight abuse or all discovery of vulnerable binaries.
T1548.001prevents — A.8.9's processes, standard templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and enforcing secure baselines (including via change management), which stops many unsafe setuid/setgid bits from being introduced or persisting on binaries; however, it does not reach all cases such as adversary-controlled malware setting bits on its own files or all feasible legacy/required setuid binaries.
T1548.002detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) plus addressing deviations, which can surface UAC-related misconfigurations (e.g. non-highest protection level) after they exist; this is genuine but only a slice, as most T1548.002 bypasses are code/execution techniques rather than detectable config drift.
T1548.002prevents — A.8.9 mandates secure configuration templates and enforcement that include disabling unnecessary services/functions, minimizing privileged accounts, changing defaults, and restricting powerful utilities — directly blocking several named UAC-bypass vectors (weak UAC level, auto-elevated COM objects, eventvwr.exe, unnecessary services) on managed systems; it does not reach all bypass methods (e.g. process injection into trusted processes or lateral movement with known admin creds).
T1548.003detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against secure templates, and addressing deviations (including sudoers changes or insecure defaults like !tty_tickets or excessive timestamp_timeout), which surfaces many but not all abuse vectors of this technique (e.g. runtime credential caching without config change is outside its scope).
T1548.003prevents — A.8.9 explicitly requires secure-configuration templates and enforcement that include minimizing privileged identities, disabling unnecessary/insecure ones, restricting powerful utilities and host parameters, changing vendor defaults immediately, and invoking automatic logoff timeouts; these directly close the poor sudo/sudoers configurations (NOPASSWD, !tty_tickets, excessive timestamp_timeout, editable defaults) the technique abuses, with only a bounded remainder for mis-implemented or post-template changes.
T1548.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous elevated-privilege executions or unauthorized configuration changes on macOS, but this is limited to post-facto detection of deviations rather than reliably catching the API abuse in real time or across all cases.
T1548.004prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, changing defaults, and monitoring deviations) constrain the attack surface and some abuse vectors for AuthorizationExecuteWithPrivileges on macOS, but do not stop the deprecated API itself or its prompt-based escalation when called from modified/masqueraded legitimate programs.
T1548.005detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including privileged access, unnecessary functions, and default settings), which can surface misconfigurations enabling temporary elevated cloud access; however, this is limited to configuration drift detection rather than runtime abuse of just-in-time/impersonation/pass-role mechanisms, and the control's scope is general rather than cloud-specific.
T1548.005prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly close the misconfiguration paths (excessive JIT/impersonation/pass-role grants, unnecessary privileged identities, insecure defaults) that enable T1548.005; the bounded remainder is post-compromise abuse of an already-correctly-configured JIT mechanism.
T1548.006detects — A.8.9 requires monitoring configurations with management tools, comparing against secure templates, and addressing deviations (including privileged access, unnecessary services, and default settings that could enable TCC database abuse); this surfaces some TCC manipulation on managed macOS systems but is limited to configuration drift rather than runtime TCC daemon or database tampering techniques.
T1548.006prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, and enforcing baselines that would block many TCC database manipulation paths (e.g. default auth changes, SIP-related hardening, unnecessary services), but the control does not reach all adversary techniques such as abusing already-granted permissions via process injection or MDM overrides.
T1550detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous use or theft of alternate auth material (e.g. unexpected Kerberos tickets or token changes) but only as a minority slice of the technique's full scope across credential access and lateral movement.
T1550prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary identities/services, restricting privileged access and utilities, changing defaults, timeout facilities) close some vectors for acquiring/using stolen alternate auth material (e.g. via reduced attack surface or weaker persistence), but do not address core theft of hashes/tickets/tokens or their use in lateral movement.
T1550.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface misconfigurations that enable token theft or misuse (e.g. overly permissive defaults, unsynchronized clocks, or excessive privileged identities), but does not broadly detect the technique of using a stolen token for API access once issued.
T1550.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, minimizing privileged access) close some vectors for token theft or misuse in managed environments, but the technique's core (stealing/using already-issued OAuth or cloud tokens) lives in identity/authorization layers untouched by configuration management.
T1550.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities can surface anomalous configuration changes or deviations that enable PtH (e.g. weak password settings or excessive privileged accounts), but this is indirect, post-facto, and limited to configuration state rather than directly detecting the technique's hash capture or authentication use.
T1550.002prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary accounts, change defaults immediately, minimize privileged identities, restrict powerful utilities) directly stop many PtH vectors that rely on weak or overly permissive local accounts and unchanged vendor defaults, but leave the dominant NTLM hash-theft + lateral-use path on managed domain accounts untouched.
T1550.003detects — A.8.9 requires monitoring and regular review of configurations (including comparison to secure templates) to detect deviations such as insecure identities, unnecessary services, or altered parameters that could enable PtT, but this surfaces only configuration-level drift rather than the technique's runtime use of dumped Kerberos tickets.
T1550.003prevents — A.8.9's secure configuration templates and enforcement (minimizing privileged accounts, disabling unnecessary services/identities, changing defaults, restricting utilities) reduce attack surface for credential dumping and ticket theft that enable PtT, but do not stop ticket capture, forgery (golden/silver), or use of valid stolen tickets for lateral movement.
T1550.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous session-cookie usage or insecure cookie-related settings (e.g. weak defaults, missing timeouts) on covered assets, but this is limited to configuration drift rather than reliably detecting the post-theft import or use of a stolen cookie in an adversary-controlled browser.
T1550.004prevents — A.8.9's secure configuration templates and enforcement (e.g. minimizing privileged identities, disabling unnecessary functions/services, changing defaults, timeout facilities) can prevent some session-cookie issuance or lifetime scenarios on managed IaaS/SaaS platforms, but the technique's core (stealing and replaying an already-issued valid cookie) is not blocked by configuration management.
T1552detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations (including password strength evaluation) can surface some unsecured credential artifacts that deviate from secure baselines, but this is limited to monitored/configured items and does not broadly detect adversary searches for credentials in arbitrary locations or artifacts.
T1552prevents — A.8.9's secure configuration templates and enforcement (disabling insecure defaults, restricting unnecessary functions/services/utilities, minimizing privileged identities, immediate default password changes) stop many common unsecured-credential storage patterns from being introduced or persisting on managed systems, but leave real residual paths such as application-specific credential stores, custom code that writes plaintext creds, or misconfigurations outside the enforced templates.
T1552.001detects — A.8.9's monitoring of configurations (comparing actuals to secure templates, reviewing password strengths, addressing deviations) surfaces insecure credential storage in config files and related artifacts, though it does not broadly detect all adversary searches or non-config-file instances.
T1552.001prevents — A.8.9's secure configuration templates and enforcement (disabling insecure defaults, restricting unnecessary functions/services, changing vendor defaults, minimizing privileged access) directly stop many classes of credential files from being created or left in insecure locations on newly installed and operational systems; however, it does not reach user-created credential files, embedded passwords in custom source/binary code, or post-deployment credential storage in logs/configs that fall outside the defined templates.
T1552.002detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing password strengths, addressing deviations) can surface insecure credential storage in the Registry when it deviates from secure baselines, but this is limited to monitored/configured assets and does not broadly detect adversary queries or all insecure storage instances.
T1552.002prevents — A.8.9's standard templates and enforcement of secure configurations (disable unnecessary services/identities, change defaults immediately, minimize privileged access, restrict utilities) directly stop many insecure credential-storing Registry entries from being created in the first place; the remainder is credentials legitimately stored by third-party software or auto-logon mechanisms that the control does not prohibit.
T1552.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous credential-related commands or insecure history settings on managed systems, but this is limited to configuration drift rather than reliably detecting the adversary technique of searching history files post-compromise.
T1552.003prevents — A.8.9's standard templates and enforcement of secure configurations explicitly include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and changing defaults, which can prevent history files from being created, retained, or made readable by adversaries on Linux/macOS/Windows; this is only a slice of the technique because the control does not mandate clearing history, using non-persistent shells, or blocking all credential-in-history cases.
T1552.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password strength and privileged access) can surface some insecurely stored private keys that deviate from the defined secure baseline, but this is limited to monitored/configured assets and does not broadly detect active adversary searches or key exports.
T1552.004prevents — A.8.9 mandates secure configuration templates and enforcement that include disabling unnecessary services/identities, restricting powerful utilities, changing defaults, and monitoring for deviations; this directly stops many common insecure storage locations and default exposures of private keys on Linux/Windows/network devices, but leaves residual cases (e.g. keys legitimately created later by apps, user errors, or post-install changes not caught by monitoring).
T1552.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous access or misconfigurations enabling T1552.005 (e.g. unrestricted metadata endpoint), but this is limited to configuration drift rather than reliably detecting the technique in flight or the SSRF vector on IaaS instances.
T1552.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address items such as disabling unnecessary services/identities, restricting powerful utilities and default parameters, and enforcing baselines on cloud services, which can block direct local queries to the metadata API from an instance; however, it does not address the distinct SSRF vector that reaches the same API from outside the instance.
T1552.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface GPP XML files containing embedded credentials on SYSVOL as a misconfiguration, but this is only a slice of the technique's post-exploitation discovery and decryption methods rather than broad detection of the credential-hunting behavior itself.
T1552.006prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, restrict powerful utilities, change defaults, monitor for deviations) directly close the insecure GPP storage that lets any domain user read/decrypt embedded credentials, but only for new or re-baselined systems; legacy GPP XMLs already published to SYSVOL remain readable until manually removed.
T1552.007detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface misconfigurations like exposed or overly permissive container APIs that enable T1552.007, but this is limited to configuration drift rather than directly detecting the credential-gathering technique itself or its runtime execution.
T1552.007prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the insecure-defaults and excessive-permissions vectors (e.g., default auth, unnecessary services, privileged identities) that enable unauthenticated or over-privileged access to Docker/Kubernetes APIs, but cannot reach every container-specific credential-gathering path once a pod's service account or runtime misconfiguration already exists.
T1552.008detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unsecured credential sharing or related misconfigurations in chat services when those appear as configuration drift, but does not broadly instrument or detect the adversary technique of harvesting credentials from chat messages themselves.
T1553detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password strength and activities) can surface some subversions of trust controls that manifest as configuration changes, but most of T1553 (e.g. stolen certs, permission mods, registry changes not tied to baseline deviation) sits outside its scope.
T1553prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, monitoring for deviations) directly block several common T1553 vectors such as registry/permission tampering or running with insecure defaults, but do not address code-signing certificate theft/creation or all platform-specific trust subversions.
T1553.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password strength and activities) can surface unauthorized changes to Gatekeeper-related settings or attributes on macOS systems, but this is limited to configuration drift rather than reliably catching the technique's runtime bypasses, logic errors, or non-quarantined file executions.
T1553.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and enforcing baselines that can block common Gatekeeper-bypass vectors (e.g. quarantine-flag evasion via curl/USB, unchecked file types, or post-first-launch writes), but the control is a general process that does not mandate the specific macOS Gatekeeper mechanisms or address all listed subversion methods such as logic errors or notarization overrides.
T1553.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized changes or unexpected signed binaries that deviate from approved baselines, but this is limited to configured assets and does not broadly instrument for certificate theft, adversary-created materials, or bypass of signing policies.
T1553.003detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) with tools that can surface unauthorized changes to registry keys, DLLs, or other components; this would detect many SIP/trust-provider hijacks after they occur, but the clause's scope is general configuration drift rather than specifically the narrow cryptographic trust-provider attack surface, leaving a genuine remainder.
T1553.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, changing defaults, and enforcing baselines on operational systems; this reaches the registry and component-configuration slice of SIP/trust-provider hijacking but leaves the DLL-search-order (T1574.001) vector and post-install tampering of already-deployed components as a real remainder.
T1553.004detects — A.8.9 requires monitoring and regular review of configurations (including comparison against secure templates) plus addressing deviations, which can surface unauthorized root-certificate installation as a config change or deviation on managed systems; it is not required for all platforms, all certificate stores, or non-configuration vectors such as supply-chain pre-installation.
T1553.004prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, change defaults, monitor for deviations) directly block common vectors for installing a root cert (e.g. via utilities, supply-chain defaults, or unauthorized changes), but do not reach all platform-specific mechanisms such as the macOS security command or cloned cert reinstallation after initial compromise.
T1553.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized changes that enable MOTW bypass (e.g. altered extraction/mount settings or disabled SmartScreen defaults), but this is limited to configuration state rather than reliably catching the in-memory or runtime technique itself across all container formats.
T1553.006detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against target templates, and addressing deviations; this surfaces unauthorized policy changes that disable code signing enforcement, but only for monitored/config-managed elements and not the kernel-memory or recovery-mode vectors.
T1553.006prevents — A.8.9's defined secure-configuration templates and enforcement processes directly close the policy-modification vector by mandating that code-signing enforcement settings (e.g. DSE, SIP, signed-DLL rules) be set, recorded, monitored and automatically restored when altered, but the clause only governs configurations chosen by the organization and leaves developer/test-mode exceptions, kernel-memory attacks, and recovery-mode changes as a genuine residual slice.
T1554detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including via management tools) can surface unauthorized binary modifications or version changes on monitored assets, but this is limited to configuration drift rather than reliably catching in-memory patches, entry-point hooks, or pre-execution binary infections across all platforms and techniques.
T1554prevents — A.8.9's secure configuration templates, enforcement processes, change management, monitoring for deviations, and practices like disabling unnecessary functions/services and changing defaults directly stop many unauthorized binary modifications (e.g. via restricted utilities, enforced baselines, and detected drift), but leave open adversary techniques like in-memory patching, supply-chain compromise of templates, or post-modification version-locking that the clause does not address.
T1555detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities (including password strength evaluation) can surface deviations or anomalies tied to credential access in managed assets, but this is limited to configured/monitored systems and does not broadly detect the technique's core search of arbitrary password stores.
T1555prevents — A.8.9's secure configuration templates and enforcement (disabling insecure identities, changing defaults immediately, restricting utilities, minimizing privileged access) stop many common password-store discovery paths on managed systems, but leave residual cases such as application-specific vaults, user-managed password managers, and post-install credential stores outside the enforced baseline.
T1555.001detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing password strengths, assessing activities with management tools) can surface anomalous credential-dumping commands or unexpected Keychain access on managed macOS systems, but only for deviations inside the monitored configuration scope and tooling set.
T1555.001prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary services/identities, restrict utilities, change defaults, minimize privileged access) can prevent some Keychain access vectors on macOS, but the technique's core (dumping via security command or reading the file with the user's own login password) remains available to any authenticated user, leaving a large residual slice
T1555.002detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing password strengths, assessing activities) can surface deviations that expose or enable memory-resident credential caching in securityd, but this is indirect, post-facto, and limited to configuration drift rather than reliably detecting the in-memory credential-gathering technique itself.
T1555.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous changes or insecure browser settings that enable credential extraction (e.g. disabled protections), but does not broadly detect the technique's core actions of reading browser files or process memory.
T1555.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, timeout facilities) can prevent browser credential storage or make extraction harder on managed systems, but this is only a slice of the technique's attack surface (memory scraping, unpatched browsers, user-installed extensions, post-compromise file reads).
T1555.004detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes or access to Credential Manager files/APIs on managed systems, but this is limited to configuration drift rather than reliably detecting credential extraction techniques or tools.
T1555.004prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities and default credentials, monitoring for deviations) directly block several listed access vectors such as vaultcmd.exe, direct file reads of .vcrd/Policy.vpol, and KRShowKeyMgr backups on managed Windows systems, but leave open API abuse (CredEnumerateA), password recovery tools, and unmonitored or non-Windows instances.
T1555.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities (including password strength evaluation) can surface deviations or anomalies tied to password manager misuse on managed systems, but this is limited to configuration drift or observable activity within the organization's defined scope rather than reliably detecting in-memory extraction, brute-force attempts, or the technique itself.
T1555.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, minimizing privileged access, changing defaults, restricting utilities, monitoring for deviations) can prevent installation or persistence of vulnerable password manager versions/configs that are easier to memory-scrape or brute-force, but this is only a slice of the technique's attack surface (e.g., does not stop in-memory extraction post-unlock or exploitation of a correctly configured manager).
T1555.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous access or privilege misuse that enables T1555.006, but this is limited to configuration drift or logged changes rather than reliably detecting the secret retrieval technique itself across cloud services.
T1555.006prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly enforce practices such as minimizing privileged identities, disabling unnecessary accounts/services, changing defaults, and restricting powerful utilities, which block many of the privilege paths that enable T1555.006; the remainder is that the technique can still succeed via other privilege vectors (e.g. compromise of a legitimately permissioned service) or post-compromise API calls that the control does not universally stop.
T1556detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password strength and privileged identities) can surface some T1556 modifications to auth processes or defaults, but this is limited to detectable config drift rather than in-process or runtime modifications of mechanisms like LSASS, PAM, or plugins, which fall outside its scope.
T1556prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, minimizing privileged access) directly stop many T1556 sub-techniques that rely on altering weak or exposed auth mechanisms (e.g. PAM mods, default creds, LSASS tampering via utilities), but leave open-ended remainder for sophisticated in-memory or plugin-level mods that do not violate the baseline template.
T1556.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized patches to LSASS or domain controller auth processes as configuration drift or anomalous changes, but this is limited to post-change detection rather than reliably catching in-memory injection or the technique's full stealthy execution path.
T1556.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, monitoring for deviations) prevent many vectors for patching LSASS on a DC, but do not block all in-memory runtime patches or every feasible bypass once the DC is already compromised.
T1556.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized DLL registrations or deviations in authentication-related components on Windows systems, but this is limited to configuration drift rather than reliably catching the in-process credential-harvesting behavior or all malicious filter placements.
T1556.002prevents — A.8.9's processes, standard templates and monitoring for secure configuration (including disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, and enforcing baselines on newly installed/operational systems) can block registration of a malicious password filter DLL on Windows hosts, but this is only a slice of the technique's attack surface given the control's general scope and lack of specificity to LSA/password filter registration mechanics.
T1556.003detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews comparing actual vs. target templates (including security settings for services, libraries, and authentication components), and addressing deviations, which surfaces unauthorized PAM modifications on Linux/macOS systems.
T1556.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address hardening PAM components (e.g. disabling unnecessary functions/services, restricting privileged access and utilities, changing defaults, and enforcing templates that prevent backdoor patches or credential-harvesting mods), but this is only a slice of the technique's surface because PAM modifications can still be introduced at runtime, via unmonitored vectors, or in non-template-managed files on Linux/macOS systems.
T1556.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password-related settings) can surface anomalous hard-coded backdoor passwords in device images or configs after they are present, but this is limited to post-modification detection on managed assets and does not broadly cover all network device image patching.
T1556.004prevents — A.8.9's secure configuration templates and enforcement (including changing vendor defaults immediately, disabling insecure functions/services, minimizing privileged access, and monitoring for deviations) directly address the initial implant of a hardcoded backdoor password during device setup or patching on network devices, but do not reach post-deployment image modification or all possible bypass vectors.
T1556.005detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against secure templates, and addressing of deviations; this surfaces the reversible-encryption setting when it deviates from the hardened baseline (e.g. the 'disable unless required' rule in the guidance).
T1556.005prevents — A.8.9 explicitly requires defining, enforcing and monitoring secure configuration templates that disable unnecessary/insecure identities, restrict powerful utilities and change vendor defaults (including the reversible-encryption property that should stay disabled); this stops the adversary from setting AllowReversiblePasswordEncryption via GPO, FGPP or PowerShell on systems under the templates, with only a bounded remainder for legacy-mandated exceptions or unmanaged assets.
T1556.006detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including changes to MFA-related settings like auth configs, defaults, or services), which surfaces many but not all T1556.006 instances such as policy exclusions or hosts-file patches outside monitored scope.
T1556.006prevents — A.8.9's secure configuration templates, enforcement processes, and monitoring explicitly require disabling unnecessary/insecure identities, restricting powerful utilities and parameter changes, and immediate correction of vendor defaults (including MFA-related settings), which stops many of the configuration-abuse vectors named in T1556.006; it does not reach every bypass (e.g., registering adversary-controlled MFA methods or policy exclusions that stay inside the approved template).
T1556.007detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including on identity, authentication, and service settings in hybrid/cloud environments), which can surface unauthorized modifications to PTA/AD FS processes or templates, but does not guarantee detection of all stealthy backdoors or cloud-side PTA agent registrations outside the monitored configuration scope.
T1556.007prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address hardening of on-premises PTA/AD FS agents, disabling unnecessary services/identities, changing defaults, and detecting unauthorized config changes (e.g. DLL injection or servicehost edits), but leave the cloud-side modification vector (Global Admin registering a rogue PTA agent) and some hybrid synchronization mechanics untouched.
T1556.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized network provider DLL registrations in the Registry or system configs, but this is only a slice of the technique's full scope (e.g., does not broadly instrument logon events or mpnotify.exe behavior).
T1556.008prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, and enforcing baselines (including via change management and deviation correction), which directly blocks the Registry-based registration and installation of a malicious network provider DLL on managed Windows systems; this is only partial because the control is scoped to assets under organizational configuration management and does not reach unmanaged endpoints, non-Windows platforms, or post-compromise changes that evade the defined templates.
T1556.009detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including privileged changes and default settings) surfaces unauthorized modifications to conditional access/IAM policies in monitored assets, but only where those policies are treated as configuration items under the organization's defined templates and tools.
T1556.009prevents — A.8.9 mandates processes, standard secure-configuration templates and ongoing monitoring/enforcement that explicitly include disabling unnecessary functions/services, restricting powerful utilities and settings, minimizing privileged identities, and changing defaults — directly blocking the policy modifications (removing MFA, expanding trusted IPs, altering conditions) that T1556.009 names, but only for configurations established and monitored under the organization's defined templates rather than every possible conditional-access policy an adversary might reach post-compromise.
T1557detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including clock sync, default changes, disabled services, and network settings) can surface some AiTM precursors such as unauthorized DNS/ARP alterations or insecure protocol configs, but does not broadly detect the in-flight technique or most of its protocol-abuse vectors.
T1557prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/functions, change defaults, restrict utilities, minimize privileged access, monitor for deviations) directly block several common AiTM vectors such as ARP/DNS/LLMNR poisoning, default credential abuse, and protocol downgrade on managed assets, but leave open vectors that rely on unpatched protocol flaws, physical-layer insertion, or configurations outside the organization's defined templates.
T1557.001detects — A.8.9's monitoring of configurations and comparison against secure templates (including disabling unnecessary services/ports and reviewing deviations) can surface anomalous name-resolution responses or misconfigurations that enable LLMNR/NBT-NS/mDNS poisoning on Windows hosts, but this is limited to configuration drift rather than real-time detection of the technique in flight or the broader attack surface.
T1557.001prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/protocols, restrict powerful utilities, minimize privileged access, change defaults) can disable or harden LLMNR/NBT-NS/mDNS on Windows hosts, stopping the poisoning vector at its source for managed systems; this is only a slice because the technique can still succeed on unmanaged hosts, legacy devices, or when poisoning is independent of the victim's own services.
T1557.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous ARP-related network behavior or unauthorized config changes enabling poisoning (e.g. via management tools), but this is limited to configuration drift or observable anomalies rather than reliably detecting the in-flight technique itself across all platforms and scenarios.
T1557.003detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection against secure templates (including disabling unnecessary services, restricting utilities, and secure defaults); this surfaces rogue DHCP servers or malicious config changes on monitored assets but only as a slice, since the technique can succeed via transient spoofed responses or unmonitored network segments without altering persistent configs.
T1557.003prevents — A.8.9's secure configuration templates, enforcement of defined configs, disabling of unnecessary services/functions, and monitoring for deviations directly close the vector when the rogue DHCP server is introduced via altered or non-hardened network device/service configs, but leave open the remainder where the adversary is an external rogue on an unmonitored segment, uses exhaustion, or spoofs without config change.
T1557.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized or rogue Wi-Fi APs that deviate from approved network configs, but this is limited to managed/known assets and does not broadly detect evil twin APs in public spaces or PNL spoofing.
T1558detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous Kerberos-related settings or changes (e.g. weak defaults, excessive privileges, or clock skew enabling forgery), but this is limited to configuration state rather than directly detecting the technique of stealing or forging tickets in flight or post-compromise.
T1558prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities and default creds, minimizing privileged access) directly block common T1558 vectors such as weak/default KDC configs, exposed ticket caches, or over-privileged service accounts that enable ticket theft or forgery; however, it does not reach core Kerberos protocol flaws, golden/silver ticket forgeries via KRBTGT compromise, or all platform-specific caching behaviors.
T1558.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous changes or settings related to KRBTGT/privileged accounts on domain controllers, but this is indirect, post-facto, and limited to configuration drift rather than reliably catching golden ticket forgery or use.
T1558.001prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, minimize privileged accounts, change defaults, monitor for deviations) reach the domain-controller hardening steps that limit KRBTGT-hash exposure and KDC attack surface, but do not stop an already-privileged adversary who reaches a DC from dumping the hash or forging the ticket.
T1558.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous silver ticket usage or related config changes (e.g. weak service account passwords), but this is limited to post-event config drift or specific monitored activities rather than reliably detecting the offline forgery itself.
T1558.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting powerful utilities, changing defaults, minimizing privileged access) directly block common prerequisites for obtaining the service-account hash needed to forge a silver ticket, but leave residual paths such as Kerberoasting a still-enabled service or exploiting an already-compromised privileged account.
T1558.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities (including password strength evaluation) can surface misconfigurations such as weak RC4-enabled service accounts or unchanged vendor defaults that enable Kerberoasting, but this is only a slice of the technique's network sniffing, TGT abuse, and offline cracking aspects.
T1558.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting powerful utilities, changing defaults, minimizing privileged accounts) directly block many common service accounts and SPNs that enable easy Kerberoasting, but cannot reach every legitimate service principal required for Windows operations, leaving a bounded remainder.
T1558.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface misconfigurations like accounts with pre-authentication disabled (a deviation from secure templates that disable insecure defaults), but this is limited to post-setup detection of the enabling condition rather than reliably catching the technique's execution (e.g., AS-REQ abuse or cracking).
T1558.004prevents — A.8.9 requires secure configuration templates and enforcement that include disabling unnecessary/insecure identities, restricting powerful utilities, and changing defaults (explicitly covering pre-authentication settings on domain accounts), which stops the prerequisite state for AS-REP Roasting from arising in managed systems; it is only partial because the control is a process that depends on correct implementation and does not reach every possible identity or unmanaged asset.
T1558.005detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing activities, evaluating password strengths) can surface anomalous ccache files or deviations in krb5.conf/KRB5CCNAME settings on Linux/macOS, but this is only a minority slice of the technique's execution (file access, extraction, conversion) rather than broad detection of ticket theft itself.
T1558.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, monitoring for deviations) can prevent insecure Kerberos setups that expose ccache files (e.g. via /etc/krb5.conf or /tmp storage), but this is only a slice of the technique's attack surface on Linux/macOS where tickets are created post-authentication and accessible via standard tools like klist.
T1559.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous COM usage or unauthorized changes enabling its abuse, but this is limited to configuration drift rather than reliably detecting in-flight technique execution or the broad set of COM interfaces.
T1559.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and monitoring for deviations) can prevent abuse of many exposed COM interfaces/objects on Windows, but not all (some COM usage is required for legitimate system functions and cannot be fully restricted without breaking operations).
T1559.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous DDE-enabling registry keys or unauthorized changes that enable the technique, but this is limited to configuration drift rather than runtime detection of DDE command execution or poisoned documents.
T1559.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, changing defaults, monitoring for deviations) can disable DDE via registry keys or Office settings on managed systems, but this is only a slice: the technique can still be re-enabled, used in unmanaged software, or invoked remotely via DCOM without violating the control.
T1559.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface misconfigurations or unauthorized changes that enable XPC abuse (e.g. weak validation or exposed services), but this is indirect, post-facto, and limited to configuration state rather than runtime malicious XPC requests or input sanitization failures on macOS.
T1559.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting privileged access and utilities, minimizing admin identities, changing defaults) directly block many XPC abuse vectors on macOS by hardening the daemon and its handlers, but leave a genuine remainder for application-specific XPC protocol definitions, client validation logic, and input sanitization that are outside the control's scope.
T1560.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities performed can surface anomalous use of archiving utilities (e.g. unexpected 7-Zip, certutil, or makecab invocation) as a deviation, but this is limited to configuration-aware monitoring rather than general behavioral detection of the technique.
T1560.001prevents — A.8.9's standard templates and enforcement of secure baselines (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) can prevent abuse of many preinstalled or third-party archiving utilities on managed systems, but this is only a slice: the technique can still run via allowed tools, custom/third-party installs outside templates, or post-compromise binaries, leaving substantial residual
T1560.003detects — A.8.9's monitoring of configurations, deviation detection from secure templates, and review of activities can surface anomalous custom archival tools/behaviors on managed systems, but this is limited to configuration drift or known-bad patterns rather than reliably catching novel custom XOR/stream-cipher implementations in adversary code.
T1561detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous disk-wiping changes (especially on managed devices or via config logs), but this is limited to post-facto detection of configuration impact rather than reliably catching the raw disk overwrite technique itself across all platforms and propagation methods.
T1561recovers — A.8.9 requires recording established configurations, maintaining change logs, and monitoring for deviations with corrective actions (including via backup/restore tools), which directly enables recovery of wiped or altered configurations on systems and network devices after T1561 executes.
T1561.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous disk-wiping changes after they occur (especially on managed systems), but this is limited to configuration drift rather than reliably catching the low-level overwrite technique itself or its propagation.
T1561.001recovers — A.8.9's monitoring, recording, and corrective-action language (including backup/restore tooling in the monitoring paragraph) directly supports restoring from known-good configuration templates after a disk-wipe event, matching the recovers verb; the remainder is data written after the last backup.
T1561.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous wipes or reformats that deviate from recorded baselines (especially on managed systems), but this is limited to post-event configuration drift rather than reliably catching the in-progress technique across all platforms, propagation vectors, or unmonitored assets.
T1561.002prevents — A.8.9's secure configuration templates, enforcement of baselines (including disabling unnecessary functions/services/utilities and restricting privileged access), change management, and monitoring can block many vectors for unauthorized disk-structure changes (e.g. via CLI, malware propagation, or misconfiguration), but do not stop all (e.g. supply-chain implants, physical access, or zero-days that bypass the enforced baseline).
T1561.002recovers — A.8.9's monitoring, deviation detection, and corrective-action language (plus secure storage of configuration records) enable restoration of a wiped boot structure from a known-good template on surviving systems, but this is limited to configuration-level recovery and does not address full data loss, propagation, or unbootable systems themselves.
T1563detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface hijacking indicators (e.g. unexpected session state or config changes on remote services), but this is limited to configuration-focused tools rather than broad session or behavioral detection of the technique itself.
T1563prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/ports, restricting utilities, changing defaults, minimizing privileged access, monitoring for deviations) stop many hijack vectors on remote services like SSH/RDP/telnet before they can be established or abused, but leave a genuine remainder where properly hardened sessions are still hijackable via unaddressed session token theft, MITM, or kernel-level takeover.
T1563.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous SSH agent sockets, unauthorized config changes, or unexpected privileged access on Linux/macOS, but this is indirect, post-compromise, and limited to what the chosen monitoring tools actually instrument.
T1563.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/identities, restricting utilities, changing defaults, minimizing privileged access) can prevent the SSH agent/socket exposure or root-level compromise that enables T1563.001 on managed systems, but this is only a slice: the technique can still succeed via other vectors like key compromise or unmonitored sessions, and the control does not mandate SSH-specific hardening.
T1563.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous RDP session hijacking (e.g. via tscon.exe use or unexpected session changes) as a configuration or activity deviation, but this is limited to monitored/config-managed assets and does not broadly instrument for the technique itself.
T1563.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting powerful utilities like tscon.exe, minimizing privileged access, and monitoring for deviations) can block common RDP hijacking vectors on managed systems, but the technique can still succeed via unhardened RDP setups, active admin sessions, or non-configuration factors like credential theft.
T1564detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including disabled accounts, restricted functions, and privileged access) surfaces some hiding techniques that alter visible configuration state, but does not address hidden files/directories, virtualization-based isolation, or most other T1564 sub-techniques.
T1564prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services/identities, restricting utilities, minimizing privileged access, monitoring for deviations) directly block many common hiding techniques that abuse default OS features or misconfigurations, but do not address virtualization-based isolation or all possible artifact-hiding methods on every platform.
T1564.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface hidden files or directories that deviate from the defined baseline (e.g. unexpected dot-files or attrib.exe usage), but this is limited to configuration-focused checks rather than general detection of the technique in use.
T1564.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, monitoring for deviations) can prevent many common forms of hidden-file abuse that rely on default or insecure settings, but the technique's core mechanisms (dot-prefix naming, attrib, UF_HIDDEN flag, space-named files) remain available to authorized processes and are not blocked outright by configuration baselines.
T1564.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including identities, access rights, and settings) can surface unauthorized hidden-user modifications on managed systems, but this is limited to configuration drift rather than reliably catching all adversary techniques (e.g., runtime plist/registry/gsettings changes or Display Manager swaps) across Linux/macOS/Windows.
T1564.002prevents — A.8.9 requires secure configuration templates and enforcement that include disabling unnecessary accounts/identities and restricting powerful utilities, which directly blocks the configuration changes (registry/plist/gsettings edits, UID tweaks, attribute flags) used by T1564.002 on managed systems; it is only partial because the control is a process/template framework whose actual coverage depends on which accounts, platforms, and settings the organization elects to template and enforce.
T1564.003detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface some hidden-window techniques that alter visible configs (e.g. plist, registry, or unauthorized script flags), but most of the technique (API calls, command-line flags, hidden desktops, or in-memory hiding) leaves no configuration deviation for the control to detect.
T1564.003prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, monitoring deviations) can block many of the technique's abuse vectors such as hidden PowerShell windows, registry edits, or plist changes on managed systems, but leaves real gaps for legitimate admin use, unmonitored platforms, and runtime API calls like CreateDesktop().
T1564.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous use of NTFS attributes (e.g. unexpected ADS content or EA metadata) on managed Windows systems, but this is limited to configured assets under template enforcement and does not broadly instrument for the hiding technique itself.
T1564.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface anomalous hidden file system structures or non-standard partitions when they deviate from the recorded baseline, but this is limited to monitored/configured assets and does not broadly instrument for hidden VFS usage or runtime concealment techniques.
T1564.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including via system management tools) can surface unauthorized virtualization artifacts or rogue VMs on monitored assets, but this is limited to configuration-state checks rather than runtime detection of in-guest behavior or hidden instances that evade host monitoring.
T1564.006prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling/restricting unnecessary functions/services, minimizing privileged access, changing defaults, and detecting deviations; this stops many (but not all) of the listed vectors for installing/running hidden virtualization tools or rogue VMs on managed systems.
T1564.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous Office document configurations or macro-related changes on managed systems, but has no defined view of compiled p-code, VBA stomping artifacts, or dynamic analysis bypasses.
T1564.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous email rules (e.g. those deleting/moving on suspicious keywords) after creation, but this is limited to configuration-focused tools rather than mailbox/content monitoring and does not address organization-wide transport rules or non-configuration aspects of the technique.
T1564.008prevents — A.8.9 mandates secure configuration templates, enforcement of those templates (including disabling unnecessary functions/services, restricting powerful utilities, and minimizing privileged access), change control, and ongoing monitoring/correction of deviations; this directly constrains the creation or alteration of malicious email rules (a configuration change to email clients or transport rules) on managed systems, but leaves a bounded remainder for rules creatable by any authenticated user without admin rights, rules on unmanaged BYOD endpoints, and post-compromise abuse that bypasses the baseline enforcement.
T1564.009detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous resource forks or unauthorized file changes on managed macOS systems, but this is limited to configured assets under the templates and does not broadly instrument for the technique's execution or obfuscated use.
T1564.009prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, monitoring for deviations) can prevent the setup or persistence of resource-fork abuse on managed macOS systems, but this is only a slice: the technique is an adversary post-exploitation action on already-deployed files, many configurations remain feasible to bypass, and the control does not address all macOS extended-attribute or bundle behaviors.
T1564.010detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous processes or memory changes on managed systems, but this is limited to configuration drift rather than specifically detecting in-memory PEB overwrites or the technique's evasion of process-creation logging.
T1564.011detects — A.8.9 requires monitoring of configurations with management tools to detect deviations from secure baselines (including disabled unnecessary functions/services and restricted utilities); this surfaces some uses of nohup or similar commands when they violate recorded secure templates, but does not broadly instrument process behavior or interrupt-signal evasion itself.
T1564.012detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including disabled services, unnecessary functions, and privileged access) can surface some hardcoded or default exclusions that deviate from the defined secure baseline, but this is limited to configuration-state checks rather than runtime detection of adversary file placement or abuse of those exclusions.
T1564.012prevents — A.8.9 requires defining, enforcing and monitoring secure configuration templates that disable unnecessary functions/services, restrict powerful utilities, minimize privileged access and address default settings; this directly constrains many default/hardcoded exclusions that defensive tools ship with, but leaves open exclusions added post-install by legitimate apps or admins as well as contextual exclusions, so only a slice of the technique is stopped at source.
T1564.013detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous bind mounts (e.g. unexpected /proc overlays or sudo-driven changes), but this is limited to configuration-focused tools rather than general process or filesystem anomaly detection, leaving most in-flight hiding techniques unreached.
T1564.014detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous xattrs or unauthorized changes that embed payloads, but only for monitored assets and only where templates/tools explicitly inspect xattrs (most standard config checks do not).
T1564.014prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, monitoring for deviations) can prevent the abuse of xattr utilities like xattr/setfattr/getfattr on many Linux/macOS systems by removing or locking down those tools and related services, but this leaves a bounded remainder on systems where xattr functionality must remain enabled for legitimate OS/application use (e.g., Gatekeeper, integrity checks).
T1565detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes that realize T1565, but this is limited to configuration items and does not broadly instrument data manipulation across applications, business processes or non-config assets.
T1565prevents — A.8.9's secure-configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and privileged access, baseline monitoring with deviation correction) stop many classes of data-manipulation that rely on misconfigured services, weak defaults, or unauthorized changes, but leave intact manipulations that use legitimate application interfaces or require only user-level access after initial compromise.
T1565.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations (including via system management tools) can surface unauthorized changes to stored configuration data or templates, but does not broadly detect manipulation of arbitrary stored data such as Office files, databases, or custom formats that are outside the configuration-management scope.
T1565.001prevents — A.8.9's secure configuration templates, enforcement processes, change control, and monitoring directly prevent many classes of unauthorized stored-data manipulation by locking down identities, disabling unnecessary services/utilities, enforcing baselines, and detecting deviations that would enable the technique.
T1565.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface unauthorized changes that realize T1565.002 but does not broadly instrument or detect in-transit data manipulation itself
T1565.002prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting utilities/parameter changes, minimizing privileged access, and monitoring for deviations) close many opportunities for an adversary to deploy an in-transit interceptor or alterter on managed systems, but leave open vectors such as external network segments, unmonitored processes, or sophisticated MITM that require no local configuration change.
T1565.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations and activities can surface unauthorized changes to binaries, file associations or settings that enable runtime data manipulation, but only for monitored/configured assets and not the specialized expertise-gathering or complex in-memory manipulations the technique often requires.
T1565.003prevents — A.8.9's secure configuration templates, enforcement of baselines, disabling of unnecessary functions/services/identities, and monitoring for deviations directly block many classes of runtime data manipulation that rely on unauthorized binary changes, default associations, or altered settings, but the technique can still succeed via specialized in-memory manipulation, prolonged reconnaissance-enabled custom tooling, or changes that do not deviate from an approved template.
T1567detects — A.8.9's monitoring of configurations, deviation detection from secure templates, and review of activities can surface anomalous use of web services for exfiltration (e.g. via unexpected data flows or config changes enabling it), but this is limited to configuration drift and system management tools rather than directly targeting the exfiltration technique itself.
T1567.001detects — A.8.9's monitoring of configurations, deviation detection, and review of activities (including via management tools) can surface anomalous use of code-repo APIs or unexpected configuration changes enabling exfil, but this is indirect, limited to monitored assets, and does not target the exfiltration technique itself.
T1567.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous use of cloud services (including exfil to storage like Dropbox) when it deviates from approved baselines, but this is limited to configuration-aware tools rather than dedicated exfil detection.
T1567.003detects — A.8.9's monitoring of configurations, deviation detection, and review of activities (via management tools) can surface anomalous use of text-storage sites or unexpected outbound connections in monitored assets, but this is limited to configuration drift or observable anomalies rather than reliably detecting the exfiltration technique itself across all platforms and concealment methods.
T1567.004detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous webhook-related changes or outbound HTTPS posts in managed systems/services, but this is limited to configuration drift or logged activity within scope and does not broadly detect the exfiltration technique itself (especially manual posts or blending with normal SaaS traffic).
T1568.003detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous C2-related config changes or deviations on managed systems, but this is limited to post-compromise config artifacts rather than reliably catching the in-memory DNS calculation technique itself across all platforms and implementations.
T1569prevents — Templates that disable or tightly control system services and utilities constrain adversaries from leveraging service execution as a stealthy or persistent execution mechanism.
T1569detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations (including disabled services, unnecessary functions, privileged access, and change logs) surfaces abuse of system services/daemons both at setup and in operation across the covered platforms.
T1569.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous or unauthorized launchctl usage on managed macOS systems, but this is limited to configured assets under the organization's monitoring scope and does not broadly instrument or detect the technique itself.
T1569.001prevents — A.8.9's processes, standard secure-configuration templates and ongoing monitoring/enforcement directly close the bulk of launchctl abuse vectors by disabling unnecessary services, restricting privileged access and powerful utilities, removing insecure defaults, and detecting deviations on macOS assets; the named remainder is that the technique can still be used against required system services or via authorized-but-abused launch agents/daemons that survive the hardened baseline.
T1569.002detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous service-related changes or executions (e.g. via management tools), but this is limited to configuration drift rather than reliably catching in-flight or remote service execution abuse via sc.exe/PsExec as described.
T1569.002prevents — A.8.9's secure-configuration templates and enforcement (disabling unnecessary services/functions, restricting privileged access and utilities, baseline monitoring with deviation correction) stop many abuse paths of the service control manager, but the technique can still be used on required Windows services or via permitted tools like sc.exe/PsExec on managed systems.
T1569.003detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection from secure templates (including disabled unnecessary services/functions); this surfaces some systemctl abuse of systemd services when it deviates from the enforced baseline, but the clause's scope is configuration state rather than runtime command execution or all possible subcommands.
T1569.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling/restricting unnecessary services and functions on Linux systems (including systemd-managed ones), which stops many systemctl-abuse paths at source; the remainder is the set of legitimate services an adversary can still start/stop/enable via systemctl after gaining the necessary privileges.
T1570prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting utilities and file-sharing protocols like SMB/RDP/scp/sftp/ftp, minimizing privileged access) can prevent many native-tool lateral transfers on managed systems, but leaves open-ended remainder for web services, synced folders, and post-compromise use of allowed functions.
T1571detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including changes to ports, services, or registry settings) can surface non-standard port usage when it deviates from approved baselines, but this is limited to monitored/configured assets and does not broadly detect in-flight protocol/port abuse or adversary changes outside the configuration management scope.
T1571prevents — A.8.9's defined secure-configuration templates and enforcement (including disabling unnecessary functions/services, restricting utilities/settings, and monitoring for deviations) can block many non-standard port changes on managed systems, but the control is silent on network filtering, protocol enforcement, and adversary changes outside the configuration baseline process.
T1572detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unauthorized tunneling setups (e.g. unexpected SSH port forwards, DoH clients, or altered network services), but this is limited to configuration-state checks rather than real-time traffic or behavioral detection of the technique in flight.
T1572prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults) can prevent many common tunneling vectors on managed systems, but leaves open-ended residual cases such as allowed/necessary services (e.g. SSH, HTTPS for DoH) that adversaries can still abuse for tunneling.
T1574detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including via system management tools) can surface some hijack vectors such as poisoned defaults, unauthorized changes, or anomalous configurations, but does not broadly detect in-flight execution hijacks or most runtime manipulations described in T1574.
T1574prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting utilities/privileges, changing defaults, minimizing admin access) directly close several common hijack vectors such as DLL search-order poisoning, untrusted path insertion, and registry poisoning on newly-installed and operational systems; however, it does not reach all variants (e.g., environment variable manipulation, binary planting in controlled but non-default locations, or runtime hook-based hijacks), leaving a genuine minority slice prevented.
T1574.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous DLL placements, substitutions, or unauthorized changes that enable T1574.001, but this is limited to configuration drift rather than runtime technique execution or all hijacking variants.
T1574.001prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities/parameter settings, minimizing privileged identities, changing defaults, monitoring for deviations) stop many common DLL search-order, phantom, redirection, and substitution vectors at the source; they do not reach every side-loading or remote-share scenario an adversary can still force.
T1574.004detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous dylib placements or unexpected library loads on monitored macOS systems, but this is limited to configuration drift rather than reliably catching the runtime search-path hijack itself.
T1574.004prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities, minimizing privileged access, changing defaults, and monitoring for deviations) can prevent the insecure search paths, weak linking, and missing-dylib conditions that enable dylib hijacking on macOS, but this is only a slice of the class because the technique also turns on application-specific build choices (@rpath, LC_LOAD_WEAK_DYLIB) and runtime loader behavior outside the control's defined templates and change-management scope.
T1574.005detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface improper permissions or insecure defaults on installer-related files/directories after they exist, but this is limited to monitored assets and does not broadly cover the technique's runtime hijacking or TEMP subdirectory behaviors.
T1574.005prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address the named weakness by enforcing least-privilege identities, disabling unnecessary services/utilities, changing defaults, restricting powerful programs, and verifying configurations (including permissions on install directories and binaries), but this is only a slice: the control governs the organization's own managed systems and does not reach third-party installers or the common %TEMP% installer behavior that vendors ship vulnerable.
T1574.006detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous environment variables or library loads that deviate from the hardened baseline, but this is limited to configuration-state checks rather than runtime detection of the hijacking technique itself.
T1574.006prevents — A.8.9 requires secure configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged identities, and changing defaults, which directly blocks many common LD_PRELOAD/DYLD_INSERT_LIBRARIES abuse vectors on Linux/macOS; it does not reach every possible environment-variable or linker configuration an adversary could manipulate, leaving a genuine minority slice unaddressed.
T1574.007detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous PATH modifications or insecure settings that enable the technique, but this is limited to configuration drift detection rather than reliably catching in-flight execution or all modification vectors (e.g., runtime launchctl or shell config changes).
T1574.007prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary services/functions, restrict powerful utilities, change defaults, monitor for deviations) directly close many PATH hijacking vectors that rely on weak/misconfigured environment or search-order settings, but leave open adversary-controlled modification of $PATH/$HOME or /etc/paths.d after initial setup.
T1574.008detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous files or unauthorized changes in program directories that enable search order hijacking, but this is limited to post-placement detection of configuration drift rather than reliably catching the technique in execution or all variants.
T1574.008prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, using full paths where feasible via hardened baselines) stop many search-order hijack opportunities on Windows; residual remains for required system utilities, unhardened third-party apps, and runtime placement of malicious files not caught by static templates.
T1574.009detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface unquoted paths or anomalous executables placed in higher directories as configuration drift or suspicious changes, but this is limited to post-placement detection within monitored assets rather than reliably catching the technique in all cases (e.g., non-configured paths or unmonitored services).
T1574.009prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, restrict utilities, change defaults, monitor for deviations) close the unquoted-path vectors that arise from insecure service/shortcut defaults or overly permissive setups, but do not reach all instances (e.g. custom application paths or post-install changes outside the managed baseline).
T1574.010detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface improper service binary permissions or unauthorized changes after they occur, but this is limited to configured/monitored assets and does not broadly instrument for the runtime hijacking behavior itself.
T1574.010prevents — A.8.9 mandates secure configuration templates and enforcement processes that directly address the listed secure-config items (disable unnecessary services/identities, restrict powerful utilities and host parameters, change defaults, minimize privileged access), which close the permission and service-configuration flaws the technique exploits on Windows; the bounded remainder is non-enforced or post-deployment drift on unmanaged assets.
T1574.011detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized Registry permission or value changes after they occur, but this is limited to configured assets under management tools and does not broadly instrument or detect the technique's execution or all possible abuse vectors.
T1574.011prevents — A.8.9 mandates secure configuration templates, enforcement processes, and monitoring that explicitly include disabling unnecessary services/identities, restricting powerful utilities and parameter settings, changing defaults, and correcting deviations — directly closing the permission and configuration flaws that enable services Registry hijacking on Windows.
T1574.012detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous COR_PROFILER environment variables or registry changes on managed Windows systems, but this is limited to configured assets and does not broadly instrument process injection or in-memory techniques.
T1574.012prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities, change defaults, monitor for deviations) can block many common COR_PROFILER abuse vectors such as registry-based system/user variables or unregistered DLL paths, but leaves a genuine remainder: in-memory process-scope abuse, custom .NET CLR loading that does not violate a baseline, or attacker-controlled processes that still load a malicious profiler.
T1574.013detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous changes to process memory structures like the PEB or KernelCallbackTable when they deviate from expected baselines, but this is limited to monitored/configured assets and does not broadly instrument or detect the in-process hijack technique itself.
T1574.013prevents — A.8.9's secure configuration templates and enforcement (disable unnecessary functions/services, restrict powerful utilities/host settings, minimize privileged access, monitor for deviations) can block common process-injection vectors that enable KernelCallbackTable abuse, but the technique's in-memory PEB tampering and GUI-message trigger sit outside the bulk of what static configuration baselines reach.
T1574.014detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface tampering with .config files, environment variables, or unauthorized changes that enable AppDomainManager hijacking, but this is limited to configuration-level artifacts on monitored systems and does not broadly detect the in-process assembly loading or custom domain creation itself.
T1574.014prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary functions/services, restricting powerful utilities and parameters, changing defaults, and enforcing baselines on software/services (including runtime settings and .config files); this stops the tampering vectors for AppDomainManager injection in many cases but leaves a remainder for custom .NET code that still creates/manages domains at runtime.
T1578detects — A.8.9 requires monitoring of configurations (including comparison to templates and review of changes/deviations) which can surface unauthorized modifications to cloud compute infrastructure, but this is limited to post-change detection within the organization's defined scope rather than reliably catching all adversary-driven evasion or evidence-removal tactics on IaaS platforms.
T1578prevents — A.8.9's processes, standard secure templates, and monitoring/enforcement of configurations (including for cloud services) directly constrain unauthorized or incorrect changes to compute infrastructure such as instances, VMs, and snapshots, stopping many T1578 modifications at source; partial because the control is governance+process-oriented and does not itself implement the enforcement mechanisms that would stop every possible privileged modification.
T1578.001detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous snapshot creation as a configuration change on IaaS assets, but only where it is logged and falls inside the monitored scope rather than evading it outright.
T1578.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including new cloud service instances) can surface unauthorized instance creation as a deviation, but this is limited to post-creation detection within monitored scope rather than reliably catching all evasion-driven creations.
T1578.002prevents — A.8.9's processes, standard secure templates (e.g. disabling unnecessary functions/services, restricting powerful utilities, minimizing privileged access, changing defaults), enforcement, monitoring, and deviation correction for cloud services directly constrain creation of insecure new instances that bypass existing rules, but do not stop all adversary-driven instance creation (e.g. via compromised privileged accounts following approved templates).
T1578.003detects — A.8.9 requires monitoring configurations with tools, regular reviews, deviation detection from secure templates, and addressing anomalies (including unauthorized changes), which can surface suspicious instance deletions in managed cloud environments but only reaches a slice of the technique (e.g., via config logs or asset records) rather than broadly detecting the adversarial act itself.
T1578.003recovers — A.8.9's monitoring, recording, and corrective-action language (including backup/restore tooling) can surface and restore from a deletion that violates the approved baseline, but the control's focus is on enforcing correct configurations rather than guaranteeing recoverability of every deleted instance or its forensic data.
T1578.004detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized snapshot restores or ephemeral storage resets as configuration drift or anomalous changes on IaaS assets.
T1578.004prevents — A.8.9's processes, standard secure templates (e.g. disabling unnecessary functions/services/identities, changing defaults, restricting utilities), recorded configs, change management, and monitoring/deviation correction directly constrain unauthorized or incorrect reversion of cloud instances via APIs/dashboards or ephemeral storage resets, but only for changes under organizational policy and tooling; adversary-controlled post-compromise use or unsanctioned snapshots remain outside its reach.
T1578.005detects — A.8.9 explicitly requires monitoring configurations with tools, regular reviews, comparison against target templates, and addressing of deviations, which surfaces unauthorized or incorrect changes to cloud compute settings such as quotas, policies, or regions.
T1578.005prevents — A.8.9's defined processes, standard secure-configuration templates (including disabling unnecessary functions/services, restricting powerful utilities and parameter settings, minimizing privileged identities, and changing defaults), recorded baselines, change-management enforcement, and ongoing monitoring+deviation correction directly stop unauthorized or incorrect modifications to cloud compute settings such as quotas, tenant policies, and region allowances before they can be abused.
T1580detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing settings and activities with management tools) can surface anomalous discovery-oriented API calls or configuration changes that expose infrastructure details, but this is limited to post-action config deviations rather than broadly detecting the discovery technique itself across IaaS resources.
T1580prevents — A.8.9's defined secure-configuration templates and enforcement (disable unnecessary services/identities/functions, minimize privileged access, change defaults, restrict utilities, monitor for deviations) directly block many of the discovery APIs, CLI commands, and misconfigurations that T1580 relies on when run against newly provisioned or drifted IaaS resources; the remainder is discovery that succeeds against already-correctly-hardened resources via legitimate (but compromised) credentials or against services the organization must expose.
T1584.001prevents — A.8.9's secure configuration templates, change management, monitoring for deviations, and practices like disabling unnecessary services/identities and immediate default password changes directly block several hijacking vectors (e.g. renewal gaps, cloud service compromise, dangling DNS, default creds) but leave social engineering, help-desk compromise, and email-account takeover largely untouched.
T1584.007detects — A.8.9 requires monitoring of configurations (including cloud services) against secure templates and addressing deviations, which can surface unauthorized changes to serverless functions after compromise, but this is limited to configured assets under organizational inventory and does not broadly detect the initial compromise or runtime abuse of serverless infrastructure.
T1584.007prevents — A.8.9 requires secure configuration templates, enforcement of defined configs (incl. for cloud services), disabling unnecessary functions/services/identities, changing defaults, and monitoring for deviations on operational systems; this directly constrains the initial compromise vector for many serverless functions (e.g. via insecure defaults or excessive privileges), but leaves open other vectors such as supply-chain compromise of the function code itself or credential theft, so only a slice of the technique is prevented.
T1584.008prevents — A.8.9's processes, standard secure-configuration templates, default-password changes, disabling of unnecessary services/identities/functions, and ongoing monitoring/enforcement of configurations on network devices (including routers) directly stop many of the common configuration weaknesses that enable T1584.008 compromise; partial because the control is scoped to the organization's own assets and does not reach third-party/Internet-facing devices the adversary can still target for proxy/C2 use.
T1586.003prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the insecure-default and weak-configuration vectors for cloud accounts (e.g., changing vendor defaults, disabling unnecessary identities/services, minimizing privileged access, enforcing templates), but the technique's dominant methods (phishing, password spraying, stolen tokens, purchased creds) lie outside configuration management.
T1589.001prevents — A.8.9's secure-configuration templates and enforcement (changing defaults immediately, disabling unnecessary accounts/services, minimizing privileged identities, restricting utilities) stop a subset of credential-gathering vectors that rely on exposed defaults or misconfigured services, but leave the dominant vectors (phishing, breach dumps, dark-web purchases, infostealer logs, MFA-provider compromise) untouched.
T1595detects — A.8.9's monitoring of configurations and comparison against secure templates can surface anomalous scanning activity (e.g. unexpected network probes from internal assets or misconfigured services), but this is only a minority slice of the PRE technique that occurs externally before any asset is under the organization's control.
T1595.002detects — A.8.9's monitoring of configurations (comparing actuals to secure templates, reviewing settings and deviations) can surface anomalous or insecure configurations that a vulnerability scan would also discover, but the control is not scoped to detect external/pre-compromise scanning activity itself.
T1595.002prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly block the configuration states (unpatched software, unnecessary services, default credentials, open ports) that vulnerability scanners target and report on, so the technique cannot succeed against a fully hardened asset; the remainder is the pre-install or externally observable slice that templates cannot reach before first scan.
T1599detects — A.8.9 requires monitoring configurations with tools, regular reviews, and deviation detection against secure templates, which can surface unauthorized reconfigurations of perimeter devices or segmentation hardware (the core of T1599), but only after the fact on managed assets and without addressing the initial compromise or non-configuration signals.
T1599prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address hardening and locking down perimeter devices (routers/firewalls) and segmentation devices per vendor guidance, least functionality, default-password changes, and privilege minimization, which stops many reconfiguration paths that T1599 relies on; it is only partial because the control is a process/template set whose effectiveness still depends on implementation rigor and does not reach every possible device or every post-compromise reconfiguration vector.
T1599.001detects — A.8.9 requires monitoring configurations with tools, regular reviews, and comparison against secure templates to detect deviations (including unauthorized NAT changes on network devices), but this is limited to post-change detection on managed assets and does not address pre-modification adversary activity, custom NAT via T1601.001, or non-configuration indicators of the technique.
T1599.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly address disabling/restricting unnecessary functions/services, changing defaults, and enforcing baselines on network devices (including NAT-related settings), which stops many unauthorized NAT modifications at the source; it reaches only a slice because the technique can still be executed via privileged compromise plus change-management bypass or custom firmware that evades the organization's defined templates.
T1600detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including password strength and insecure settings) can surface some T1600 sub-techniques such as altered crypto parameters or disabled hardware after the fact, but this is limited to detectable configuration drift on managed devices and does not broadly detect the adversary technique itself or its network-traffic impact.
T1600prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary functions/services, change defaults, minimize privileged access, monitor for deviations) directly block several sub-techniques that weaken device encryption (e.g. T1600.002 Disable Crypto Hardware, T1600.001 Reduce Key Space via insecure defaults or utilities), but do not stop all vectors such as T1601 Modify System Image or sophisticated runtime manipulation of already-deployed crypto.
T1600.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including crypto-related parameters like key sizes) can surface unauthorized weakening of cipher strength on managed devices, but only for assets inside the monitored scope and only after the change has already occurred.
T1600.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require (and enforce) strong cryptographic settings including key sizes and disabling weak defaults, which stops the adversary from successfully reducing key space on devices built and maintained under it; the remainder is post-compromise changes via T1601/T1059.008 on already-deployed devices where the control's enforcement has been bypassed.
T1600.002detects — A.8.9 requires monitoring configurations with tools, regular reviews, comparison against secure templates, and addressing deviations (including on network devices), which can surface unauthorized disabling of hardware crypto as a config change or deviation; partial because the clause's scope is set by the organization's chosen templates and monitoring coverage rather than mandating detection of this specific technique on all network devices.
T1601detects — A.8.9's monitoring of configurations, comparison against target templates, and review of deviations (including via system management tools) can surface unauthorized changes to a device OS image when it deviates from the recorded baseline, but this is limited to monitored assets, does not address in-memory runtime modifications before they persist, and is scoped by what the organization chooses to baseline and tool.
T1601prevents — A.8.9's processes, standard secure-configuration templates (disabling unnecessary functions/services, restricting utilities and defaults, minimizing privileged access), enforcement, monitoring and deviation-correction directly stop many of the unauthorized OS-image modifications that T1601 relies on, especially at install and during operational lifetime; the remainder is live in-memory patches on already-compromised devices where the control's change-management and monitoring slices do not reach.
T1601.001detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing of deviations, which surfaces unauthorized or unexpected patches to the system image on monitored network devices.
T1601.001prevents — A.8.9's processes, standard secure-configuration templates (including minimizing privileged access, disabling unnecessary functions/services, changing defaults, and restricting utilities), enforcement, monitoring, and deviation correction directly stop many of the standard-operator and debug-command vectors for patching a network-device OS image, but leave open the ROMMONkit/bootloader-implant path that can bypass those controls at boot or in memory.
T1601.002detects — A.8.9 requires monitoring and regular review of configurations (comparing actuals to secure templates and addressing deviations), which can surface an unauthorized downgrade to an older/weaker image on a network device; partial because the clause's scope is general hardware/software/services (not mandating network-device firmware/OS image monitoring depth or real-time change detection).
T1601.002prevents — A.8.9's processes, standard secure-configuration templates (including disabling unnecessary functions/services, restricting utilities, and changing defaults), change-management enforcement, and ongoing monitoring/deviation-correction directly stop many unauthorized or insecure downgrades of device images on managed network hardware; the remainder is that the control is scoped to configurations the organization has already defined and can monitor, leaving unaddressed cases such as supply-chain or initial-deployment images, or devices outside the monitored set.
T1602detects — A.8.9's monitoring of configurations (comparing actuals to templates, reviewing settings/activities/deviations with management tools) can surface anomalous access or changes targeting a configuration repository, but this is limited to monitored assets and does not broadly detect the collection technique itself across all exposure vectors or platforms.
T1602prevents — A.8.9's processes, standard secure templates, change control, and monitoring directly constrain how configuration repositories are set up, hardened (e.g. disabling unnecessary services/identities, changing defaults, restricting utilities), and kept consistent, which stops many exposure paths adversaries use to collect data from them; it is only partial because the control does not mandate specific repository protections (e.g. network isolation, protocol-level auth) that would block all collection techniques on all platforms.
T1602.001detects — A.8.9's monitoring of configurations (comparing actuals to templates, reviewing settings/activities/deviations with management tools) can surface anomalous SNMP queries or MIB access as configuration drift or unauthorized activity, but this is only a slice — the clause is scoped to configuration enforcement and review rather than general network telemetry or SNMP-specific detection.
T1602.001prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement directly close the insecure SNMP defaults, excessive privileges, open services, and unchanged vendor passwords that enable unauthenticated or weakly-protected MIB queries on network devices.
T1602.002detects — A.8.9's monitoring of configurations with management tools, regular reviews, deviation detection against templates, and logging of changes directly surfaces an adversary's access or export of a network device configuration (via SNMP, SMI, or similar), which is observable as anomalous configuration activity on the monitored asset.
T1602.002prevents — A.8.9's defined secure-configuration templates, enforcement processes, disabling of unnecessary functions/services/identities, changing of defaults, and ongoing monitoring/deviation-correction directly stop most of the management-tool and default-access vectors that T1602.002 relies on to dump network device configs; the bounded remainder is post-compromise in-memory extraction or novel zero-day access methods outside the template scope.
T1606.002detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized changes to federation/SSO settings or certificates that enable SAML token forgery, but this is limited to configuration drift rather than reliably catching the forgery act, private-key compromise, or resulting token use itself.
T1606.002prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, change defaults, minimize privileged accounts, monitor for deviations) directly block the most common vectors for obtaining/using a token-signing certificate or federation trust, but cannot stop an already-privileged adversary who can add their own trusted certificate or compromise a private key elsewhere.
T1609detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous container admin commands or config changes enabling them (e.g. via management tools or logs), but this is limited to configuration drift rather than reliably catching in-flight technique use across all container admin paths.
T1609prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the bulk of the technique by enforcing hardened baselines (disable unnecessary services/daemons, minimize privileged identities, change defaults, restrict utilities and remote management functions) on container hosts and orchestration components; the named remainder is adversary abuse that still succeeds when the admin service must remain exposed or when the attacker already holds sufficient permissions inside an allowed configuration.
T1610detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations can surface unauthorized or non-baseline container deployments (especially privileged/vulnerable ones), but this is limited to post-deployment configuration checks rather than reliably catching all deployment methods or runtime evasion.
T1610prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary functions/services/identities, restricting utilities, changing defaults, etc.), change management, and monitoring/deviation correction directly stop many insecure/privileged container deployments that would otherwise bypass defenses or enable escape, but do not block all adversary means (e.g. API-driven malicious image use from approved baselines or runtime payload download).
T1611detects — A.8.9 requires monitoring configurations with tools to detect deviations from secure templates (including privileged containers, unnecessary functions, bind mounts, default creds, etc.), which surfaces many T1611 vectors after the fact; it does not instrument runtime escape attempts or hypervisor-level exploits outside configuration checks.
T1611prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting privileged access and utilities, changing defaults, minimizing admin identities) directly block multiple documented T1611 vectors such as privileged containers, bind mounts, exposed docker.sock, and insecure defaults, but leave residual paths like kernel exploits, unshare/keyctl abuse, and hypervisor vulnerabilities unaddressed.
T1612detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface anomalous or unauthorized image builds on the host (especially if they alter recorded configurations), but this is limited to post-build detection within the organization's defined scope rather than reliably catching the build technique itself or all container-specific cases.
T1612prevents — A.8.9's processes, standard secure templates (disabling unnecessary functions/services, restricting utilities, changing defaults), enforcement, monitoring for deviations, and change management constrain the ability to invoke the Docker build API or add malware via custom images on the host, but do not block all such builds (e.g., approved base images or privileged changes that still follow process).
T1613detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing settings/activities/deviations with management tools) can surface anomalous discovery behavior or misconfigurations that enable T1613 (e.g. exposed dashboards/APIs, excessive privileges, insecure defaults), but this is limited to configuration-state anomalies rather than directly detecting the technique in flight or all discovery vectors like log leakage.
T1613prevents — A.8.9's secure configuration templates, enforcement of baselines (disabling unnecessary services/functions, restricting utilities and privileged access, changing defaults), monitoring for deviations, and change control directly block many common discovery vectors (e.g., exposed dashboards, insecure APIs, leaky logs, unnecessary kubelet endpoints) on container platforms, but do not reach all discovery methods (e.g., legitimate API use from a compromised pod or misconfigurations outside the defined templates).
T1615detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface anomalous Group Policy changes or settings after the fact on managed Windows systems, but this is limited to deviation detection rather than reliably catching the reconnaissance commands (gpresult, Get-DomainGPO) themselves, with large scope gaps for unmonitored assets or stealthy reads.
T1620detects — A.8.9's monitoring of configurations, deviation detection against secure templates, and review of activities can surface anomalous reflective loading that deviates from approved process/memory baselines or introduces unauthorized code, but this is limited to configuration-focused tools rather than general behavioral or memory execution monitoring.
T1621detects — A.8.9's monitoring of configurations, deviation detection from secure templates, password strength evaluation, and review of activities can surface anomalous login/MFA patterns or misconfigurations enabling fatigue attacks, but this is limited to configuration drift rather than directly detecting the technique in flight across all platforms and vectors.
T1647detects — A.8.9 requires monitoring of configurations against target templates and review of deviations (including via system management tools), which can surface plist modifications on managed macOS systems but only where those files are in scope of the defined templates and monitoring; the technique's use on arbitrary user-controlled plists or for non-configuration purposes falls outside this.
T1647prevents — A.8.9 mandates secure configuration templates, enforcement processes, change control, and monitoring that directly constrain plist modifications on macOS (e.g. disabling unnecessary services, restricting privileged changes, enforcing baselines on info.plist/LaunchAgent files); this stops many adversary uses but leaves a slice reachable via authorized admin sessions or unmonitored user-level plist edits.
T1648detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including in cloud services) can surface unauthorized or anomalous serverless function creation/invocation as a config drift, but this is limited to post-creation detection of misconfigurations rather than reliably catching the technique's runtime abuse, event-triggered persistence, or privilege-escalating side effects across all platforms.
T1648prevents — A.8.9 mandates secure configuration templates, enforcement, change control and monitoring that can block creation or alteration of insecure serverless functions (e.g. via hardened baselines, disabled unnecessary services, changed defaults, minimized privileges), but leaves many adversary paths (event-triggered creation, IAM abuse, post-deployment invocation) outside its direct reach.
T1649detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface certificate-related misconfigurations (e.g. insecure defaults, excessive enrollment rights, or improper SAN/EKU settings) that enable T1649, but does not broadly detect the theft or forging actions themselves once they occur.
T1649prevents — A.8.9's secure-configuration templates and enforcement (disable unnecessary services/identities, change defaults, minimize privileged access, monitor for deviations) directly block several T1649 vectors such as default cert settings, over-permissive enrollment rights, and misconfigured EKU/SAN values, but leave the remainder of theft vectors (crypto API extraction, golden CA key compromise, registry/file theft) untouched.
T1651detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface abuse of cloud management services (e.g. via anomalous config changes or privileged command execution), but this is limited to configuration-focused tools rather than general command or behavioral detection on IaaS VMs.
T1651prevents — A.8.9's processes, standard secure-configuration templates, and monitoring directly close the bulk of the technique by enforcing least-privilege identities, disabling unnecessary services/agents, restricting powerful utilities, and detecting deviations that would allow abuse of cloud management services such as RunCommand; the named remainder is post-compromise abuse of already-authorized administrative or delegated accounts that satisfy the hardened template.
T1653detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and comparison against target templates to detect deviations (including in power-related settings), but this is scoped to configuration drift rather than specifically to adversarial abuse of power settings or deletion of shutdown-related files, leaving a large remainder of the technique undetected.
T1653prevents — A.8.9 requires defining, enforcing and monitoring secure configuration templates that explicitly include disabling/restricting unnecessary functions/services, changing defaults, and invoking inactivity timeouts; these directly constrain the abuse of powercfg, lock-screen timeouts, hibernate/disk timeouts and similar settings that T1653 relies on, but the control stops at requiring templates and monitoring rather than guaranteeing enforcement against every possible abuse vector or platform, leaving a genuine residual slice.
T1654detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing settings/activities with management tools) can surface anomalous log-access or enumeration behaviors when they deviate from the enforced baseline, but this is indirect, limited to configuration drift rather than real-time log-enumeration detection, and does not address centralized SIEM targeting or real-time adversary monitoring of IR logs.
T1659detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and deviation detection against secure templates, which can surface anomalous configuration changes or unauthorized alterations that enable upstream channel compromise and content injection, but this is indirect, post-compromise, and limited to observable configuration state rather than real-time traffic or injection in flight.
T1666detects — A.8.9 explicitly requires monitoring configurations with tools, regular reviews, comparison against target templates, and addressing of deviations; this surfaces unauthorized hierarchy changes (e.g. new accounts/subscriptions or LeaveOrganization calls that alter enforced policies) when they deviate from recorded secure baselines, but only for monitored/configured elements within the organization's defined scope rather than all possible IaaS hierarchy modifications.
T1666prevents — A.8.9 mandates processes, standard secure-configuration templates, change control, and ongoing monitoring/enforcement of defined configurations (including for cloud services); this directly constrains unauthorized or incorrect hierarchy modifications that would violate the enforced baseline, but only for changes that cross the configuration boundary rather than all permissioned API calls that can still occur before enforcement or via privileged bypass.
T1669detects — A.8.9 requires monitoring configurations with tools to verify settings, detect deviations from secure templates (e.g. disabled insecure services, restricted access, changed defaults), and address them; this surfaces unauthorized Wi-Fi changes or insecure wireless configs on managed assets but does not broadly detect physical proximity attacks, dual-homed bridging, or post-connection sniffing/AiTM.
T1669prevents — A.8.9 mandates secure configuration templates and enforcement (disabling unnecessary services/functions, restricting access to utilities, changing defaults, minimizing privileged identities) that can prevent open or weakly secured Wi-Fi networks from existing, but leaves physical proximity attacks, dual-homed bridging via already-compromised devices, and credential-based access (T1078) largely untouched.
T1671detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface malicious OAuth integrations or anomalous app consents as configuration drift or unauthorized changes, but only for monitored/in-scope services and only after the integration is established.
T1671prevents — A.8.9 requires secure configuration templates, enforcement of defined settings (including disabling unnecessary functions/services/identities, restricting powerful utilities, and changing defaults), monitoring for deviations, and change management processes that would block many unauthorized or insecure OAuth app integrations and service principals when applied to cloud/SaaS environments; however, the control is general-purpose and does not specifically address consent flows, token persistence, or post-consent integration abuse, leaving a genuine slice of the technique unaddressed.
T1673detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous enumeration of VMs (e.g. via unexpected CLI/GUI use on hypervisors or config changes), but this is limited to monitored/configured assets and does not broadly instrument for the discovery technique itself.
T1675detects — A.8.9's monitoring of configurations, comparison against templates, and review of activities/deviations can surface anomalous ESXi admin commands or config changes enabling T1675, but this is limited to configuration drift rather than reliably catching in-flight guest command execution via APIs or tools.
T1675prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, restricting privileged access and utilities, baseline monitoring with deviation correction) can prevent abuse of ESXi/VMware Tools daemons and guest-execution APIs on managed systems, but this is only a slice: the technique can still be used against unmanaged/out-of-scope assets, legacy defaults, or via authorized management paths that the control does not universally prohibit.
T1677detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface unauthorized changes to CI config files or referenced build artifacts (the core of T1677), but this is limited to post-change detection on managed assets and does not broadly cover public/fork-based or indirect scenarios before execution.
T1677prevents — A.8.9's processes, standard secure-configuration templates, change-management enforcement, and monitoring directly close the Direct and Indirect poisoning vectors by locking down CI config files, referenced scripts, default credentials, unnecessary services, and privileged access on build infrastructure; they do not reach Public Pipeline Execution from external forks or untrusted inputs that the technique exploits via permissive triggers and self-hosted runners.
T1679detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including changes to files, services, or settings) can surface selective-exclusion artifacts left by the technique on managed assets, but only where those changes intersect recorded configuration items rather than the ransomware's runtime logic or unmonitored exclusions.
T1680prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary functions/services, restricting utilities and parameters, minimizing privileged access) can prevent many of the listed discovery commands from being available or executable, but this is only a slice — many native commands/utilities remain required for legitimate system operation and cannot be removed.
T1685detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including changes to security settings, services, or logging) surfaces tampering with defensive tools or configs as deviations, but only for monitored/config-managed items and not the full range of in-memory, driver-based, or non-config tampering described in T1685.
T1685prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of baselines (including disabling unnecessary services, restricting utilities, changing defaults, and addressing deviations) stop many of the configuration-file, Registry-key, service, and sensor-tampering actions named in T1685 before they can succeed on managed assets; the remainder is the technique's in-memory, driver-based, anti-tampering-bypass, and already-compromised-host slices that the control does not reach.
T1685.001detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations (including via system management tools and logs of changes) surfaces unauthorized or anomalous modifications to EventLog service, registry keys, auditpol settings, or related configs that implement the technique.
T1685.001prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary services/functions, restricting powerful utilities, enforcing baselines that keep the EventLog service running with audit policies intact, and addressing deviations — which stops the T1685.001 techniques (service disable, registry edits, auditpol clears) from succeeding on managed systems; partial because the control is a process that depends on implementation rigour, does not reach unmanaged/legacy assets or post-compromise admin-level changes, and leaves a slice of the technique (e.g., non-Windows or out-of-scope components) untouched.
T1685.002detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing of deviations (including via automatic enforcement), which surfaces unauthorized changes to cloud logging settings before or during T1685.002 execution; mostly because the control is scoped to configuration items under organizational templates and may miss ad-hoc or unmonitored SaaS/identity-provider logging toggles outside that inventory.
T1685.002prevents — A.8.9's processes, standard secure-configuration templates, and ongoing monitoring/enforcement of baselines (including disabling unnecessary functions/services, restricting privileged access, and addressing deviations) directly stop many of the configuration changes the technique relies on, but only for systems built and maintained under the control; post-compromise privileged abuse that bypasses those baselines is outside its reach.
T1685.003detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface spoofed UIs or tampered security tool configurations as anomalies on monitored systems, but this is limited to configuration drift rather than reliably catching UI manipulation or falsified status indicators in real time.
T1685.004detects — A.8.9 requires monitoring of configurations (including comparison against secure templates) and review of activities performed, which can surface unauthorized changes to auditd/audit.rules/audit.conf on Linux systems; this is a genuine but minority slice of the technique (hooking library functions or killing the daemon without touching config leaves no configuration deviation).
T1685.004prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary services/functions, restricting privileged changes, recording/configuring auditd-like components, and correcting deviations, which stops many (but not all) of the root-privileged disable/modify paths described in the technique.
T1685.005detects — A.8.9 requires monitoring configurations with management tools, regular reviews, and comparison against target templates to detect deviations (including unauthorized changes that could clear logs), but this is limited to configuration state rather than directly observing the specific clearing commands, GUI actions, or file deletions in the technique.
T1685.005prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/utilities, restricting powerful programs, minimizing privileged access, monitoring for deviations) can block some clearing vectors such as default tools or direct file deletion, but cannot stop an admin using wevtutil, PowerShell, or Event Viewer when privileges are already present.
T1685.006detects — A.8.9's monitoring of configurations (comparing actual vs. target templates, reviewing with management tools, addressing deviations) can surface unauthorized log-clearing actions that alter expected logging configurations or files, but this is indirect, not guaranteed for all log-clearing methods, and limited to configuration-focused tools rather than general log-integrity or anomaly detection.
T1686detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations (including via automatic enforcement), which surfaces unauthorized firewall changes as configuration drift.
T1686prevents — A.8.9 mandates processes, standard secure-configuration templates and ongoing monitoring/enforcement that explicitly include disabling unnecessary functions/services, restricting powerful utilities, changing defaults, and correcting deviations — directly stopping most of the configuration changes T1686 relies on (firewall rules, services, profiles) before or as they occur.
T1686.001detects — A.8.9's monitoring of configurations, comparison against templates, and review of deviations (including changes to firewall/security group rules) can surface unauthorized firewall modifications in IaaS after they occur, but only for configurations inside the organization's defined scope and tooling; the technique's pre-compromise acquisition of permissions and many cloud-native changes sit outside that slice.
T1686.001prevents — A.8.9 mandates processes, standard secure templates and ongoing enforcement/monitoring that explicitly include disabling unnecessary functions/services, restricting powerful utilities and host parameters, and automatic enforcement of target configurations for cloud services and networks — directly stopping the unauthorized rule changes that constitute the technique.
T1686.002detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations, which surfaces unauthorized firewall rule changes or ACL modifications on network devices.
T1686.002prevents — A.8.9's defined processes, standard secure-configuration templates (disabling unnecessary services/identities, restricting utilities, changing defaults, etc.), enforcement tools, change management, and ongoing monitoring+deviation correction directly stop most unauthorized firewall/ACL rule changes on network devices from succeeding or persisting.
T1686.003detects — A.8.9 explicitly requires monitoring configurations with management tools, regular reviews, comparison against target templates, and addressing deviations, which surfaces unauthorized firewall changes on Windows hosts as configuration drift.
T1686.003prevents — A.8.9 mandates secure configuration templates, enforcement processes, disabling of unnecessary services/functions, and ongoing monitoring/correction of deviations, which directly blocks most unauthorized firewall modifications or insecure defaults on Windows hosts; the bounded remainder is post-compromise privileged changes that can still bypass enforcement.
T1687detects — A.8.9's monitoring of configurations (comparing against templates, reviewing deviations, evaluating password strengths) can surface some misconfigurations or changes that indicate exploitation of defensive components, but does not broadly detect the exploitation technique itself or its effects on EDR/AV/firewalls.
T1687prevents — A.8.9's secure configuration templates and enforcement (disabling unnecessary services/functions, minimizing privileged access, changing defaults, restricting utilities) directly close many exploitable misconfigurations and default states in defensive components that T1687 relies on, but do not address the underlying programming errors/vulnerabilities in those components themselves
T1688detects — A.8.9's monitoring of configurations, comparison against target templates, and review of activities/deviations can surface changes to BCD, registry values for safe mode services, or unexpected boot configurations, but this is limited to post-boot or periodic checks rather than reliably catching the technique in flight or all variants (e.g., malicious COM objects).
T1688prevents — A.8.9's processes, standard secure-configuration templates, and monitoring explicitly require disabling unnecessary services/functions, restricting powerful utilities, enforcing baselines on boot-related settings, and addressing deviations; this stops most (but not all) of the BCD/registry/COM abuse paths that force or persist safe-mode boots, leaving a bounded remainder for post-boot service additions and non-enforced legacy configurations.
T1689detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of deviations (including version changes or insecure defaults) can surface some downgrade attempts that alter recorded configurations, but misses in-memory/version-forcing attacks, network-protocol downgrades, and boot-manager changes that do not deviate from a stored template.
T1689prevents — A.8.9's secure configuration templates, baseline enforcement, disabling of unnecessary functions/services, changing of defaults, and monitoring/deviation correction directly block many downgrade vectors (e.g. forcing vulnerable PowerShell versions, insecure protocols, or boot managers) by locking in current secure versions and settings; it reaches only a slice because it does not address all backward-compatibility downgrade paths an adversary can force at runtime or via unpatched legacy components.
T1690detects — A.8.9's monitoring of configurations, comparison against secure templates, and review of activities/deviations can surface some T1690 instances (e.g. altered HISTFILE/HISTCONTROL, disabled logging settings, or changed PSReadLine options) when they deviate from a hardened baseline, but this is limited to monitored/configured assets and does not broadly detect all adversary techniques like prepending spaces or network device `no logging`.
T1690prevents — A.8.9 requires secure-configuration templates and enforcement that include disabling unnecessary functions/services, restricting powerful utilities, and hardening defaults (including HIST* variables and PSReadLine options); this stops many of the listed configuration changes that impair history logging, but leaves a slice reachable via runtime environment manipulation or post-compromise commands that the baseline itself does not block.

Prevented OWASP Web Top 10 (2025) risks (19)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A02→M A03→P A05←P →P A06←P A07→P A08→P A10←P

Why these map — AI rationale (under review)

A01mitigates — Configuration enforcement (templates, monitoring, deviation correction) can bound the blast radius or block some misuse vectors of a realized authorization failure (e.g. via hardened defaults, disabled services, restricted utilities), but does not address the core authorization-decision or bypass defects named by the category.
A01prevents — A.8.9's secure configuration templates and enforcement (e.g. minimizing privileged accounts, disabling unnecessary functions/services, restricting powerful utilities, changing defaults) directly block several A01 members that arise from insecure defaults or overly permissive setups, but leave untouched many others (e.g. missing authorization checks, IDOR, CSRF, path traversal) that are not configuration defects.
A02mitigates — A.8.9's defined processes, standard secure-configuration templates, change control, monitoring and automated enforcement directly reduce the realized consequences and attack surface of weak defaults, incomplete hardening and exposed settings named by A02:2025.
A03mitigates — Configuration enforcement, monitoring for deviations, and secure baseline templates (including disabling unnecessary services, changing defaults, and minimizing privileges) can limit the blast radius or ease of exploiting a compromised/outdated dependency or pipeline once present, but do not reduce the realized weakness itself.
A05mitigates — A.8.9's monitoring and enforcement of secure configurations can catch and limit some injection vectors (e.g. via disabled unnecessary services, restricted utilities, or hardened defaults that bound attack surface), but does not neutralize untrusted input crossing interpreter boundaries, which is the core of the A05 weakness class.
A07mitigates — A.8.9's secure-configuration templates and monitoring directly harden authentication mechanisms (e.g. disabling default credentials, enforcing strong password parameters, session timeouts, minimal privileged accounts), which bounds the blast radius or success rate of several A07 failures without stopping every bypass, brute-force, or hijack vector.
A07prevents — A.8.9's secure-configuration templates and enforcement directly close several authentication-failure vectors (default credentials, privileged accounts, unused services, session timeouts, clock sync for replay protection) when applied at install and maintained; they leave the dominant credential-stuffing, weak-reset, and session-management logic flaws untouched.
A08mitigates — Configuration enforcement, change control, and monitoring reduce the attack surface for unsigned updates and some CI/CD paths by preventing unauthorized or drifted configurations that could enable integrity failures, but do not address core issues like insecure deserialization, lack of signature verification on trusted code/data, or many supply-chain integrity failures.
A08prevents — A.8.9's secure configuration templates, enforcement of baselines, disabling of insecure functions/services, and monitoring/deviation correction directly prevent many integrity failures (e.g. unsigned updates via enforced secure defaults and change control, CI/CD paths via config management of build pipelines, insecure deserialization via disabled unsafe features), but leave real gaps in the class such as runtime trust of signed-but-malicious code or supply-chain data tampering outside configuration enforcement.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.