{"data":{"id":"AC-06","name":"Least Privilege","family":"AC","family_name":"Access Control","withdrawn":false,"description":"Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.","supplemental_guidance":"Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.","enhancements":[{"id":"AC-06(01)","name":"Authorize Access to Security Functions","statement":"Authorize access for [Assignment: organization-defined individuals or roles] to:\na. [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]; and\nb. [Assignment: organization-defined security-relevant information].","baselines":["moderate","high"]},{"id":"AC-06(02)","name":"Non-privileged Access for Nonsecurity Functions","statement":"Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.","baselines":["moderate","high"]},{"id":"AC-06(03)","name":"Network Access to Privileged Commands","statement":"Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system.","baselines":["high"]},{"id":"AC-06(04)","name":"Separate Processing Domains","statement":"Provide separate processing domains to enable finer-grained allocation of user privileges.","baselines":[]},{"id":"AC-06(05)","name":"Privileged Accounts","statement":"Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].","baselines":["moderate","high"]},{"id":"AC-06(06)","name":"Privileged Access by Non-organizational Users","statement":"Prohibit privileged access to the system by non-organizational users.","baselines":[]},{"id":"AC-06(07)","name":"Review of User Privileges","statement":"a. Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and\nb. Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.","baselines":["moderate","high"]},{"id":"AC-06(08)","name":"Privilege Levels for Code Execution","statement":"Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: organization-defined software].","baselines":[]},{"id":"AC-06(09)","name":"Log Use of Privileged Functions","statement":"Log the execution of privileged functions.","baselines":["moderate","high"]},{"id":"AC-06(10)","name":"Prohibit Non-privileged Users from Executing Privileged Functions","statement":"Prevent non-privileged users from executing privileged functions.","baselines":["moderate","high"]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-06","name":"Least Privilege","description":"Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.","discussion":"Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.","related_controls":["AC-02","AC-03","AC-05","AC-16","CM-05","CM-11","PL-02","PM-12","SA-08","SA-15","SA-17","SC-38"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.5.15","A.5.18","A.8.2","A.8.3","A.8.18"],"iso_27002_2022":["5.15","5.18","8.2","8.3","8.18"],"cobit_2019":["DSS05","DSS06"],"pci_dss_v4":["3.4","7.1","7.2","8.6"],"nist_csf_2":["PR.AA-05"],"cis_controls_v8":["CIS 3.3","CIS 3.14","CIS 5","CIS 5.4","CIS 6","CIS 6.1","CIS 6.8","CIS 12.8"],"soc2_tsc":["CC6.1","CC6.1-POF7"],"finos_ccc":["CCC-C11","CCC-C12"],"iso_42001_2023":["A.3.2","A.9.2"],"iec_62443":["3-3 SR 1.3","3-3 SR 2.1"],"asd_e8":["E8-5","E8-5 ML1","E8-5 ML2","E8-5 ML3","E8-8 ML3"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 22-23"],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.2","ORP.4"],"anssi":["Hygiene.14","Hygiene.15","Hygiene.16","Hygiene.17","SecNumCloud.10.3","SecNumCloud.10.4"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.B.d(60)","IV.C(61)"],"gdpr":["Art.5(1)(c)","Art.5(1)(f)","Art.25(2)","Art.32(1)(b)"],"dora":["Art.9(4)(c)","Art.9(4)(d)"],"bio2":["5.15","5.18","8.2","8.3","8.18"],"rbi_csf":["Annex1.8","ITGRCA.19"],"fisc":["FISC.T2"],"lgpd_bcb":["BCB.Art.3","LGPD.Art.6","LGPD.Art.46"],"hkma_tme1":["TME1.8.1","TME1.8.2"],"mlps_2":["8.1.4.2","8.1.5.1","8.1.10.4"],"dnb_good_practice":["DNB.7.1","DNB.17.2"],"cra":["CRA.I.2d"],"swift_cscf":["SWIFT.1.2","SWIFT.5.1","SWIFT.6.3"],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CD-1","CTO-1"],"cbn_csf":["Part3.2","Part9"],"popia":["s10","s19"],"sa_js2":["JS2-7.1"],"bcbs_239":["Principle 11"],"bot_cyber":["Ch2.2"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.2"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.7","II.C.7(b)","II.C.13(a)","II.C.15","II.C.15(a)","II.C.15(b)","II.C.18"],"hipaa_sr":["§164.308(a)(3)(i)","§164.308(a)(3)(ii)(A)","§164.308(a)(3)(ii)(B)","§164.308(a)(4)(i)","§164.308(a)(4)(ii)(B)","§164.308(a)(4)(ii)(C)","§164.312(a)(1)","§164.314(b)(2)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.6","500.7"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC"],"nerc_cip":[],"nrc_73_54":["RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":["5.1"],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":["AWWA Sec 3"],"iaea_nss":["Sec 5.3"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.4"],"cbest":[],"tiber_eu":["TIBER.CONF"],"pci_hsm":["1","4","5","8"],"common_criteria":["CC Part 2 — FDP","CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.6.2","SYSC 13.7.3"],"fda_21_cfr_11":["§11.10(d)","§11.10(g)"],"fda_cyber":["SA-1","SA-4"],"hitrust_csf":["01.a","13.c","13.e"],"iso_27799":["9.1","9.3","9.5","H.4"],"lloyds_ms":["MS1.1","MS5.1","MS8.3"],"naic_ds":["4-access","4-audit","4B"],"nhs_dspt":["NDG-1.1","NDG-4.1","NDG-4.4"],"pra_ss1_23":["P2.4","P3.3","P3.6","P4.4","P-IT.1"],"solvency_ii":["EIOPA-ICT-4.4"],"owasp_masvs_v2":["MASVS-PRIVACY-1"],"csa_ccm_v4":["IAM-04","IAM-05","IAM-08","IAM-09","IAM-10","IAM-11","IAM-16","LOG-04"],"csa_aicm":["IAM-04","IAM-05","IAM-08","IAM-09","IAM-10","IAM-11","IAM-16","IAM-18","IAM-19","LOG-04","MDS-07"],"ccss_v9":["1.03.5","1.04.3","1.05.1","1.05.3"],"mica":["Art.36(1)","Art.40(1)","Art.55(1)","Art.63(1)","Art.65(1)","Art.67(1)","Art.86(1)","Art.92(1)","Art.97(1)"],"basel_sco60":["SCO60.55","SCO60.61","SCO60.62","SCO60.64","SCO60.66","SCO60.72"],"bssc":["GSP-11","KMS-04","KMS-05","KMS-06","KMS-09","NOS-05","NOS-08","TIS-07"],"sec_custody_digital":["SEC-CD-02","SEC-CD-03","SEC-CD-04","SEC-CD-05","SEC-CD-16"],"dpdpa":["Act.8(5)","Rules.6(1)(b)","Rules.Sch1.B.7"]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting user and process privileges limits access to sensitive credential stores such as LSASS memory, SAM databases, and domain controller data, preventing standard accounts from invoking the tools and APIs required for OS credential dumping."},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing least privilege constrains which users and processes can access sensitive local files and databases, reducing the scope of data an adversary can collect from compromised endpoints."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting remote service access to only those accounts with a demonstrated need prevents lateral movement by restricting who can authenticate to RDP, SSH, SMB, and other remote management protocols across the network."},{"id":"T1025","name":"Data from Removable Media","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting removable media access rights ensures that only authorized users can mount and read external storage devices, limiting an adversary's ability to stage and collect data from removable media."},{"id":"T1036","name":"Masquerading","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Least privilege prevents adversaries from placing malicious executables in protected system directories or renaming system utilities, as these operations require elevated file-system permissions that standard accounts lack."},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"By restricting outbound network access and process-level permissions, least privilege limits which processes can establish C2 channels, reducing the pathways available for exfiltrating data over command-and-control infrastructure."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting WMI execution privileges to authorized administrators prevents adversaries from using Windows Management Instrumentation for remote command execution, process creation, and lateral system enumeration."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Least privilege restrictions on network socket creation and protocol usage prevent low-privilege processes from opening alternative protocol channels (DNS, ICMP, SMTP) for covert data exfiltration."},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting device mount permissions and write access to physical media ports prevents unauthorized users from exfiltrating sensitive data to USB drives, external disks, and other removable storage."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to create scheduled tasks and cron jobs to authorized administrators prevents adversaries from establishing persistent execution or privilege escalation through the task scheduler subsystem."},{"id":"T1055","name":"Process Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting debug privileges and cross-process memory access prevents adversaries from injecting code into higher-privilege processes, blocking both privilege escalation and defense evasion via process injection techniques."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Constraining which accounts can execute scripting engines and command interpreters reduces the adversary's ability to run PowerShell, cmd, bash, or Python for command execution on compromised systems."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Running services and applications at minimum necessary privilege levels limits the impact of exploitation, as a successful exploit inherits only the restricted permissions of the vulnerable process rather than system-level access."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to log files, event stores, and audit databases prevents adversaries from clearing evidence of their activities, since indicator removal requires elevated permissions to modify protected logging infrastructure."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting administrative access to software deployment platforms (SCCM, Ansible, WSUS) prevents adversaries from abusing these trusted tools to distribute malware or execute commands across managed endpoints."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing least privilege ensures that even when adversaries obtain valid credentials, the compromised account has minimal permissions, restricting initial access scope and preventing escalation to sensitive systems or data."},{"id":"T1091","name":"Replication Through Removable Media","tactics":["initial-access","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting AutoRun capabilities and removable media execution permissions prevents malware from automatically propagating via infected USB devices or shared removable media."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting who can modify account attributes, group memberships, and permissions prevents adversaries from manipulating accounts to establish persistence or escalate privileges through unauthorized account changes."},{"id":"T1106","name":"Native API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to sensitive native APIs and system calls limits an adversary's ability to directly invoke OS-level functions for process creation, memory manipulation, and privilege escalation."},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing account lockout policies and restricting authentication endpoints to necessary accounts reduces the attack surface for brute force attempts by limiting the number of targetable accounts and authentication paths."},{"id":"T1112","name":"Modify Registry","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting registry modification rights to authorized administrators prevents adversaries from altering registry keys used for persistence, configuration changes, and defense evasion."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting external remote service access to only authorized accounts and networks reduces the initial access surface by ensuring VPN, RDP gateway, and Citrix endpoints are not accessible to over-privileged or unnecessary accounts."},{"id":"T1134","name":"Access Token Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create, duplicate, or impersonate access tokens prevents adversaries from manipulating Windows security tokens to assume the identity and privileges of other users or system accounts."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting account creation rights to authorized identity administrators prevents adversaries from establishing persistence by creating new local, domain, or cloud accounts for backdoor access."},{"id":"T1137","name":"Office Application Startup","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to install Office add-ins, modify templates, and configure startup items prevents adversaries from leveraging Office application startup mechanisms for persistent code execution."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Constraining browser extension installation to approved extensions from managed repositories prevents adversaries from deploying malicious browser extensions that provide persistent access and data interception."},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Limiting browser process privileges and restricting inter-process communication reduces the ability of adversaries to inject into browser sessions for credential harvesting and session hijacking."},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Running browsers and client applications with minimal privileges limits the impact of drive-by compromise exploits, as successful code execution inherits only the constrained permissions of the sandboxed process."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Ensuring public-facing applications run under least-privilege service accounts limits post-exploitation capabilities, preventing adversaries from leveraging web application compromises to access sensitive system resources."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting installation privileges and software execution rights reduces the impact of supply chain compromises, since trojaned components inherit only the restricted permissions of the installing process."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting BITS job creation to authorized accounts prevents adversaries from abusing the Background Intelligent Transfer Service for persistent file download and execution under standard user contexts."},{"id":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Constraining third-party partner accounts to only necessary systems and data prevents adversaries from exploiting trusted relationships to gain broad access when a partner organization is compromised."},{"id":"T1200","name":"Hardware Additions","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting device installation and driver loading privileges prevents unauthorized hardware additions from being recognized and utilized, blocking rogue network devices, keyloggers, and other physical implants."},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Least privilege ensures client applications run in restricted contexts, so even when exploitation achieves code execution, the resulting process lacks the privileges needed to escalate access or pivot to sensitive resources."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting remote service accounts and network authentication to minimum necessary privileges limits the blast radius when adversaries exploit vulnerabilities in remote services for lateral movement."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Running security tools and defense components under protected, high-integrity processes limits the ability of adversaries to exploit vulnerabilities to disable or modify defensive controls."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Constraining service account privileges ensures that exploitation of authentication-related vulnerabilities yields only limited credential access, rather than domain-wide or administrative credential exposure."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing granular access controls on information repositories (SharePoint, Confluence, code repos) restricts which accounts can read sensitive data, limiting adversary collection even after initial compromise."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting execution permissions for signed system binaries prevents adversaries from using trusted utilities (mshta, rundll32, regsvr32) as proxies to execute malicious payloads while evading application controls."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting who can modify file and directory permissions prevents adversaries from weakening ACLs to gain access to protected files or to make their tools executable in restricted directories."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain and tenant policy modification rights to authorized administrators prevents adversaries from altering Group Policy or Azure AD policies to weaken security controls or escalate privileges."},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting write and delete permissions on critical data stores prevents adversaries from executing data destruction attacks, since bulk file deletion or corruption requires elevated storage permissions."},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting file system write access and process execution privileges limits an adversary's ability to deploy and execute ransomware, as encrypting large volumes of data requires broad write permissions across file shares."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting service management privileges to authorized administrators prevents adversaries from stopping critical services to disrupt operations or disable security controls."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to backup infrastructure and recovery tools prevents adversaries from deleting shadow copies, disabling recovery partitions, or modifying boot configuration to inhibit system recovery."},{"id":"T1491","name":"Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to web content directories and internal portals prevents adversaries from modifying pages for defacement, since altering published content requires elevated content management permissions."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Constraining firmware update capabilities to authorized administrators and verified processes prevents adversaries from corrupting device firmware, which requires privileged access to hardware management interfaces."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to install server components (web shells, IIS modules, transport agents) to authorized administrators prevents adversaries from implanting persistent backdoors on server infrastructure."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting container image push and registry write access to authorized CI/CD pipelines prevents adversaries from implanting malicious container images that execute when deployed across the environment."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting OAuth application registration and token scope assignments prevents adversaries from obtaining overly-permissive application access tokens that grant broad access to cloud resources and APIs."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing granular IAM policies on cloud storage buckets and blobs restricts which identities can list and retrieve objects, preventing unauthorized access to sensitive data stored in cloud environments."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud storage transfer and cross-account replication permissions prevents adversaries from exfiltrating data by moving it to attacker-controlled cloud accounts or subscriptions."},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to cloud management consoles and dashboards to authorized administrators prevents adversaries from using these interfaces to discover resources, configurations, and architecture details."},{"id":"T1539","name":"Steal Web Session Cookie","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting browser process privileges and cookie store access limits the ability of adversaries to extract web session cookies from protected browser data stores."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Constraining access to firmware update interfaces and boot configuration prevents adversaries from installing pre-OS boot persistence mechanisms such as bootkits and UEFI implants."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create or modify system services, launch daemons, and systemd units to administrators prevents adversaries from establishing persistent, auto-starting processes at system level."},{"id":"T1546","name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to configure event-triggered execution mechanisms (WMI subscriptions, shell profiles, AppInit DLLs) prevents adversaries from establishing persistence through system event hooks."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict privilege boundaries and UAC configuration prevents adversaries from abusing elevation control mechanisms such as sudo caching, UAC bypass, and setuid binaries to escalate privileges."},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting which accounts and services can use pass-the-hash, pass-the-ticket, and other alternate authentication material limits lateral movement using stolen or forged credentials."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting file system and registry access prevents adversaries from discovering unsecured credentials stored in configuration files, scripts, Group Policy Preferences, and other accessible locations."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to install root certificates, modify code signing policies, and alter trust settings prevents adversaries from subverting trust controls to run unsigned or improperly-signed malicious code."},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to password stores, keychain databases, and credential vaults through strict process-level and user-level permissions prevents adversaries from extracting stored credentials."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification of authentication modules (PAM, LSASS, AD FS) to authorized administrators prevents adversaries from inserting backdoors into the authentication pipeline to harvest credentials or bypass controls."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting service account privileges and restricting delegation settings reduces the viability of Kerberos ticket attacks, since service tickets forged or stolen for low-privilege accounts have limited utility."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting COM object registration and DDE channel access limits the adversary's ability to abuse inter-process communication mechanisms for code execution across application boundaries."},{"id":"T1561","name":"Disk Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting raw disk access and low-level storage APIs to authorized processes prevents adversaries from performing disk wipe operations that destroy both data and partition structures."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to stop services, modify firewall rules, and alter logging configurations to authorized administrators prevents adversaries from disabling or modifying defensive security tools."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting remote session access and preventing session sharing limits the ability of adversaries to hijack existing RDP or SSH sessions for lateral movement without requiring new authentication."},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Limiting which processes can access external web services and cloud storage APIs restricts the channels available for exfiltrating data over services like Dropbox, Google Drive, or Mega."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create and start system services to authorized accounts prevents adversaries from using service execution for running malicious payloads with elevated privileges."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Setting strict file permissions on application directories, PATH locations, and DLL search paths prevents adversaries from planting malicious libraries or executables that hijack legitimate execution flows."},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud compute management permissions prevents adversaries from creating snapshots, spinning up rogue instances, or modifying compute configurations to evade detection or establish persistence."},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Limiting cloud infrastructure discovery permissions through IAM policies prevents adversaries from enumerating virtual machines, storage, networks, and other cloud resources during reconnaissance."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device configuration privileges prevents adversaries from bridging network boundaries by modifying routing tables, NAT rules, or firewall policies on infrastructure devices."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Constraining firmware and OS image modification privileges to authorized network administrators prevents adversaries from patching or downgrading system images on routers and switches."},{"id":"T1606","name":"Forge Web Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to signing keys and token-generation infrastructure prevents adversaries from forging web cookies or SAML tokens, which requires access to the cryptographic material held by authentication services."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting container administration command access through RBAC policies prevents adversaries from executing arbitrary commands within containers or orchestrator control planes."},{"id":"T1610","name":"Deploy Container","tactics":["defense-evasion","execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting container deployment permissions to authorized pipelines prevents adversaries from deploying malicious containers that provide execution environments for post-exploitation tooling."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Applying least privilege to container runtimes by dropping unnecessary capabilities and enforcing seccomp profiles prevents adversaries from escaping container isolation to the underlying host."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting image build permissions on container hosts prevents adversaries from creating custom container images that embed malware or backdoors for defense evasion."},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Limiting Kubernetes and Docker API access through RBAC prevents adversaries from enumerating containers, pods, services, and cluster resources during post-compromise discovery."},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Enforcing least-privilege IAM policies on cloud storage APIs prevents adversaries from listing and discovering storage objects, buckets, and blobs during reconnaissance activities."},{"id":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting MFA enrollment and modification capabilities to authorized identity processes limits the effectiveness of MFA fatigue attacks by reducing the number of accounts susceptible to push notification abuse."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting plist file modification permissions on macOS prevents adversaries from altering property list files used for application configuration, launch agents, and system preferences."},{"id":"T1648","name":"Serverless Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting serverless function deployment and invocation permissions through IAM policies prevents adversaries from executing malicious code through Lambda, Cloud Functions, or Azure Functions."},{"id":"T1651","name":"Cloud Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud administration CLI and API access to authorized administrative accounts prevents adversaries from using cloud management commands for remote code execution on cloud resources."},{"id":"T1654","name":"Log Enumeration","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Limiting read access to audit logs and security event data prevents adversaries from enumerating log configurations and security monitoring capabilities during reconnaissance."},{"id":"T1657","name":"Financial Theft","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to financial systems, payment platforms, and transaction APIs to authorized personnel limits an adversary's ability to conduct financial theft even after establishing a foothold."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting debug privileges and SeDebugPrivilege token assignment prevents standard accounts from accessing LSASS process memory, the primary target for credential dumping tools like Mimikatz."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting administrative access to the registry and SAM database file prevents adversaries from extracting locally-cached password hashes from the Security Account Manager."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the NTDS.dit file and domain controller backup operations prevents adversaries from extracting the Active Directory database containing all domain credential hashes."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to LSA registry keys and the SECURITY hive prevents adversaries from extracting service account credentials, cached logon data, and other secrets stored in LSA Secrets."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to cached domain credential stores prevents adversaries from extracting the DCC2 hashes that allow offline cracking of domain user passwords."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting Active Directory replication privileges to domain controllers prevents adversaries from performing DCSync attacks, which abuse the Directory Replication Service to extract password data remotely."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to /proc filesystem entries prevents adversaries from reading process memory maps to extract credentials and cryptographic keys from running applications on Linux systems."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict file permissions on /etc/passwd and /etc/shadow prevents non-root users from reading password hash files used for offline credential cracking on Unix systems."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device configuration privileges prevents adversaries from configuring port mirroring or SPAN sessions that duplicate traffic to attacker-controlled collection points."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting RDP access rights to authorized administrators and enforcing Network Level Authentication prevents adversaries from using stolen credentials for Remote Desktop lateral movement."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting administrative share access (C$, ADMIN$, IPC$) to authorized accounts prevents adversaries from using SMB/Windows Admin Shares for file transfer and remote command execution."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting DCOM activation permissions prevents adversaries from instantiating remote COM objects for lateral movement across Windows environments."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Constraining SSH access to authorized key-based authentication and limiting which accounts can establish SSH sessions prevents unauthorized lateral movement via Secure Shell."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting VNC server access and limiting remote desktop sharing capabilities prevents adversaries from using Virtual Network Computing for persistent remote access and lateral movement."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting WinRM access to authorized administrators through group policy and firewall rules prevents adversaries from using Windows Remote Management for lateral movement and remote command execution."},{"id":"T1021.007","name":"Cloud Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud service IAM roles and enforcing session policies limits adversaries' ability to pivot across cloud tenants using compromised cloud service credentials."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting direct cloud VM connection permissions (e.g., Azure Bastion, AWS SSM) through IAM policies prevents adversaries from establishing direct management connections to cloud virtual machines."},{"id":"T1036.003","name":"Rename System Utilities","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to system utility directories prevents adversaries from replacing or renaming system binaries with malicious executables that masquerade as legitimate tools."},{"id":"T1036.005","name":"Match Legitimate Name or Location","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict directory permissions prevents adversaries from placing malicious files in trusted locations or naming them to match legitimate software, since these operations require elevated access."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound encrypted protocol access at the process level limits which applications can establish asymmetric encrypted connections used for covert data exfiltration over non-C2 channels."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Limiting network socket creation privileges prevents unauthorized processes from opening unencrypted protocol channels (FTP, HTTP) for data exfiltration over non-standard communication paths."},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting USB device mounting and write permissions prevents unauthorized data transfer to removable USB storage, a common physical exfiltration vector."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to the at command and scheduler APIs to authorized accounts prevents adversaries from creating one-time scheduled tasks for deferred command execution."},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting crontab modification to authorized users prevents adversaries from installing persistent cron jobs that execute malicious commands on a recurring schedule."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting Task Scheduler access to administrators prevents adversaries from creating Windows scheduled tasks for persistent command execution or privilege escalation."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting systemd timer creation and modification to authorized administrators prevents adversaries from abusing systemd timers for persistent, calendar-triggered code execution on Linux systems."},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting Kubernetes CronJob and Job creation through RBAC prevents adversaries from scheduling malicious workloads within container orchestration environments."},{"id":"T1055.001","name":"Dynamic-link Library Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting debug privileges prevents adversaries from injecting malicious DLLs into running processes, which requires the ability to write to and create threads in target process address space."},{"id":"T1055.002","name":"Portable Executable Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting cross-process memory write capabilities prevents adversaries from injecting portable executable code into legitimate processes for privilege escalation and defense evasion."},{"id":"T1055.003","name":"Thread Execution Hijacking","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting thread manipulation privileges prevents adversaries from suspending and hijacking execution threads in legitimate processes to redirect control flow to injected malicious code."},{"id":"T1055.004","name":"Asynchronous Procedure Call","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to queue asynchronous procedure calls to foreign processes prevents adversaries from using APC injection to execute malicious code in the context of target processes."},{"id":"T1055.005","name":"Thread Local Storage","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting process memory manipulation privileges prevents adversaries from corrupting Thread Local Storage callbacks to redirect execution to malicious code during DLL loading."},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting ptrace capabilities through kernel security modules prevents adversaries from attaching to running processes to inject code or read sensitive memory on Linux systems."},{"id":"T1055.009","name":"Proc Memory","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting /proc/[pid]/mem access prevents adversaries from directly writing to the memory space of running processes for code injection on Linux systems."},{"id":"T1055.011","name":"Extra Window Memory Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Constraining window message handling privileges prevents adversaries from using SetWindowLong to inject code via the extra window memory of processes hosting graphical windows."},{"id":"T1055.012","name":"Process Hollowing","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting process creation and memory manipulation APIs prevents adversaries from creating processes in a suspended state and hollowing their memory to host malicious code."},{"id":"T1055.013","name":"Process Doppelgänging","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting transactional NTFS and process creation privileges prevents adversaries from using process doppelganging to execute malicious code through transactional file operations."},{"id":"T1055.014","name":"VDSO Hijacking","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify VDSO (Virtual Dynamic Shared Object) mappings prevents adversaries from hijacking kernel-user space interfaces for code execution on Linux systems."},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting web portal administration privileges prevents adversaries from modifying authentication pages to capture user credentials through fake login forms on legitimate portals."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting PowerShell execution through Constrained Language Mode and restricting script execution policies prevents adversaries from running malicious PowerShell commands and scripts."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting AppleScript execution privileges and osascript access limits adversaries' ability to use Apple's scripting framework for macOS command execution and automation abuse."},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting cmd.exe execution through application control policies prevents adversaries from using the Windows Command Shell for interactive command execution and batch script processing."},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting shell access and limiting which accounts can invoke bash, sh, or zsh prevents adversaries from using Unix shells for interactive command execution on compromised Linux and macOS systems."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting VBScript and VBA macro execution through application policies prevents adversaries from using Visual Basic scripting for malicious document-based code execution."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting Python interpreter access to authorized automation accounts prevents adversaries from leveraging pre-installed Python environments for post-exploitation scripting and tool execution."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting JavaScript execution environments (cscript, wscript, Node.js) to authorized processes prevents adversaries from using JavaScript for fileless malware execution and payload delivery."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device CLI access to authorized network administrators prevents adversaries from executing commands on routers, switches, and firewalls for infrastructure manipulation."},{"id":"T1059.009","name":"Cloud API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting cloud API access through granular IAM policies prevents adversaries from invoking cloud management APIs for resource manipulation, data access, and infrastructure modification."},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting AutoHotKey and AutoIT execution to approved automation use cases prevents adversaries from using these scripting frameworks for keylogging, GUI manipulation, and malware delivery."},{"id":"T1059.011","name":"Lua","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting Lua interpreter access to authorized applications prevents adversaries from exploiting embedded Lua scripting environments for code execution within host applications."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting permissions on Windows Event Log files and the EventLog service prevents adversaries from clearing Security, System, and Application event logs to remove forensic evidence."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting write access to /var/log and syslog configuration prevents adversaries from clearing Linux and macOS system logs that record authentication events and process execution."},{"id":"T1070.003","name":"Clear Command History","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to command history files (.bash_history, .zsh_history, PSReadLine) prevents adversaries from clearing shell histories that document executed commands."},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting network device configuration access prevents adversaries from clearing connection logs, ARP tables, and routing histories that reveal lateral movement activity."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting mailbox administration privileges prevents adversaries from purging email data to remove evidence of phishing campaigns, data exfiltration, or unauthorized email forwarding rules."},{"id":"T1070.009","name":"Clear Persistence","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to persistence mechanism configuration (registry, startup folders, scheduled tasks) prevents adversaries from selectively removing their persistence artifacts to evade forensic analysis."},{"id":"T1078.001","name":"Default Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling or renaming default accounts and removing unnecessary default privileges eliminates the readily-exploitable credential set that adversaries target for initial access and privilege escalation."},{"id":"T1078.002","name":"Domain Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Constraining domain account privileges to the minimum required for each role limits the impact of domain credential compromise, preventing adversaries from using a single account for broad lateral movement."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting local account privileges and disabling local administrator accounts where possible reduces the value of compromised local credentials for persistence and privilege escalation."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing least-privilege IAM policies on cloud accounts restricts what adversaries can access with compromised cloud credentials, limiting blast radius across cloud tenants and subscriptions."},{"id":"T1087.004","name":"Cloud Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud directory read permissions prevents adversaries from enumerating cloud accounts, roles, and service principals during post-compromise discovery activities."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to add credentials to cloud service principals and managed identities prevents adversaries from establishing persistent backdoor access through additional authentication material."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting email delegation and mailbox permission changes to authorized administrators prevents adversaries from granting themselves persistent access to other users' email."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting cloud role assignment capabilities to authorized identity administrators prevents adversaries from self-escalating by granting their compromised account additional cloud permissions."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to ~/.ssh/authorized_keys and SSH configuration files prevents adversaries from implanting public keys for persistent, password-free SSH access."},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting device registration permissions in Azure AD and other identity providers prevents adversaries from registering rogue devices that can authenticate to cloud resources."},{"id":"T1098.006","name":"Additional Container Cluster Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Kubernetes RBAC role binding to authorized cluster administrators prevents adversaries from assigning themselves elevated container orchestration privileges."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting Active Directory and local group membership modification to authorized administrators prevents adversaries from adding compromised accounts to privileged groups for access escalation."},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing account lockout after failed attempts and restricting authentication to necessary accounts limits the effectiveness of password guessing attacks against exposed services."},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to password hash stores and enforcing strong hashing algorithms reduces the feasibility of offline password cracking against captured credential databases."},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting the number of accounts accessible to external authentication and enforcing lockout policies limits the effectiveness of password spraying campaigns across the environment."},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting authentication endpoints and enforcing account lockout policies reduces the success rate of credential stuffing attacks that reuse passwords from prior breaches."},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting SeImpersonatePrivilege and token duplication rights prevents adversaries from stealing or duplicating access tokens to assume the identity of higher-privilege accounts."},{"id":"T1134.002","name":"Create Process with Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting CreateProcessWithToken and CreateProcessAsUser privileges prevents adversaries from spawning new processes under stolen tokens with elevated permissions."},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting token creation privileges prevents adversaries from using LogonUser and ImpersonateLoggedOnUser to fabricate tokens that impersonate privileged accounts."},{"id":"T1134.005","name":"SID-History Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to SID-History modification prevents adversaries from injecting security identifiers into account histories to inherit the access rights of privileged domain accounts."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting local account creation rights to authorized administrators prevents adversaries from creating persistent backdoor accounts on individual compromised endpoints."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting domain account creation to authorized identity management processes prevents adversaries from creating new domain accounts for persistent network-wide access."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud IAM user and service account creation to authorized administrators prevents adversaries from establishing persistent cloud access through new cloud identities."},{"id":"T1137.001","name":"Office Template Macros","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify Office templates and global macros prevents adversaries from implanting malicious code in template files that execute whenever Office applications launch."},{"id":"T1137.002","name":"Office Test","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting write access to Office Test registry keys prevents adversaries from configuring Office Test entries that load arbitrary DLLs on Office application startup."},{"id":"T1137.003","name":"Outlook Forms","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting custom form deployment in Exchange environments prevents adversaries from installing malicious Outlook forms that execute code when users view specially-crafted messages."},{"id":"T1137.004","name":"Outlook Home Page","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to configure Outlook Home Page settings prevents adversaries from setting custom home page URLs that load malicious content on Outlook folder access."},{"id":"T1137.005","name":"Outlook Rules","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting Outlook rule creation and modification prevents adversaries from establishing rules that automatically forward emails, execute applications, or run scripts triggered by incoming messages."},{"id":"T1137.006","name":"Add-ins","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting Office add-in installation to approved, signed extensions prevents adversaries from deploying malicious COM or VSTO add-ins that provide persistent code execution in Office applications."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing granular space and page permissions in Confluence prevents adversaries from bulk-downloading wiki content containing sensitive architectural, operational, and credential information."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting SharePoint site and document library permissions to authorized users limits adversaries' ability to collect sensitive corporate documents and data from the collaboration platform."},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing repository-level access controls limits adversaries' ability to clone and exfiltrate source code, configuration files, and embedded secrets from code repositories."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting CRM access to authorized sales and support personnel prevents adversaries from collecting sensitive customer data, financial records, and contact information from CRM platforms."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to messaging application archives and APIs prevents adversaries from harvesting sensitive communications and shared files from platforms like Slack, Teams, and internal chat systems."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting msiexec execution privileges prevents adversaries from using the Windows Installer to proxy-execute malicious payloads packaged as MSI files."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting which Electron applications can execute and constraining their process privileges prevents adversaries from abusing Electron's Node.js integration for signed-binary proxy execution."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting ACL modification rights (icacls, takeown) to administrators prevents adversaries from weakening Windows file and directory permissions to access protected resources."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting chmod, chown, and setfacl usage to authorized accounts prevents adversaries from modifying Linux and macOS file permissions to access protected files or make malware executable."},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting lifecycle policy configuration on cloud storage prevents adversaries from setting automated deletion rules that destroy data through legitimate cloud retention mechanisms."},{"id":"T1491.001","name":"Internal Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting write access to internal web applications and portals prevents adversaries from modifying internal-facing pages and dashboards for defacement or disinformation."},{"id":"T1491.002","name":"External Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting publishing permissions on public-facing web infrastructure prevents adversaries from defacing external websites and damaging organizational reputation."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting Exchange transport agent installation to authorized administrators prevents adversaries from deploying malicious mail transport agents that intercept and modify email traffic."},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting web server file system write access prevents adversaries from deploying web shells that provide persistent, interactive command execution through the web server process."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting IIS module installation and configuration to authorized administrators prevents adversaries from implanting malicious ISAPI filters or managed modules for persistent web server access."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify Terminal Services DLL configurations prevents adversaries from replacing RDP-related DLLs with malicious versions for persistent session interception."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting BIOS/UEFI configuration access and requiring signed firmware updates prevents adversaries from modifying system firmware to establish persistence below the operating system."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting boot sector modification through Secure Boot enforcement and disk access controls prevents adversaries from installing bootkits that load before the operating system."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to network device ROM Monitor mode prevents adversaries from installing ROMMONkit implants that persist in router firmware below the IOS image."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting TFTP server configuration and boot source settings prevents adversaries from redirecting network device boot processes to load compromised operating system images."},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting LaunchAgent plist creation to authorized paths and users prevents adversaries from installing persistent macOS launch agents that execute at user login."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting systemd unit file creation and the ability to enable services prevents adversaries from installing persistent systemd services on Linux systems."},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting Windows service creation and modification to authorized administrators prevents adversaries from installing malicious services that run with SYSTEM privileges and survive reboots."},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting LaunchDaemon plist creation to authorized administrators prevents adversaries from installing system-level persistent daemons on macOS that run regardless of user login."},{"id":"T1543.005","name":"Container Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting container service deployment permissions prevents adversaries from creating persistent container-based services in orchestration platforms like Kubernetes."},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting WMI event subscription creation to administrators prevents adversaries from establishing persistent event-based triggers that execute code in response to system events."},{"id":"T1546.004","name":"Unix Shell Configuration Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting write access to shell configuration files (.bashrc, .zshrc, .profile) prevents adversaries from injecting malicious commands that execute on every shell session."},{"id":"T1546.011","name":"Application Shimming","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Application Compatibility Shim Database installation to administrators prevents adversaries from using application shimming for persistent code injection and privilege escalation."},{"id":"T1546.013","name":"PowerShell Profile","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting write access to PowerShell profile files prevents adversaries from inserting malicious code that executes automatically whenever a PowerShell session is opened."},{"id":"T1546.016","name":"Installer Packages","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting installer package creation and deployment permissions prevents adversaries from crafting malicious installer packages that execute elevated code during installation."},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to register custom time providers prevents adversaries from installing malicious DLLs that load automatically through the Windows Time service at startup."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting modifications to Winlogon Helper DLL registry entries prevents adversaries from configuring malicious DLLs to load during the Windows logon process."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting kernel module loading to signed modules from authorized sources prevents adversaries from inserting malicious kernel modules or extensions for rootkit-level persistence."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to shortcut files (.lnk) in startup directories prevents adversaries from modifying shortcuts to execute malicious code on user login."},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to register print processors to authorized administrators prevents adversaries from installing malicious print processor DLLs that load with the print spooler service."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create XDG Autostart entries prevents adversaries from installing desktop environment startup items on Linux systems for persistent code execution at user login."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict UAC configuration at the highest notification level and removing standard users from the local administrators group limits the effectiveness of UAC bypass techniques."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting sudoers file entries and enforcing timestamp_timeout=0 prevents adversaries from abusing cached sudo credentials to execute commands as root without re-authentication."},{"id":"T1548.005","name":"Temporary Elevated Cloud Access","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict time limits and approval workflows on temporary cloud role elevations prevents adversaries from abusing just-in-time access to maintain persistent elevated privileges."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify macOS TCC (Transparency, Consent, and Control) databases prevents adversaries from granting malware permissions to access protected resources like the camera, microphone, and files."},{"id":"T1550.002","name":"Pass the Hash","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting local administrator account reuse across endpoints and enabling Credential Guard prevents adversaries from using captured NTLM hashes for pass-the-hash lateral movement."},{"id":"T1550.003","name":"Pass the Ticket","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting Kerberos delegation settings and enforcing ticket validation prevents adversaries from reusing stolen Kerberos tickets for authentication to additional services."},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting file system access to configuration files, scripts, and deployment artifacts prevents adversaries from discovering credentials embedded in plaintext files across the environment."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting registry read access to sensitive hives prevents adversaries from extracting credentials stored in registry keys by applications that use the registry for credential persistence."},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to Group Policy Objects and SYSVOL shares prevents adversaries from extracting cached credentials from Group Policy Preferences XML files."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting container API access through RBAC prevents adversaries from querying Kubernetes secrets, ConfigMaps, and environment variables that contain embedded credentials."},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify SIP (Subject Interface Package) and trust provider DLL registrations prevents adversaries from hijacking Windows code signing verification."},{"id":"T1553.006","name":"Code Signing Policy Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting code signing policy modification to authorized administrators prevents adversaries from weakening code signing requirements to allow execution of unsigned malicious binaries."},{"id":"T1555.002","name":"Securityd Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the macOS securityd process memory prevents adversaries from extracting keychain credentials by dumping the security daemon's address space."},{"id":"T1555.006","name":"Cloud Secrets Management Stores","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing granular IAM policies on cloud secrets managers (AWS Secrets Manager, Azure Key Vault) prevents unauthorized access to stored API keys, certificates, and database credentials."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification privileges on domain controllers prevents adversaries from patching LSASS or installing custom password filters that capture credentials during authentication."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting write access to PAM configuration files and module directories prevents adversaries from inserting malicious Pluggable Authentication Modules that intercept or bypass authentication."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device configuration privileges prevents adversaries from modifying TACACS+, RADIUS, or local authentication settings to insert credential-capturing backdoors."},{"id":"T1556.005","name":"Reversible Encryption","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to modify Active Directory password storage policies prevents adversaries from enabling reversible encryption that exposes plaintext passwords from the directory."},{"id":"T1556.006","name":"Multi-Factor Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting MFA configuration and conditional access policy modification prevents adversaries from disabling or downgrading multi-factor authentication requirements to bypass security controls."},{"id":"T1556.007","name":"Hybrid Identity","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting Azure AD Connect and hybrid identity configuration to authorized administrators prevents adversaries from manipulating identity synchronization to create authentication backdoors."},{"id":"T1556.008","name":"Network Provider DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to register Network Provider DLLs prevents adversaries from installing credential-intercepting libraries in the Windows network authentication pipeline."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Limiting conditional access policy modification to authorized security administrators prevents adversaries from weakening authentication requirements to allow access from untrusted locations or devices."},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the krbtgt account and domain controller backups prevents adversaries from obtaining the key material necessary to forge Golden Tickets for unrestricted domain access."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting service account privileges and rotating service account passwords reduces the window of opportunity for adversaries to forge Silver Tickets using compromised service account hashes."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting which accounts have SPNs registered and enforcing strong service account passwords reduces the attack surface for Kerberoasting attacks that crack service ticket encryption offline."},{"id":"T1558.005","name":"Ccache Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting file system access to Kerberos credential cache files prevents adversaries from stealing cached tickets that enable authentication without knowing the original password."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting COM object registration and instantiation privileges limits adversaries' ability to abuse Component Object Model interfaces for cross-process code execution."},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting DDE (Dynamic Data Exchange) capability and restricting which applications can establish DDE channels prevents adversaries from executing commands through document-based DDE payloads."},{"id":"T1561.001","name":"Disk Content Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting raw disk access and volume shadow copy management prevents adversaries from overwriting disk content to destroy data and evade forensic recovery."},{"id":"T1561.002","name":"Disk Structure Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting low-level disk access to authorized maintenance processes prevents adversaries from corrupting partition tables and disk structures to render systems permanently unbootable."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to stop, uninstall, or reconfigure security tools to SYSTEM-level or protected processes prevents adversaries from disabling antivirus, EDR, and other defensive controls."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting audit policy modification and Event Log service configuration to authorized administrators prevents adversaries from disabling Windows event logging to operate undetected."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firewall rule modification to authorized network administrators prevents adversaries from disabling or reconfiguring host and network firewalls to open lateral movement paths."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to ETW (Event Tracing for Windows) provider configuration prevents adversaries from blocking telemetry indicators before they reach security monitoring tools."},{"id":"T1562.007","name":"Disable or Modify Cloud Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud security group and firewall rule modification to authorized administrators prevents adversaries from weakening cloud network security controls to enable unauthorized access."},{"id":"T1562.008","name":"Disable or Modify Cloud Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting CloudTrail, Azure Monitor, and GCP audit log configuration to authorized security administrators prevents adversaries from disabling cloud logging to conceal their activities."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting boot configuration modification prevents adversaries from forcing Safe Mode restarts that disable security software, allowing unrestricted malware execution."},{"id":"T1562.012","name":"Disable or Modify Linux Audit System","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting auditd and audit system configuration to authorized administrators prevents adversaries from disabling Linux audit logging that records system calls, file access, and security events."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting SSH agent forwarding and session multiplexing prevents adversaries from hijacking existing SSH sessions to move laterally without establishing new authenticated connections."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting RDP session management privileges prevents adversaries from connecting to disconnected sessions or shadowing active sessions for lateral movement via Remote Desktop."},{"id":"T1566.003","name":"Spearphishing via Service","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting which external services can deliver content to users and limiting permissions for external collaboration reduces the risk of spearphishing through third-party messaging platforms."},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting launchctl execution privileges on macOS prevents adversaries from using the launch control system to execute services and daemons for persistence and privilege escalation."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create and start Windows services to authorized administrators prevents adversaries from using the Service Control Manager for executing malicious payloads."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to application framework directories prevents adversaries from placing malicious dylibs in locations where macOS applications search for dynamic libraries."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict file permissions on installer directories prevents adversaries from replacing installer executables with malicious binaries that execute with elevated privileges during updates."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification of PATH environment variables prevents adversaries from inserting directories containing malicious executables that intercept calls to legitimate system commands."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict permissions on DLL search directories prevents adversaries from placing malicious libraries in locations searched before the legitimate DLL path."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Properly quoting service executable paths and restricting write access to path traversal directories eliminates the unquoted path vulnerability that allows adversary executable interception."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Setting strict ACLs on service executable paths and configuration files prevents adversaries from replacing service binaries with malicious executables that inherit service-level privileges."},{"id":"T1574.011","name":"Services Registry Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to service-related registry keys prevents adversaries from modifying ImagePath and ServiceDLL entries to redirect service execution to malicious code."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting the ability to set COR_PROFILER environment variables prevents adversaries from configuring malicious .NET profiler DLLs that load into every CLR process."},{"id":"T1574.014","name":"AppDomainManager","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to set APPDOMAIN_MANAGER environment variables or modify application configuration files prevents adversaries from loading malicious AppDomainManagers into .NET applications."},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud snapshot creation permissions prevents adversaries from creating disk snapshots of running instances to extract data or clone environments for offline analysis."},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting cloud instance creation permissions prevents adversaries from spinning up rogue virtual machines in the target's cloud environment for cryptomining or as attack infrastructure."},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud instance termination permissions prevents adversaries from deleting virtual machines to destroy evidence, disrupt operations, or deny access to critical services."},{"id":"T1578.005","name":"Modify Cloud Compute Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting cloud compute configuration modification prevents adversaries from altering instance metadata, networking, or security settings to weaken defenses or enable data exfiltration."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting NAT and routing configuration on network devices prevents adversaries from creating translation rules that bridge segmented networks, circumventing zone-based security architectures."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to network device firmware update mechanisms prevents adversaries from patching the running system image to insert backdoors or disable security features."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to downgrade network device firmware prevents adversaries from installing older, vulnerable system images that lack current security patches."},{"id":"T1606.001","name":"Web Cookies","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to web application signing keys and session management infrastructure prevents adversaries from forging session cookies that grant authenticated access without valid credentials."},{"id":"T1606.002","name":"SAML Tokens","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to SAML signing certificates and token-signing keys on AD FS and identity provider servers prevents adversaries from forging SAML assertions for unauthorized cloud access."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-005","SP-013","SP-015","SP-016","SP-023","SP-026","SP-028","SP-029","SP-030","SP-032","SP-033","SP-035","SP-037","SP-040","SP-041","SP-042","SP-044","SP-045","SP-047","SP-050","SP-051","SP-053","SP-054"]}}