{"data":{"id":"AC-03","name":"Access Enforcement","family":"AC","family_name":"Access Control","withdrawn":false,"description":"Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.","supplemental_guidance":"Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection (PE) family.","enhancements":[{"id":"AC-03(01)","name":"Restricted Access to Privileged Functions","withdrawn":true,"incorporated_into":["AC-06"]},{"id":"AC-03(02)","name":"Dual Authorization","statement":"Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].","baselines":[]},{"id":"AC-03(03)","name":"Mandatory Access Control","statement":"Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy:\na. Is uniformly enforced across the covered subjects and objects within the system;\nb. Specifies that a subject that has been granted access to information is constrained from doing any of the following;\n1. Passing the information to unauthorized subjects or objects;\n2. Granting its privileges to other subjects;\n3. Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components;\n4. Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and\n5. Changing the rules governing access control; and\nc. Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints.","baselines":[]},{"id":"AC-03(04)","name":"Discretionary Access Control","statement":"Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:\na. Pass the information to any other subjects or objects;\nb. Grant its privileges to other subjects;\nc. Change security attributes on subjects, objects, the system, or the system’s components;\nd. Choose the security attributes to be associated with newly created or revised objects; or\ne. Change the rules governing access control.","baselines":[]},{"id":"AC-03(05)","name":"Security-relevant Information","statement":"Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.","baselines":[]},{"id":"AC-03(06)","name":"Protection of User and System Information","withdrawn":true,"incorporated_into":["MP-04","SC-28"]},{"id":"AC-03(07)","name":"Role-based Access Control","statement":"Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].","baselines":[]},{"id":"AC-03(08)","name":"Revocation of Access Authorizations","statement":"Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations].","baselines":[]},{"id":"AC-03(09)","name":"Controlled Release","statement":"Release information outside of the system only if:\na. The receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls]; and\nb. [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release.","baselines":[]},{"id":"AC-03(10)","name":"Audited Override of Access Control Mechanisms","statement":"Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].","baselines":[]},{"id":"AC-03(11)","name":"Restrict Access to Specific Information Types","statement":"Restrict access to data repositories containing [Assignment: organization-defined information types].","baselines":[]},{"id":"AC-03(12)","name":"Assert and Enforce Application Access","statement":"a. Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions];\nb. Provide an enforcement mechanism to prevent unauthorized access; and\nc. Approve access changes after initial installation of the application.","baselines":[]},{"id":"AC-03(13)","name":"Attribute-based Access Control","statement":"Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].","baselines":[]},{"id":"AC-03(14)","name":"Individual Access","statement":"Provide [Assignment: organization-defined mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: organization-defined elements].","baselines":["privacy"]},{"id":"AC-03(15)","name":"Discretionary and Mandatory Access Control","statement":"a. Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and\nb. Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-03","name":"Access Enforcement","description":"Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.","discussion":"Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection (PE) family.","related_controls":["AC-02","AC-04","AC-05","AC-06","AC-16","AC-17","AC-18","AC-19","AC-20","AC-21","AC-22","AC-24","AC-25","AT-02","AT-03","AU-09","CA-09","CM-05","CM-11","IA-02","IA-05","IA-06","IA-07","IA-11","IA-13","MA-03","MA-04","MA-05","MP-04","PM-02","PS-03","PT-02","PT-03","SA-17","SC-02","SC-03","SC-04","SC-12","SC-13","SC-28","SC-31","SC-34","SI-04","SI-08"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.5.15","A.5.33","A.8.3","A.8.4","A.8.18","A.8.20","A.8.26"],"iso_27002_2022":["5.15","8.3","8.4"],"cobit_2019":["DSS05","DSS06"],"pci_dss_v4":["1.2.8","3.4","7.2","7.3"],"nist_csf_2":["PR.AA-05","PR.DS-01","PR.DS-10","PR.IR-01"],"cis_controls_v8":["CIS 3.3","CIS 6","CIS 6.7","CIS 6.8","CIS 13.9"],"soc2_tsc":["CC6.1","CC6.6","CC6.6-POF2"],"finos_ccc":["CCC-C05","CCC-C11"],"iso_42001_2023":["A.9.2","A.9.4"],"iec_62443":["3-3 SR 2.1","3-3 SR 4.1"],"asd_e8":["E8-8 ML3"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 22-23"],"mas_trm":["9","15"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4","SYS.1.1","SYS.2.1"],"anssi":["Hygiene.14","Hygiene.15","Hygiene.17","SecNumCloud.10.3"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.B.d(60)","IV.C(61)"],"gdpr":["Art.5(1)(f)","Art.25(2)","Art.32(1)(b)"],"dora":["Art.9(4)(c)"],"bio2":["5.15","8.3","8.4"],"rbi_csf":["Annex1.8","ITGRCA.19"],"fisc":["FISC.T2","FISC.T5","FISC.T11"],"lgpd_bcb":["BCB.Art.3","BCB.OpenFinance","BCB.PIX","LGPD.Art.11","LGPD.Art.46"],"hkma_tme1":["TME1.8.1","TME1.10.3","TME1.11.2"],"mlps_2":["8.1.3.2","8.1.4.2","8.2","8.4","8.5"],"dnb_good_practice":["DNB.12.3","DNB.17.2","DNB.20.1"],"cra":["CRA.I.2d"],"swift_cscf":["SWIFT.2.9","SWIFT.2.11A","SWIFT.5.1","SWIFT.5.4","SWIFT.6.3"],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2","2-7"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-IX","CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CTO-1","CTO-5"],"cbn_csf":["Part3.2","Part5.2"],"popia":["s19"],"sa_js2":["JS2-7.1"],"bcbs_239":["Principle 11"],"bot_cyber":["Ch2.2"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.2"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.7(b)","II.C.13(a)","II.C.15","II.C.15(a)","II.C.15(b)","II.C.18"],"hipaa_sr":["§164.308(a)(3)(i)","§164.308(a)(3)(ii)(A)","§164.308(a)(4)(i)","§164.308(a)(4)(ii)(B)","§164.308(a)(4)(ii)(C)","§164.312(a)(1)","§164.314(b)(2)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.7"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC"],"nerc_cip":["CIP-007-6","CIP-011-3"],"nrc_73_54":["73.54(c)(1)","RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":["5.1","5.9"],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":["AWWA Sec 3"],"iaea_nss":["Sec 5.3"],"pci_pts":[],"fips_140":[],"cbest":["CBEST.9"],"tiber_eu":["TIBER.CONF"],"pci_hsm":["4","8"],"common_criteria":["CC Part 2 — FDP"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.10(d)","§11.10(g)"],"fda_cyber":["SA-1","SA-4"],"hitrust_csf":["01.a","01.c","13.e"],"iso_27799":["9.1","9.5","H.4"],"lloyds_ms":["MS1.1","MS2.1","MS5.1","MS6.1","MS8.3"],"naic_ds":["4-access","4B"],"nhs_dspt":["NDG-1.1","NDG-4.1"],"pra_ss1_23":["P3.3","P3.6","P-IT.1"],"solvency_ii":["DR.266-DataSec","EIOPA-ICT-4.4"],"owasp_masvs_v2":["MASVS-AUTH-1","MASVS-AUTH-3","MASVS-PLATFORM-1","MASVS-PRIVACY-1","MASVS-PRIVACY-4","MASVS-STORAGE-1"],"csa_ccm_v4":["DSP-17","IAM-16"],"csa_aicm":["DSP-17","IAM-16","MDS-07"],"ccss_v9":["1.03.5","1.05.1"],"mica":["Art.40(1)","Art.55(1)","Art.62(9)","Art.63(1)","Art.67(1)","Art.97(1)"],"basel_sco60":["SCO60.61","SCO60.62","SCO60.66"],"bssc":["GSP-11","KMS-06","KMS-09","NOS-05","TIS-07"],"sec_custody_digital":["SEC-CD-02","SEC-CD-05"],"dpdpa":["Act.8(5)","Act.11","Rules.6(1)(b)","Rules.Sch1.B.3-4","Rules.Sch1.B.7","Rules.Sch2"]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement mechanisms restrict which accounts and processes can read sensitive credential stores such as SAM databases, LSASS memory, and NTDS.dit files, limiting the ability of adversaries to extract hashed or plaintext credentials from the operating system."},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Mandatory access controls and role-based permissions on files and directories prevent unauthorized processes and users from reading sensitive data stored on local systems, reducing the scope of collection available to adversaries."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Enforcing authorization policies on remote service endpoints ensures that only authenticated, authorized users can establish remote sessions via RDP, SSH, SMB, or other protocols, blocking lateral movement by adversaries lacking proper entitlements."},{"id":"T1025","name":"Data from Removable Media","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on removable media mount points and device interfaces restricts which users and processes can read data from USB drives and other removable storage, limiting adversary collection from physical media."},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on file systems and execution environments restricts adversaries from writing or reading obfuscated payloads in protected directories, limiting their ability to stage and retrieve encoded malicious content."},{"id":"T1036","name":"Masquerading","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict access controls on system directories and binary locations prevents adversaries from placing masquerading files alongside or in place of legitimate executables, as write access to trusted paths is denied."},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on boot and logon script directories prevents unauthorized modification of startup scripts, blocking adversaries from inserting malicious initialization commands that execute during system or user logon."},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Data-level access controls and egress authorization policies restrict which processes and users can transmit data over command-and-control channels, limiting unauthorized exfiltration by preventing access to sensitive data objects in the first place."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting WMI namespace permissions and limiting remote DCOM access through access enforcement mechanisms prevents unauthorized users from executing arbitrary commands or queries via Windows Management Instrumentation."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network interfaces and data repositories prevents unauthorized processes from reading sensitive data and transmitting it over alternative protocols such as DNS, FTP, or SMTP for exfiltration."},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on physical device interfaces and restricting which users can mount or write to removable media prevents adversaries from copying sensitive data to physical media for offline exfiltration."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions on task scheduling services (cron, Task Scheduler, at) through access enforcement ensures only authorized administrators can create or modify scheduled tasks, preventing adversary persistence and execution."},{"id":"T1055","name":"Process Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Process-level access controls, including memory protection boundaries and inter-process permission enforcement, restrict which processes can read or write to the memory of other processes, impeding injection techniques."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on scripting engines and command interpreters through execution policies, shell restrictions, and application allowlists prevents unauthorized users from invoking PowerShell, cmd, bash, or other interpreters."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on log files, event logs, and audit records prevents unauthorized users and processes from deleting or modifying forensic evidence, preserving indicators of compromise."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on software deployment tools restricts which accounts can push packages and execute remote installations, preventing adversaries from hijacking deployment infrastructure for lateral movement."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Fine-grained access enforcement ensures that even when adversaries obtain valid credentials, the compromised accounts are constrained by least-privilege authorization policies that limit accessible resources and actions."},{"id":"T1080","name":"Taint Shared Content","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access controls on shared network drives and collaboration platforms restrict which users can write or modify shared content, preventing adversaries from tainting files used by other users for lateral movement."},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Network-layer access enforcement through proxy authorization controls and firewall rules restricts which systems and users can establish outbound connections, hindering adversary use of proxy infrastructure for C2."},{"id":"T1091","name":"Replication Through Removable Media","tactics":["initial-access","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on removable media autorun capabilities and USB device mounting restricts execution of binaries from removable media, preventing malware replication and initial access via infected devices."},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement at the network layer through protocol-specific authorization and firewall policies restricts unauthorized non-application-layer communications, disrupting adversary C2 channels using raw TCP/UDP or ICMP."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict authorization on directory services and identity management interfaces prevents unauthorized users from modifying account attributes, group memberships, or permissions for privilege escalation and persistence."},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement mechanisms that lock accounts or restrict authentication endpoints after policy violations complement brute force prevention by ensuring that even successfully guessed credentials face additional authorization barriers."},{"id":"T1114","name":"Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on mailbox permissions, mail server APIs, and email delegation settings restricts which users and applications can read email content, limiting adversary collection of organizational communications."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Authorization controls on VPN gateways, remote desktop services, and other external access points ensure only explicitly permitted accounts can establish remote sessions, limiting adversary initial access and persistence."},{"id":"T1134","name":"Access Token Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement validates process tokens against authorization policies at each resource request, making it harder for adversaries to gain elevated privileges simply by manipulating tokens without corresponding entitlements."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting account creation privileges through authorization policies ensures only designated administrators can provision new local, domain, or cloud accounts, preventing adversaries from creating persistent backdoor identities."},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on browser session data and web application authorization tokens limits what resources a hijacked browser session can access, constraining the impact of session takeover attacks."},{"id":"T1187","name":"Forced Authentication","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on network authentication protocols and file share permissions prevent adversaries from exploiting forced authentication scenarios by restricting what credentials are automatically sent to remote resources."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Authorization controls on public-facing application interfaces, including API gateways and web application firewalls, enforce input validation and privilege checks that limit the impact of exploitation attempts."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on software repositories, build pipelines, and deployment channels restricts who can introduce code or binaries, reducing the risk of supply chain compromise through unauthorized modifications."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting BITS job creation and management permissions through access enforcement prevents non-administrative users from scheduling background transfers that could be used for persistence or data staging."},{"id":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement ensures that trusted third-party connections are limited to specific, authorized services and data, preventing adversaries from pivoting through partner network trust relationships."},{"id":"T1200","name":"Hardware Additions","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Physical and logical access enforcement on device interfaces prevents unauthorized hardware additions such as rogue network adapters, keyloggers, or implant devices from gaining system access."},{"id":"T1205","name":"Traffic Signaling","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network interfaces and firewall configurations prevents unauthorized modification of traffic signaling mechanisms like port knocking, ensuring only approved services respond to connection requests."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Network segmentation and service-level access controls restrict which systems can connect to internal services, limiting adversary ability to exploit remote service vulnerabilities for lateral movement."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on information repositories such as wikis, SharePoint, and databases restricts data retrieval to authorized users, preventing adversary collection of sensitive organizational knowledge."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting execution permissions on system binaries and signed executables through application control policies prevents adversaries from using trusted binaries as proxies to bypass security controls."},{"id":"T1219","name":"Remote Access Software","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on outbound network connections and application allowlists restricts installation and use of remote access tools, preventing adversaries from establishing unauthorized remote management channels."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing immutable file and directory permissions through mandatory access controls prevents adversaries from using chmod, icacls, or similar utilities to weaken protection on critical system and data files."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on domain and tenant policy objects restricts which administrators can modify Group Policy or Azure AD policies, preventing adversaries from weakening security configurations across the environment."},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on critical data stores and backup repositories prevent unauthorized deletion operations, ensuring adversaries cannot destroy data without first obtaining explicitly granted administrative privileges."},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting write and execute permissions on critical file systems through access enforcement limits the ability of ransomware to encrypt data, particularly when combined with role separation between data owners and administrators."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on service management interfaces restricts which accounts can stop, disable, or reconfigure critical services, preventing adversaries from disrupting operations without elevated privileges."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to backup management tools, volume shadow copies, and recovery consoles through authorization policies prevents adversaries from deleting recovery resources needed for system restoration."},{"id":"T1491","name":"Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on web server content directories and internal portal resources restricts unauthorized modification, preventing adversaries from replacing pages with defacement content."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on firmware update mechanisms and BIOS/UEFI management interfaces restrict which accounts and processes can modify firmware, preventing unauthorized corruption of low-level system software."},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Network access enforcement through rate limiting, traffic filtering, and authorization policies on network infrastructure helps mitigate denial-of-service attacks by restricting unauthorized traffic volumes."},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on application endpoints through authentication requirements and rate-limiting policies prevents unauthorized users from overwhelming services with resource-exhausting requests."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access controls on server software installation directories, module registration, and extension loading mechanisms prevent unauthorized deployment of malicious server components for persistent backdoor access."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on container registries and image repositories restricts which accounts can push or modify container images, preventing adversaries from implanting trojaned images for later deployment."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing OAuth consent policies and application permission scopes through access controls limits which applications can request access tokens, reducing the risk of token theft through unauthorized app registrations."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud storage buckets, blobs, and containers through IAM policies and bucket policies restricts data retrieval to authorized principals, preventing unauthorized cloud data collection."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud account resource policies restricts which identities can create or modify cross-account data transfer configurations, preventing unauthorized exfiltration to adversary-controlled cloud accounts."},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to cloud management consoles and service dashboards through IAM policies and conditional access rules prevents unauthorized enumeration of cloud infrastructure and service configurations."},{"id":"T1539","name":"Steal Web Session Cookie","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on browser cookie stores and session management mechanisms restricts which processes can read session tokens, limiting adversary ability to steal web session cookies for account takeover."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on firmware update interfaces, BIOS settings, and boot configuration through physical and logical controls prevents unauthorized pre-OS boot modifications that evade operating system security."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions to create or modify system processes, services, and daemons ensures only authorized administrators can register new services, preventing adversary persistence through system process manipulation."},{"id":"T1546","name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on event-triggered execution mechanisms such as WMI subscriptions, shell configuration files, and registry autorun entries prevents adversaries from establishing persistent execution hooks."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Mandatory access controls and proper privilege separation ensure that elevation control mechanisms like UAC, sudo, and setuid binaries cannot be bypassed by unauthorized users to gain elevated privileges."},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement validates authentication material beyond simple token or hash presentation, requiring contextual authorization checks that detect and block use of stolen or forged alternate credentials."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting file system and registry access to locations where credentials may be stored prevents unauthorized users from discovering plaintext passwords, private keys, or other unsecured credential material."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on trust stores, certificate authorities, and code signing infrastructure prevents adversaries from installing unauthorized root certificates or modifying trust validation mechanisms."},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on password manager databases, keychain files, and credential vaults restrict which processes and users can query stored credentials, preventing bulk extraction of saved passwords."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on authentication system components such as domain controllers, PAM modules, and authentication libraries prevents unauthorized modification of the authentication process for credential harvesting or bypass."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Network-level access enforcement through authenticated and encrypted communication channels prevents adversary-in-the-middle attacks by ensuring that only authorized endpoints can participate in network conversations."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Kerberos infrastructure, including KDC services and ticket-granting mechanisms, restricts which accounts can request service tickets, limiting Kerberoasting and ticket forgery attacks."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access controls on COM objects and inter-process communication channels restrict which processes can invoke IPC mechanisms, preventing adversaries from leveraging trusted process communication for execution."},{"id":"T1561","name":"Disk Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on raw disk access and volume management APIs prevents unauthorized users and processes from directly wiping disk content or modifying disk structures for destructive impact."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on security tool configurations, logging services, and firewall settings prevents adversaries from disabling or modifying defensive capabilities without proper administrative authorization."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on remote session management, including idle session handling and terminal server reconnection policies, prevents adversaries from hijacking active SSH or RDP sessions for lateral movement."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on databases, file systems, and application data stores prevent unauthorized modification of stored or runtime data, ensuring data integrity against manipulation attacks."},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on outbound web service connections and cloud storage APIs restricts which processes can upload data to external services, preventing exfiltration via legitimate web platforms."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions on service control managers and launchctl interfaces through access enforcement prevents unauthorized users from creating or executing system services for malicious purposes."},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access controls on network shares and internal transfer mechanisms restrict which users can copy tools and files between systems, impeding adversary lateral tool transfer within the network."},{"id":"T1572","name":"Protocol Tunneling","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network interfaces and tunnel creation capabilities restricts which users and processes can establish protocol tunnels, disrupting adversary attempts to encapsulate C2 traffic."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on DLL directories, service binary paths, and execution flow paths prevents adversaries from placing malicious libraries or executables where they will be loaded by trusted applications."},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"IAM policies and access controls on cloud compute APIs restrict which accounts can create, modify, or delete virtual machines and snapshots, preventing unauthorized infrastructure manipulation for defense evasion."},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud infrastructure APIs and management consoles restricts discovery operations to authorized administrators, preventing adversaries from enumerating cloud resources for targeting."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on network device configurations and routing tables prevent unauthorized modification of network boundaries, blocking adversary attempts to bridge isolated network segments."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network device management interfaces and firmware update mechanisms prevents unauthorized modification of system images used by routers, switches, and other network infrastructure."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access controls on SNMP communities, network device CLI access, and configuration management interfaces restrict unauthorized retrieval of device configurations containing sensitive network architecture details."},{"id":"T1606","name":"Forge Web Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on web credential infrastructure, including SAML assertion signing keys and cookie generation mechanisms, prevents adversaries from forging authentication credentials without proper authorization."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to container runtime APIs and orchestration management interfaces through RBAC policies prevents unauthorized execution of administrative commands within container environments."},{"id":"T1610","name":"Deploy Container","tactics":["defense-evasion","execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on container orchestration platforms restricts which accounts can deploy new containers, preventing adversaries from running malicious workloads that evade host-based security controls."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on container runtime configurations, including seccomp profiles and namespace boundaries, restrict the ability of containerized processes to escape to the host operating system."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on container build APIs and image registries restricts which users can build images directly on host systems, preventing adversaries from creating malicious containers that bypass image scanning."},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to container orchestration APIs and service discovery endpoints through RBAC prevents unauthorized enumeration of running containers, pods, and associated resources."},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud storage listing APIs restricts which identities can enumerate storage objects, preventing adversaries from discovering and targeting sensitive data in cloud storage services."},{"id":"T1622","name":"Debugger Evasion","tactics":["defense-evasion","discovery"],"mapping_type":"mitigates","mapping_rationale":"Access controls on debugging interfaces and process inspection APIs restrict which accounts can attach debuggers or inspect process memory, limiting adversary ability to detect and evade analysis environments."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on property list files and application configuration directories on macOS prevents unauthorized modification of plist files used to configure system behavior and application settings."},{"id":"T1648","name":"Serverless Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on serverless function deployment and invocation through IAM policies restricts which identities can create or trigger Lambda functions, Azure Functions, or Cloud Functions for malicious execution."},{"id":"T1651","name":"Cloud Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud administration command execution through IAM policies and conditional access ensures only authorized operators can run management commands against cloud infrastructure resources."},{"id":"T1654","name":"Log Enumeration","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Access controls on log storage locations and query interfaces restrict which accounts can enumerate log data, preventing adversaries from using log access to map security monitoring capabilities."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the LSASS process through Protected Process Light and memory access controls prevents unauthorized processes from reading LSASS memory to extract cached credentials and Kerberos tickets."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on the SAM registry hive and associated system files prevents unauthorized extraction of local password hashes stored in the Security Account Manager database."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the NTDS.dit Active Directory database file and the Volume Shadow Copy service prevents unauthorized dumping of domain-wide credential hashes."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on LSA Secrets registry keys and the Security registry hive prevent unauthorized processes from extracting service account passwords, machine account credentials, and cached secrets."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on the cached domain credentials stored in the SECURITY registry hive limits adversary ability to extract DCC2 hashes for offline cracking."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting Active Directory replication permissions to authorized domain controllers prevents non-DC accounts from performing DCSync attacks to extract domain-wide password hashes via the MS-DRSR protocol."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on the /proc filesystem, particularly /proc/[pid]/mem and /proc/[pid]/maps, prevent unauthorized processes from reading memory of other processes to extract credential material on Linux systems."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict file permissions on /etc/passwd and /etc/shadow files ensures only root and authorized shadow group members can read password hashes, preventing unauthorized credential harvesting."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network device configurations restricts which administrators can configure port mirroring or traffic duplication, preventing adversaries from duplicating traffic for covert data exfiltration."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on RDP endpoints through Network Level Authentication requirements and user rights assignments restricts which accounts can establish Remote Desktop sessions for lateral movement."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to administrative shares (C$, ADMIN$, IPC$) through share permissions and user rights policies prevents unauthorized SMB-based lateral movement between Windows systems."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on DCOM launch and access permissions restricts which accounts can remotely instantiate COM objects, preventing adversaries from using DCOM for lateral movement across Windows networks."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting SSH access through authorized_keys management, AllowUsers directives, and key-based authentication enforcement limits which accounts can establish SSH sessions for lateral movement."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access controls on VNC server configurations and authentication requirements restrict which users can establish remote graphical sessions, preventing unauthorized lateral movement via VNC."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting WinRM access through TrustedHosts configurations and listener permissions prevents unauthorized accounts from executing remote commands via Windows Remote Management."},{"id":"T1021.007","name":"Cloud Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"IAM policies and conditional access rules on cloud service management APIs restrict which identities can access cloud services, preventing adversary lateral movement through cloud platform interfaces."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud VM connection methods, including serial console access and instance-level SSH, restricts direct access to virtual machines, preventing bypass of network-level security controls."},{"id":"T1036.003","name":"Rename System Utilities","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on system utility directories prevent adversaries from replacing or renaming system utilities with malicious variants, as write permissions to protected paths are restricted."},{"id":"T1036.005","name":"Match Legitimate Name or Location","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on trusted application directories and system paths prevents adversaries from placing malicious files with legitimate names in protected locations to deceive users and security tools."},{"id":"T1036.010","name":"Masquerade Account Name","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on account creation and naming conventions through directory service policies prevents adversaries from creating accounts with names designed to mimic legitimate service or administrative accounts."},{"id":"T1037.002","name":"Login Hook","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on macOS login hook configuration files restrict which users can modify the com.apple.loginwindow.plist, preventing unauthorized insertion of login hooks for persistence."},{"id":"T1037.003","name":"Network Logon Script","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to network logon script directories and Group Policy script configurations prevents adversaries from modifying domain logon scripts executed during user authentication."},{"id":"T1037.004","name":"RC Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on /etc/rc.d and init script directories restricts which users can create or modify RC scripts, preventing adversary persistence through system initialization script manipulation."},{"id":"T1037.005","name":"Startup Items","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to macOS StartupItems directories and launch configuration files prevents unauthorized installation of startup items that execute with elevated privileges during system boot."},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement restricts which processes can establish outbound encrypted connections over non-standard protocols, limiting adversary ability to exfiltrate data via symmetric-encrypted alternative channels."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access controls on network egress paths and application-level authorization restrict unauthorized processes from transmitting data over asymmetric-encrypted non-C2 protocols for exfiltration."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on network interfaces and data objects prevents unauthorized processes from sending sensitive data over unencrypted alternative protocols such as raw HTTP, FTP, or DNS."},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on USB device interfaces, including device access policies and removable storage write restrictions, prevents unauthorized data transfer to USB drives for physical exfiltration."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions on the at command and its associated spool directories prevents non-privileged users from scheduling malicious jobs for deferred execution and persistence."},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on crontab files and cron directories restricts which users can create or modify cron jobs, preventing adversary persistence through unauthorized scheduled task creation on Unix systems."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the Windows Task Scheduler service and task folder through ACLs prevents unauthorized users from creating or modifying scheduled tasks for execution and persistence."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on systemd timer unit files and the systemctl interface restricts which users can create or modify timer-based services for persistent scheduled execution on Linux systems."},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"RBAC policies on container orchestration platforms restrict which accounts can create CronJobs or Jobs, preventing adversaries from scheduling malicious workloads in Kubernetes or similar environments."},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on the ptrace system call through security modules like Yama restrict which processes can attach to and inject code into other processes via ptrace-based debugging interfaces."},{"id":"T1055.009","name":"Proc Memory","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on /proc/[pid]/mem files through process isolation and mandatory access controls prevents unauthorized processes from writing to another process's memory space for code injection."},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on web portal authentication pages and form handling mechanisms prevents adversaries from injecting credential-harvesting overlays into legitimate web authentication interfaces."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through PowerShell execution policies, Constrained Language Mode, and AMSI integration restricts unauthorized users from executing arbitrary PowerShell scripts and commands."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting AppleScript execution permissions and osascript access through macOS security policies prevents unauthorized users from executing automation scripts for malicious purposes."},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access controls on cmd.exe execution through application control policies and user rights restrictions prevent unauthorized invocation of the Windows Command Shell for adversary command execution."},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on shell binaries and restricting interactive shell access through PAM configurations and rbash limits adversary ability to execute commands via Unix shells."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Visual Basic scripting hosts (wscript, cscript) through application control policies prevents unauthorized execution of VBScript files for malicious purposes."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting Python interpreter access and execution permissions through application control and user rights policies prevents adversary use of Python for executing malicious scripts."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access controls on JavaScript runtime engines and browser scripting capabilities restrict adversary execution of malicious JavaScript through host-based script interpreters like Node.js or Windows Script Host."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network device CLI interfaces through privilege levels, role-based access, and authentication controls restricts which administrators can execute configuration commands on network infrastructure."},{"id":"T1059.009","name":"Cloud API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"IAM policies and API access controls restrict which identities can invoke cloud APIs, preventing adversaries from executing arbitrary cloud management commands through compromised or unauthorized accounts."},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through application allowlisting prevents unauthorized execution of AutoHotKey and AutoIT scripts that adversaries use for automating malicious actions on Windows systems."},{"id":"T1059.011","name":"Lua","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to Lua interpreters embedded in applications and network devices through access controls prevents adversaries from executing malicious Lua scripts for code execution."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Windows Event Log files and the Event Log service prevents unauthorized users from clearing security, system, and application event logs to remove forensic evidence."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to system log files in /var/log and syslog facilities through file permissions prevents adversaries from clearing Linux or macOS system logs to cover their tracks."},{"id":"T1070.003","name":"Clear Command History","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on shell history files (.bash_history, .zsh_history) and history configuration prevent adversaries from clearing or disabling command history to remove evidence of executed commands."},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network configuration tools and connection history storage prevents adversaries from clearing wireless network profiles, VPN logs, and other network connection artifacts."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to mailbox data stores and email deletion APIs through authorization policies prevents adversaries from clearing mailbox contents to remove evidence of data access or email-based C2."},{"id":"T1070.009","name":"Clear Persistence","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on persistence mechanism locations, including registry autorun keys, scheduled tasks, and startup directories, prevent adversaries from removing their own persistence artifacts to evade detection."},{"id":"T1071.004","name":"DNS","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on DNS resolver configurations and query channels restricts unauthorized DNS traffic, limiting adversary ability to use DNS as a covert command-and-control protocol."},{"id":"T1078.002","name":"Domain Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Fine-grained access enforcement on domain resources ensures that compromised domain accounts are constrained by group policies, OU-level restrictions, and resource-specific ACLs that limit lateral movement."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on local system resources through UAC, local security policies, and file system permissions constrains compromised local accounts to their authorized privilege level, limiting damage."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"IAM policies, service control policies, and resource-based policies in cloud environments enforce least-privilege access for cloud accounts, constraining adversary actions even with valid cloud credentials."},{"id":"T1087.004","name":"Cloud Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud IAM enumeration APIs and directory services restricts which accounts can list cloud user accounts, preventing adversary reconnaissance of cloud identity infrastructure."},{"id":"T1090.003","name":"Multi-hop Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through egress filtering and proxy authentication requirements disrupts multi-hop proxy chains by requiring authorization at each network boundary traversal point."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions to add credentials, access keys, or service principals to cloud accounts prevents adversaries from establishing persistent access through additional cloud credential provisioning."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Exchange and M365 delegation settings restricts which accounts can grant email delegate permissions, preventing adversaries from adding mailbox access for persistent email collection."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"IAM policy enforcement restricts which identities can assign cloud roles, preventing adversaries from granting themselves elevated permissions such as Owner, Contributor, or Admin roles."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on ~/.ssh/authorized_keys files and SSH configuration directories restrict who can add SSH public keys, preventing adversaries from establishing persistent key-based access."},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on device registration services and enrollment policies restricts which accounts can register new devices to the directory, preventing adversary persistence through rogue device enrollment."},{"id":"T1098.006","name":"Additional Container Cluster Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"RBAC policies on container orchestration platforms restrict which accounts can create or modify ClusterRoles and RoleBindings, preventing adversaries from granting themselves elevated container cluster permissions."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on group management APIs and directory services restricts which accounts can add members to local or domain security groups, preventing adversary privilege escalation through group manipulation."},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement mechanisms that implement progressive delays and thresholds on authentication endpoints slow down password guessing attempts, making real-time brute force attacks impractical."},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Strong access enforcement on credential stores and password hash databases limits adversary access to the hashed material needed for offline password cracking, reducing the attack surface."},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through per-account lockout policies and intelligent rate limiting across authentication endpoints detects and blocks password spraying campaigns that target many accounts with few passwords."},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on authentication endpoints that detect and throttle credential stuffing attempts, combined with per-IP and per-account rate limits, prevent adversaries from testing stolen credential databases."},{"id":"T1114.002","name":"Remote Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Exchange Web Services, IMAP, and Graph API endpoints restricts which accounts and applications can access mailboxes remotely, preventing unauthorized email collection."},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement validates token integrity at each resource access attempt, preventing adversaries from using impersonated or stolen tokens to access resources beyond the original token's authorization scope."},{"id":"T1134.002","name":"Create Process with Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Mandatory access controls verify the legitimacy of process tokens at creation time, preventing adversaries from spawning processes with manipulated tokens that bypass intended privilege boundaries."},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement mechanisms validate the authenticity of impersonation tokens against authorization policies, preventing adversaries from fabricating tokens that grant unauthorized access to protected resources."},{"id":"T1134.005","name":"SID-History Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on SID-History attribute modification in Active Directory prevent unauthorized injection of privileged SIDs that would grant escalated access across domain trust boundaries."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement restricts local account creation to authorized administrators through user rights assignments, preventing adversaries from creating backdoor local accounts on compromised systems."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Enforcing permissions on Active Directory organizational units and user containers restricts domain account creation to authorized directory administrators, preventing unauthorized domain-level persistence."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"IAM policy enforcement on cloud identity services restricts account creation to authorized administrators, preventing adversaries from provisioning cloud accounts for persistent unauthorized access."},{"id":"T1205.001","name":"Port Knocking","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on firewall and network device configurations prevents unauthorized modification of port filtering rules, blocking adversaries from implementing port knocking sequences for covert access."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access controls on Confluence spaces, pages, and API endpoints restrict which users can read organizational knowledge base content, preventing adversary collection of sensitive documentation."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing SharePoint site permissions, document library access controls, and sharing policies restricts unauthorized users from accessing stored documents and organizational intelligence."},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on code repository permissions, including branch protection and read access restrictions, prevents adversaries from cloning or browsing source code repositories for sensitive information."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting CRM platform access through role-based permissions and API authentication prevents adversaries from extracting customer data, sales intelligence, and other sensitive business information."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access controls on messaging platforms such as Slack, Teams, and enterprise chat enforce channel membership and message visibility policies, preventing unauthorized collection of internal communications."},{"id":"T1218.002","name":"Control Panel","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting execution permissions for Control Panel items (.cpl files) through application control policies prevents adversaries from using the Control Panel as a proxy for executing malicious DLLs."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on MSI package installation and msiexec execution through application control policies prevents adversaries from using the Windows Installer for proxy execution of malicious payloads."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting execution of verclsid.exe through application control and user rights policies prevents adversaries from using this COM object verification utility as a proxy for DLL execution."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Mandatory access controls on Windows that override discretionary permissions prevent adversaries from using icacls, cacls, or PowerShell to weaken file and directory ACLs on protected resources."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Mandatory access controls on Linux and macOS enforce permission boundaries that cannot be overridden by chmod, chown, or setfacl commands, preventing adversary weakening of file protections."},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud storage lifecycle policies restricts which identities can create or modify retention rules, preventing adversaries from configuring automatic deletion of critical data."},{"id":"T1491.001","name":"Internal Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on internal-facing web content and intranet portals restrict modification permissions, preventing adversaries from replacing internal pages with defacement content for organizational disruption."},{"id":"T1491.002","name":"External Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on externally-facing web server content directories and CMS platforms prevents unauthorized modification of public websites for reputational damage through defacement."},{"id":"T1498.001","name":"Direct Network Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Network access enforcement through ingress filtering, rate limiting, and traffic authorization policies reduces the volume of direct network flood traffic that reaches protected infrastructure."},{"id":"T1498.002","name":"Reflection Amplification","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network services susceptible to reflection and amplification, combined with ingress filtering and BCP38 compliance, limits the effectiveness of amplification-based DDoS attacks."},{"id":"T1499.001","name":"OS Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through connection-level controls and resource allocation policies prevents unauthorized users from exhausting operating system resources such as TCP connections and socket handles."},{"id":"T1499.002","name":"Service Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to service endpoints through authentication requirements and rate-limiting enforcement prevents adversaries from flooding specific services with resource-exhausting requests."},{"id":"T1499.003","name":"Application Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on application interfaces through request validation and resource quotas prevents adversaries from sending specially crafted requests designed to exhaust application-layer resources."},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on application endpoints combined with input validation and authentication requirements limit adversary ability to exploit application vulnerabilities for denial-of-service conditions."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Exchange transport agent registration and mail server configuration prevents unauthorized installation of malicious transport agents that intercept or modify email traffic for persistence."},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to web server directories and CGI-bin locations through access controls prevents adversaries from deploying web shells for persistent remote command execution on compromised servers."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on IIS module registration and configuration files prevents unauthorized installation of malicious ISAPI extensions or managed modules that provide persistent server-side backdoor access."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to Terminal Services DLL registration paths and RDP configuration prevents adversaries from loading malicious DLLs that execute within the context of remote desktop sessions."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on BIOS/UEFI management interfaces through physical security and firmware passwords prevents unauthorized modification of system firmware for persistent pre-OS boot access."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access controls on boot sector modification, including Secure Boot enforcement and disk write protections, prevent adversaries from installing bootkits that persist below the operating system."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to network device ROMMON interfaces through physical security and console port authentication prevents adversaries from modifying ROM Monitor firmware on Cisco devices."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on TFTP server configurations and network device boot settings prevents adversaries from redirecting devices to boot from malicious TFTP-served images for persistent compromise."},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on macOS LaunchAgent directories (~/Library/LaunchAgents and /Library/LaunchAgents) restrict which users can install launch agent plists for persistence through user-level process creation."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to systemd unit file directories and the systemctl interface prevents unauthorized creation or modification of systemd services for persistent privileged execution on Linux systems."},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on the Windows Service Control Manager and service binary paths prevents unauthorized creation or modification of Windows services used for persistence and privilege escalation."},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to /Library/LaunchDaemons and the launchctl interface through access controls prevents adversaries from installing launch daemons that execute with root privileges on macOS."},{"id":"T1543.005","name":"Container Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"RBAC policies on container orchestration platforms restrict which accounts can create or modify container services, preventing adversaries from deploying persistent malicious containers."},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on WMI event subscriptions and the WMI repository restricts which accounts can create permanent event consumers, preventing adversary persistence through WMI event-triggered execution."},{"id":"T1546.004","name":"Unix Shell Configuration Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to shell configuration files (.bashrc, .zshrc, .profile) through access controls prevents adversaries from inserting malicious commands that execute on each shell session."},{"id":"T1546.013","name":"PowerShell Profile","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on PowerShell profile locations prevent unauthorized modification of profile scripts that execute automatically when PowerShell sessions start, blocking profile-based persistence."},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting registry access to the W32Time service configuration and Time Provider DLL registration keys prevents adversaries from registering malicious time provider DLLs for persistent execution."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Winlogon registry keys prevents unauthorized modification of Winlogon Helper DLL references, blocking adversaries from loading malicious DLLs during the Windows logon process."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to kernel module loading interfaces (insmod, modprobe) and kernel extension directories through access controls prevents unauthorized installation of kernel-level persistence mechanisms."},{"id":"T1547.007","name":"Re-opened Applications","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on the macOS re-opened applications plist and session restoration data prevent adversaries from registering malicious applications for automatic re-launch after system restart."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to shortcut (.lnk) files in startup directories and common locations prevents adversaries from modifying shortcuts to redirect execution to malicious payloads."},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on the Print Spooler service configuration and print processor registry keys prevents adversaries from registering malicious print processor DLLs for persistent code execution."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to XDG autostart directories (~/.config/autostart, /etc/xdg/autostart) prevents adversaries from creating desktop entry files for automatic execution on Linux desktop environments."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through properly configured UAC policies, including requiring elevation prompts for all administrative operations, prevents adversaries from silently bypassing User Account Control."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting sudoers file modification and enforcing timestamp_timeout=0 in sudo configuration limits adversary ability to exploit sudo caching for persistent elevated access without re-authentication."},{"id":"T1548.005","name":"Temporary Elevated Cloud Access","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud IAM policies governing temporary role assumption and just-in-time access prevents adversaries from abusing temporary elevated cloud access beyond authorized scope and duration."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on the macOS TCC database and privacy preference policy control prevent unauthorized manipulation of application permissions that grant access to protected resources like camera, microphone, and files."},{"id":"T1550.002","name":"Pass the Hash","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement that requires full Kerberos authentication rather than accepting NTLM hashes alone prevents adversaries from using pass-the-hash techniques to authenticate as other users."},{"id":"T1550.003","name":"Pass the Ticket","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access controls on Kerberos ticket validation, including PAC verification and ticket lifetime enforcement, prevent adversaries from using stolen or forged Kerberos tickets for lateral movement."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on Windows Registry keys where credentials may be stored, including HKLM\\SOFTWARE and HKCU entries, prevents unauthorized processes from extracting stored credential material."},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to cloud instance metadata APIs through IMDSv2 enforcement and network access controls prevents unauthorized processes from retrieving temporary credentials from metadata services."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on container runtime APIs, including Docker socket and kubelet endpoints, prevents unauthorized processes from querying container metadata to extract secrets and credentials."},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on Subject Interface Package (SIP) and trust provider DLL registration in the registry prevent adversaries from hijacking Windows code signing verification to validate malicious binaries."},{"id":"T1555.002","name":"Securityd Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on the macOS securityd process and keychain database files restricts which processes can read decrypted credentials from the system keychain memory."},{"id":"T1555.005","name":"Password Managers","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to password manager application data, browser credential databases, and vault configuration files prevents adversary extraction of stored credentials from password management tools."},{"id":"T1555.006","name":"Cloud Secrets Management Stores","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"IAM policies and access controls on cloud secrets management services (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) restrict which identities can retrieve stored secrets."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on domain controller authentication components, including password filter DLLs and authentication packages, prevents unauthorized modification of the DC authentication pipeline."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to PAM module directories (/etc/pam.d/, /lib/security/) and PAM configuration files prevents adversaries from installing malicious authentication modules for credential capture."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access controls on network device authentication configurations, including TACACS+ and RADIUS settings, prevent unauthorized modification of authentication mechanisms on routers and switches."},{"id":"T1556.006","name":"Multi-Factor Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to MFA provider configurations and registration interfaces prevents adversaries from modifying multi-factor authentication settings to bypass or intercept second-factor verification."},{"id":"T1556.007","name":"Hybrid Identity","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on hybrid identity synchronization services such as Azure AD Connect prevents adversary modification of authentication flows between on-premises and cloud identity providers."},{"id":"T1556.008","name":"Network Provider DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting registry access to network provider DLL registration keys prevents adversaries from installing malicious credential-intercepting DLLs in the Windows network authentication chain."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on conditional access policy management interfaces prevents adversaries from modifying or disabling conditional access rules that enforce MFA, device compliance, and location-based controls."},{"id":"T1557.001","name":"LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement through SMB signing requirements and NTLM relay protections prevents adversaries from intercepting LLMNR/NBT-NS authentication traffic and relaying captured hashes."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Network-level access controls including static ARP entries and port security configurations prevent adversaries from poisoning ARP caches to redirect traffic through attacker-controlled systems."},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on DHCP server deployment and rogue DHCP detection prevents adversaries from spoofing DHCP responses to redirect network traffic through malicious gateways."},{"id":"T1557.004","name":"Evil Twin","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on wireless network infrastructure, including rogue AP detection and 802.1X enforcement, prevent adversaries from deploying evil twin access points for credential interception."},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on the krbtgt account and KDC service restricts the ability to forge Kerberos TGTs, as only the KDC should possess the krbtgt key needed for golden ticket creation."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to service account password hashes and enforcing strong service account credentials through access controls limits adversary ability to forge service tickets for lateral movement."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement that restricts which accounts can request service tickets, combined with strong service account passwords, reduces the exploitability of Kerberoasting attacks targeting weak SPN credentials."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement requiring Kerberos pre-authentication for all accounts prevents adversaries from requesting AS-REP responses for accounts without pre-auth, blocking AS-REP Roasting attacks."},{"id":"T1558.005","name":"Ccache Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access controls on Kerberos credential cache files (ccache) in /tmp and user directories prevent unauthorized processes from reading stored ticket-granting tickets for credential theft."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on COM object instantiation through DCOM launch permissions and activation security settings restricts which processes can invoke COM objects for inter-process communication."},{"id":"T1561.001","name":"Disk Content Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on raw disk access APIs and disk management utilities prevent unauthorized processes from directly overwriting disk content sectors, protecting against wiper malware."},{"id":"T1561.002","name":"Disk Structure Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to disk partitioning tools and MBR/GPT modification interfaces prevents adversaries from destroying disk partition tables and boot structures for destructive impact."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on security tool configurations and service management prevents adversaries from disabling antivirus, EDR, or other protective tools without administrative authorization."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions on the Windows Event Log service and audit policy configuration prevents adversaries from disabling event logging to blind security monitoring capabilities."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on firewall management interfaces and iptables/netsh configurations prevent unauthorized modification or disabling of host-based firewalls that enforce network segmentation."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on ETW providers, sensor configurations, and telemetry pipelines prevents adversaries from blocking security indicators from reaching monitoring and detection systems."},{"id":"T1562.007","name":"Disable or Modify Cloud Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"IAM policies restricting access to cloud security group and firewall rule management prevent adversaries from disabling or modifying cloud-based network access controls."},{"id":"T1562.008","name":"Disable or Modify Cloud Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud logging service configurations, including CloudTrail, Cloud Audit Logs, and Azure Monitor, prevents adversaries from disabling or modifying cloud audit trails."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to boot configuration tools and Safe Mode settings prevents adversaries from rebooting systems into Safe Mode where security tools and drivers are not loaded."},{"id":"T1562.012","name":"Disable or Modify Linux Audit System","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on auditd configuration files and the Linux audit framework prevent adversaries from disabling or modifying audit rules that capture security-relevant system activity."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on SSH session multiplexing, agent forwarding, and ControlMaster configurations prevents adversaries from hijacking active SSH sessions for unauthorized lateral movement."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting RDP session reconnection permissions and enforcing session-specific authentication prevents adversaries from hijacking disconnected Remote Desktop sessions belonging to other users."},{"id":"T1564.004","name":"NTFS File Attributes","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on NTFS alternate data streams restrict which processes can read or write hidden content in ADS, limiting adversary use of this file system feature for data concealment."},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on databases, file systems, and application data stores prevents unauthorized modification of stored records, protecting data integrity against manipulation by adversaries."},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access controls on process memory and runtime data structures prevent adversaries from manipulating live application data in memory to alter processing outcomes or corrupt real-time information."},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access controls on the launchctl interface and associated plist configuration files restrict which users can load, unload, or manage macOS services for execution purposes."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the Windows Service Control Manager and service creation APIs prevents unauthorized users from installing or executing services for malicious code execution."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on macOS dylib search paths and framework directories prevents adversaries from placing malicious dynamic libraries where applications will load them through dylib hijacking."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write permissions on installer directories and executable paths prevents adversaries from exploiting weak file permissions to replace legitimate installer binaries with malicious versions."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on PATH environment variable modification and system binary directories prevent adversaries from placing malicious executables earlier in the search path to intercept execution."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing access controls on application directories and DLL search paths prevents adversaries from placing malicious binaries in locations that take precedence in the search order resolution."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on service binary paths and proper quoting of service executable paths prevent adversaries from exploiting unquoted path vulnerabilities to intercept service execution."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write permissions on Windows service binary paths and configuration files prevents adversaries from replacing service executables through services file permissions weakness."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access controls on the COR_PROFILER environment variable and .NET profiler DLL directories prevent adversaries from registering malicious profiler DLLs that load into .NET processes."},{"id":"T1574.014","name":"AppDomainManager","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to AppDomainManager configuration files and .NET application directories prevents adversaries from specifying malicious AppDomainManager types that execute within .NET application domains."},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"IAM policy enforcement restricts which accounts can create cloud compute snapshots, preventing adversaries from snapshotting volumes to extract data or create instances that bypass security controls."},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on cloud compute instance creation APIs restrict which identities can launch new virtual machines, preventing adversaries from deploying instances outside security monitoring coverage."},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud instance termination permissions through IAM policies prevents adversaries from deleting virtual machines to destroy evidence or disrupt services."},{"id":"T1578.005","name":"Modify Cloud Compute Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on cloud compute configuration modification APIs prevents adversaries from changing VM settings, security groups, or metadata to weaken security posture or enable further access."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access controls on NAT configuration and network device management interfaces prevent adversaries from modifying NAT rules to traverse network boundaries and access isolated network segments."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to network device software update mechanisms and configuration interfaces prevents adversaries from patching system images to inject malicious functionality into network infrastructure."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on network device firmware management prevents adversaries from downgrading system images to older versions with known vulnerabilities that can be exploited for persistent access."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting SNMP community string access and enforcing SNMPv3 authentication prevents unauthorized MIB queries that expose network device configurations, credentials, and architecture details."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access controls on network device configuration export functions and management protocols restrict unauthorized retrieval of running and startup configurations containing sensitive infrastructure data."},{"id":"T1606.001","name":"Web Cookies","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access enforcement on web cookie generation mechanisms and session management infrastructure prevents adversaries from forging valid session cookies that bypass authentication controls."},{"id":"T1606.002","name":"SAML Tokens","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to SAML signing certificates and token-signing keys through hardware security modules and access controls prevents adversaries from forging SAML assertions for unauthorized authentication."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.33, A.8.18, A.8.20, A.8.26 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.IR-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-004","SP-005","SP-008","SP-011","SP-013","SP-020","SP-022","SP-023","SP-027","SP-028","SP-029","SP-030","SP-032","SP-033","SP-037","SP-039","SP-040","SP-041","SP-042","SP-044","SP-047","SP-050","SP-051","SP-052","SP-053","SP-054"]}}