{"data":{"id":"CM-06","name":"Configuration Settings","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations];\nb. Implement the configuration settings;\nc. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements]; and\nd. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.","supplemental_guidance":"Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.\n\nCommon secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors.\n\nImplementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB] and security technical implementation guides (STIGs), which affect the implementation of CM-6 and other controls such as AC-19 and CM-7. The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.","enhancements":[{"id":"CM-06(01)","name":"Automated Management, Application, and Verification","statement":"Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms].","baselines":["high"]},{"id":"CM-06(02)","name":"Respond to Unauthorized Changes","statement":"Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions].","baselines":["high"]},{"id":"CM-06(03)","name":"Unauthorized Change Detection","withdrawn":true,"incorporated_into":["SI-07"]},{"id":"CM-06(04)","name":"Conformance Demonstration","withdrawn":true,"incorporated_into":["CM-04"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-06","name":"Configuration Settings","description":"a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations];\nb. Implement the configuration settings;\nc. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements]; and\nd. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.","discussion":"Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.\n\nCommon secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors.\n\nImplementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB] and security technical implementation guides (STIGs), which affect the implementation of CM-6 and other controls such as AC-19 and CM-7. The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.","related_controls":["AC-03","AC-19","AU-02","AU-06","CA-09","CM-02","CM-03","CM-05","CM-07","CM-11","CP-07","CP-09","CP-10","IA-03","IA-05","PL-08","PL-09","RA-05","SA-04","SA-05","SA-08","SA-09","SC-18","SC-28","SC-43","SI-02","SI-04","SI-06"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Minor text changes Changed parameter from specific information system checklists to specific common secure configurations Discussion adds explanation of privacy parameters"}},"compliance_mappings":{"iso_27001_2022":["A.8.9"],"iso_27002_2022":["5.37","8.9"],"cobit_2019":["BAI10"],"pci_dss_v4":["1.2","1.2.1","1.2.8","2.1","2.2","2.2.1","2.2.2"],"nist_csf_2":["DE.CM-09","PR.PS-01"],"cis_controls_v8":["CIS 4","CIS 4.1","CIS 4.2","CIS 4.6","CIS 4.7","CIS 10.5","CIS 12","CIS 12.1","CIS 12.3","CIS 16.7"],"soc2_tsc":["CC6.1-POF7","CC6.7-POF1","CC7.1","CC7.1-POF1","CC8.1"],"finos_ccc":["CCC-C14"],"iso_42001_2023":["A.4.2","A.6.2.3"],"iec_62443":["3-3 SR 7.6"],"asd_e8":["E8-3","E8-3 ML1","E8-3 ML3","E8-4","E8-4 ML1","E8-4 ML2","E8-4 ML3"],"nis2":["Art. 21(2)(g)"],"apra_cps_234":[],"mas_trm":["11"],"pra_op_resilience":[],"bsi_grundschutz":["APP.1.1","NET.1.2","NET.3.1","SYS.1.1","SYS.2.1"],"anssi":["Hygiene.18","Hygiene.20","SecNumCloud.13.1"],"osfi_b13":["B-13.2.2","B-13.3.2"],"finma_circular":["IV.A(28)","IV.A(29)","IV.C(64)"],"gdpr":["Art.25(1)","Art.25(2)","Art.32(1)(b)"],"dora":["Art.7(1)","Art.9(1)"],"bio2":["5.37","8.9"],"rbi_csf":["Annex1.5"],"fisc":["FISC.O3","FISC.T7","FISC.T14"],"lgpd_bcb":["LGPD.Art.46"],"hkma_tme1":["TME1.4.1"],"mlps_2":["8.1.5.3","8.1.10.4","8.1.10.6"],"dnb_good_practice":["DNB.3.2","DNB.13.1","DNB.19.2","DNB.20.1"],"cra":["CRA.I.2b","CRA.Info.8a"],"swift_cscf":["SWIFT.1.3","SWIFT.2.3","SWIFT.2.10"],"cbb_tm":["TM-5"],"cbuae":["CR-7"],"nca_ecc":["2-3","2-10","5-1"],"qatar_nia":["OS"],"sama_csf":["3.3","3.5","3.8","4.3"],"uae_ia":["T7"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.1","3.2"],"cbe_csf":["CTO-6","CTO-7","CTO-12"],"cbn_csf":["Part3.3"],"popia":["s19"],"sa_js2":["JS2-7.2","JS2-8.4"],"bot_cyber":["Ch2.1"],"cpmi_pfmi":["CG.PR","PFMI.P17","PFMI.P22"],"eba_ict":["3.4.4","3.5(a)"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.A.2","II.C.10","II.C.15(a)","II.C.18"],"hipaa_sr":["§164.316(b)(2)(ii)"],"iosco_cyber":["PROT-6"],"nydfs_500":["500.5"],"sebi_cscrf":["PR.ES","PR.IP"],"cmmc_2":["CM"],"nerc_cip":["CIP-010-4"],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":[],"ieee_1686":["5.4"],"ferc_cip":[],"doe_c2m2":["ASSET"],"api_1164":["Sec 7"],"awia":[],"iaea_nss":["Sec 5.4"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.2","FIPS 140-3 §7.6"],"cbest":[],"tiber_eu":[],"pci_hsm":["8"],"common_criteria":["CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.6.5","SYSC 13.7.1"],"fda_21_cfr_11":["§11.10(f)"],"fda_cyber":["PU-2","SPDF-3"],"hitrust_csf":["09.a"],"iso_27799":["12.1","18.4"],"lloyds_ms":["MS8.4"],"naic_ds":["4-config","4B"],"nhs_dspt":["NDG-9.9"],"pra_ss1_23":["P3.3","P-IT.3"],"solvency_ii":["DR.266","EIOPA-ICT-4.8"],"owasp_masvs_v2":["MASVS-CODE-1","MASVS-CRYPTO-1","MASVS-CRYPTO-2"],"csa_ccm_v4":["CCC-06","IVS-04","UEM-05","UEM-07"],"csa_aicm":["CCC-06","I&S-04","UEM-05","UEM-07"],"ccss_v9":["1.02.6"],"mica":["Art.62(1)","Art.62(5)"],"basel_sco60":["SCO60.51","SCO60.64","SCO60.65"],"bssc":["GSP-14","NOS-03","TIS-03"],"sec_custody_digital":["SEC-CD-03","SEC-CD-06","SEC-CD-07","SEC-CD-08"],"dpdpa":[]},"attack_techniques":[{"id":"T1001","name":"Data Obfuscation","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Enforcing restrictive configuration baselines on network devices and endpoints can limit the protocols and encoding methods available for outbound communications, constraining adversaries' ability to obfuscate command-and-control traffic using non-standard data transformations."},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings—such as enabling Credential Guard, restricting debug privileges, and enforcing LSA protection—directly limit the tools and OS interfaces adversaries exploit to dump credentials from memory, the SAM database, or domain controllers."},{"id":"T1008","name":"Fallback Channels","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restrictive configuration of egress firewall rules and proxy settings on endpoints limits the alternative network paths available to adversaries, preventing fallback C2 channels from successfully establishing connectivity when primary channels are blocked."},{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that disable or restrict Bluetooth, Wi-Fi, and other non-primary network interfaces on managed endpoints prevent adversaries from exfiltrating data through alternative network media outside standard monitoring channels."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Enforcing restrictive configuration settings for remote services—disabling unnecessary protocols like RDP, SMB, or WinRM by default—reduces the attack surface available for lateral movement through legitimate remote administration tools."},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Mandatory configuration baselines that enforce code signing requirements, restrict execution of unknown binaries, and enable content inspection help detect and block obfuscated files or information used to evade static analysis and signature-based detection."},{"id":"T1029","name":"Scheduled Transfer","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce data transfer quotas, time-based network access restrictions, and proxy-based content inspection can detect and prevent scheduled data exfiltration by limiting when and how data flows leave the network."},{"id":"T1030","name":"Data Transfer Size Limits","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Enforcing configuration-based data loss prevention policies with transfer size thresholds and content inspection at network boundaries detects and blocks adversary attempts to chunk exfiltrated data into sizes designed to evade volumetric detection."},{"id":"T1036","name":"Masquerading","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Strict configuration settings enforcing code signing validation, application whitelisting, and file integrity checks prevent adversaries from masquerading malicious executables as legitimate system binaries or trusted applications."},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Locking down boot and logon initialization script locations through restrictive configuration policies—such as GPO-enforced script paths and write-protected startup directories—prevents adversaries from planting persistent malicious scripts that execute during system startup or user logon."},{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that disables unnecessary network services, closes unused ports, and restricts ICMP responses reduces the information available through network service discovery scans, limiting adversary reconnaissance within the environment."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restrictive WMI configuration settings—including disabling remote WMI access for non-administrative users and enforcing WMI namespace security—prevent adversaries from leveraging Windows Management Instrumentation for remote code execution and system enumeration."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict egress filtering configurations that whitelist approved protocols and destination addresses at network boundaries prevents adversaries from exfiltrating data through alternative protocols such as DNS, ICMP, or unapproved encrypted channels."},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that disable USB mass storage devices, enforce device control rules, and restrict removable media mounting directly prevent exfiltration of sensitive data over physical media such as USB drives."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings that restrict task scheduler permissions, limit cron access to authorized users, and enforce approval workflows for scheduled jobs prevent adversaries from creating persistent scheduled tasks for execution or privilege escalation."},{"id":"T1055","name":"Process Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration baselines enforcing process protection mechanisms—such as ASLR, DEP, code integrity policies, and restricted debug privileges—raise the barrier for adversaries attempting process injection techniques to execute code within legitimate process address spaces."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Enforcing restrictive configuration baselines can disable or constrain scripting engines (PowerShell, WScript, bash) and command interpreters through execution policies, AppLocker rules, or shell restrictions, directly preventing adversaries from executing malicious scripts on managed endpoints."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Maintaining restrictive configuration settings that enforce DEP, ASLR, Control Flow Guard, and kernel patch protection reduces the exploitable attack surface, making privilege escalation through software vulnerability exploitation significantly more difficult."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce immutable logging, centralized log forwarding, and restricted permissions on log directories prevent adversaries from clearing or tampering with audit trails to conceal their activities."},{"id":"T1071","name":"Application Layer Protocol","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restrictive proxy and firewall configuration settings that enforce protocol inspection, block unauthorized application-layer protocols, and require authenticated outbound connections limit adversaries' ability to disguise C2 communications within standard protocols like HTTP or DNS."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration of software deployment tools—restricting administrative access, enforcing mutual authentication, and limiting deployment scope—prevents adversaries from abusing enterprise software distribution systems for lateral code execution."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict authentication configuration settings—password complexity requirements, account lockout thresholds, session timeout policies, and MFA enforcement—reduces the viability of compromised valid accounts for initial access, persistence, and privilege escalation."},{"id":"T1087","name":"Account Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict access to user enumeration interfaces—such as disabling anonymous SAM enumeration, hiding user lists from login screens, and limiting LDAP query permissions—reduce the information adversaries can gather about account structures during discovery."},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Strict proxy configuration settings that enforce authenticated outbound connections, block unauthorized SOCKS or HTTP proxy tools, and restrict direct internet access prevent adversaries from establishing proxy-based C2 relay infrastructure."},{"id":"T1091","name":"Replication Through Removable Media","tactics":["initial-access","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that disable autorun/autoplay functionality and enforce device control restrictions on removable media prevent malware propagation through infected USB drives and other removable storage devices."},{"id":"T1092","name":"Communication Through Removable Media","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting removable media access through configuration policies prevents adversaries from using physical media as covert communication channels to transfer commands and data to air-gapped or isolated systems."},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Network configuration settings that enforce protocol whitelisting at the firewall level and block raw socket access from non-privileged applications prevent adversaries from establishing C2 channels over non-application-layer protocols like ICMP or raw TCP."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce approval workflows for privilege changes, restrict self-service account modification, and lock down group membership management prevent adversaries from silently manipulating accounts to maintain persistent elevated access."},{"id":"T1102","name":"Web Service","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restrictive web access configuration settings—URL category filtering, domain whitelisting, and SSL/TLS inspection—limit adversaries' ability to use legitimate web services as C2 dead drops or relay points."},{"id":"T1104","name":"Multi-Stage Channels","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Egress filtering and protocol inspection configurations that restrict outbound connectivity to approved destinations and inspect encrypted traffic prevent adversaries from establishing multi-stage C2 channels that evolve through different infrastructure."},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration baselines enforcing application whitelisting, download restrictions, and proxy-based content inspection prevent adversaries from transferring additional tools and payloads into the compromised environment via the network."},{"id":"T1106","name":"Native API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restrictive configuration settings such as API call filtering, code integrity policies, and restricted access to sensitive Windows APIs limit adversaries' ability to invoke native OS APIs directly for execution, process manipulation, or credential harvesting."},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration-enforced account lockout policies, password complexity requirements, and rate limiting on authentication endpoints directly mitigate brute force attacks by increasing the cost and detectability of credential guessing attempts."},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that enforces phishing-resistant MFA methods (FIDO2/WebAuthn), disables legacy authentication protocols, and restricts token caching prevents adversaries from intercepting or replaying multi-factor authentication credentials."},{"id":"T1114","name":"Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restrictive email client and server configuration settings—disabling auto-forwarding rules, enforcing access controls on mailbox delegation, and limiting programmatic mailbox access—prevent adversaries from collecting sensitive email content at scale."},{"id":"T1119","name":"Automated Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict file system permissions, disable unnecessary scripting capabilities, and restrict API access limit the tools and interfaces adversaries can leverage for automated data collection across compromised systems."},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration baselines that restrict or disable execution of trusted developer utilities (MSBuild, dotnet) through application control policies prevent adversaries from abusing these signed binaries to proxy execution of malicious code."},{"id":"T1132","name":"Data Encoding","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict proxy configuration with deep content inspection enables detection of non-standard data encoding patterns in outbound traffic, identifying C2 communications that use Base64 or custom encoding to evade signature-based detection."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restrictive configuration of external remote services—enforcing VPN-only access, requiring MFA, disabling unnecessary remote access protocols, and limiting exposed service endpoints—reduces the attack surface for initial access and persistent backdoor connections."},{"id":"T1134","name":"Access Token Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict token creation privileges, enforce User Account Control, and limit the SeImpersonatePrivilege assignment to essential service accounts prevent adversaries from manipulating access tokens to escalate privileges or impersonate users."},{"id":"T1135","name":"Network Share Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts network share visibility, enforces share-level permissions, and disables unnecessary administrative shares (C$, ADMIN$) limits adversary ability to discover and enumerate network file shares during lateral movement."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that restrict local and domain account creation to authorized administrative processes and enforce approval workflows prevent adversaries from creating rogue accounts for persistent access."},{"id":"T1137","name":"Office Application Startup","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Hardened Office application configurations—disabling macros by default, blocking external add-ins, and enforcing trusted publisher requirements—prevent adversaries from installing persistent backdoors through Office startup mechanisms."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Browser configuration policies that restrict extension installation to an approved whitelist, enforce enterprise management of browser settings, and disable sideloading prevent adversaries from installing malicious browser extensions for persistent access and credential theft."},{"id":"T1187","name":"Forced Authentication","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable NTLM authentication, enforce SMB signing, and restrict outbound authentication to trusted domains prevent adversaries from coercing forced authentication to capture credential hashes via techniques like malicious SCF files or document links."},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restrictive browser and endpoint configuration settings—enabling site isolation, disabling unnecessary plugins, enforcing content security policies, and keeping browser sandboxing active—reduce the attack surface exploitable through drive-by compromise of vulnerable web content."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings for public-facing applications—disabling debug modes, enforcing input validation, restricting unnecessary features, and applying secure defaults—reduce the exploitable vulnerabilities available for initial access through internet-exposed services."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce software supply chain integrity checks—code signing validation, package hash verification, and trusted repository restrictions—detect tampered or compromised components before they enter the production environment."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict BITS job creation to authorized processes and administrative accounts, and enforce monitoring of BITS activity, prevent adversaries from abusing Background Intelligent Transfer Service for stealthy file transfer and persistence."},{"id":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Strict configuration of trust relationships—limiting shared credentials, enforcing network segmentation between partner connections, and requiring MFA for third-party access—reduces the risk of adversaries leveraging trusted relationships for initial access."},{"id":"T1201","name":"Password Policy Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts access to password policy information—limiting GPO read access, disabling anonymous LDAP queries, and securing policy retrieval interfaces—prevents adversaries from discovering password requirements to optimize credential attacks."},{"id":"T1204","name":"User Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce file type restrictions, disable macro execution by default, and enable SmartScreen or equivalent warning mechanisms reduce the likelihood of successful user execution of malicious files or links."},{"id":"T1205","name":"Traffic Signaling","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening of network devices that disables port knocking capabilities, enforces strict ACL rules, and locks down management interfaces prevents adversaries from using traffic signaling to trigger hidden backdoor services on compromised infrastructure."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Enforcing restrictive configuration baselines that disable unnecessary services, apply security patches promptly, and harden network-facing applications directly reduces the vulnerabilities available for adversaries to exploit during lateral movement."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings that enable exploit protection mechanisms (DEP, ASLR, CFG) and restrict access to vulnerable system components reduce the attack surface for exploitation aimed at evading security controls."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restrictive configuration settings enforcing credential storage hardening, memory protection, and restricted access to authentication-related services mitigate exploitation attempts targeting software vulnerabilities to extract credentials."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict access controls on information repositories—wikis, SharePoint sites, databases, and document management systems—limit adversaries' ability to harvest sensitive data from centralized knowledge stores."},{"id":"T1216","name":"System Script Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that restrict execution of system scripts (PubPrn, SyncAppvPublishingServer) through application control rules prevent adversaries from abusing signed system scripts as proxy execution mechanisms to bypass security controls."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Application control configurations that restrict which signed system binaries can execute—blocking or monitoring utilities like mshta, regsvr32, rundll32, and msiexec—prevent adversaries from using trusted binaries to proxy execution of malicious payloads."},{"id":"T1219","name":"Remote Access Software","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that block unauthorized remote access tools, enforce application whitelisting for remote administration, and restrict outbound connections to unapproved remote desktop services prevent adversary use of legitimate remote access software for C2."},{"id":"T1220","name":"XSL Script Processing","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable XSLT processing or restrict it to trusted stylesheets prevent adversaries from using XSL script processing to execute arbitrary code through the msxsl.exe utility or embedded XML transforms."},{"id":"T1221","name":"Template Injection","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Hardened Office configurations that block external template loading, disable automatic content retrieval from remote sources, and enforce trusted location policies prevent adversaries from exploiting template injection to deliver malicious payloads via document files."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce mandatory access controls, restrict modification of file permissions to privileged accounts, and maintain ACL integrity prevent adversaries from weakening file and directory permissions to access or tamper with protected resources."},{"id":"T1482","name":"Domain Trust Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts domain trust enumeration—limiting access to AD trust objects, disabling anonymous LDAP queries, and restricting nltest usage—prevents adversaries from mapping trust relationships for cross-domain lateral movement."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restrictive configuration of domain and tenant policies—enforcing change approval workflows, limiting GPO modification rights, and monitoring policy changes—prevents adversaries from modifying domain or cloud tenant policies to weaken security controls or escalate privileges."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce service protection mechanisms, restrict service control permissions to authorized administrators, and implement change management for critical services prevent adversaries from stopping security-critical services to enable further attacks."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration baselines that protect system recovery mechanisms—restricting access to volume shadow copies, protecting backup configurations, and enforcing boot configuration integrity—prevent adversaries from inhibiting system recovery during destructive attacks."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce firmware write protections, require signed firmware updates, and enable Secure Boot prevent adversaries from corrupting device firmware to cause persistent denial of service or establish undetectable persistence."},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Hardened network configuration settings—rate limiting, SYN flood protection, ingress filtering, and redundant connectivity—reduce the impact of network denial of service attacks by limiting the effectiveness of volumetric and protocol-based flooding."},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce connection limits, request rate thresholds, and resource allocation controls on endpoints and services prevent adversaries from exhausting system resources through application or service-level denial of service attacks."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restrictive server configuration settings—disabling unnecessary modules, enforcing file integrity monitoring on web roots, and restricting server extension installation—prevent adversaries from deploying persistent server software components like web shells or malicious IIS modules."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing container image signing, trusted registry restrictions, and image scanning policies prevent adversaries from implanting malicious code within internal container images used for deployment."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce OAuth scope restrictions, limit token lifetimes, and require consent prompts for application permissions reduce the risk of adversaries stealing application access tokens for unauthorized API access."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restrictive cloud storage configuration settings—enforcing bucket policies, disabling public access, requiring encryption, and implementing access logging—prevent adversaries from accessing sensitive data stored in cloud storage services."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce cloud egress controls, restrict cross-account data transfer, and require approval for storage replication policies prevent adversaries from exfiltrating data by transferring it to attacker-controlled cloud accounts."},{"id":"T1539","name":"Steal Web Session Cookie","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Browser configuration settings that enforce secure cookie attributes (HttpOnly, Secure, SameSite), restrict cookie access from scripts, and implement short session lifetimes reduce the risk of adversaries stealing web session cookies for session hijacking."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing Secure Boot, firmware write protections, and UEFI validation prevent adversaries from establishing pre-OS boot persistence mechanisms that execute before the operating system and its security controls load."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration baselines that restrict service creation privileges, enforce service binary signing requirements, and limit systemd unit file modifications prevent adversaries from creating or modifying system processes for persistence and privilege escalation."},{"id":"T1546","name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings that restrict WMI subscription creation, lock down shell configuration files, and enforce integrity checking on event trigger mechanisms prevent adversaries from establishing persistence through event-triggered execution paths."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce UAC at the highest level, restrict sudo access, configure proper setuid/setgid permissions, and limit elevation prompt behavior prevent adversaries from abusing built-in elevation control mechanisms for privilege escalation."},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce Kerberos delegation restrictions, disable NTLM where possible, and implement token binding reduce adversaries' ability to use stolen hashes, tickets, or tokens as alternate authentication material for lateral movement."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that removes embedded credentials from scripts and configuration files, restricts access to credential stores, and enforces secrets management policies eliminates the unsecured credential repositories adversaries search during post-compromise operations."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict code signing policies, maintain trusted certificate stores, and validate trust chains prevent adversaries from subverting trust controls by installing rogue certificates or bypassing signature verification."},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing file integrity monitoring, binary signing requirements, and write protection on application directories detect and prevent adversaries from replacing legitimate software binaries with trojanized versions for persistent access."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Hardened authentication configuration settings—protecting authentication module directories, enforcing integrity checking on authentication libraries, and restricting modification of PAM configurations—prevent adversaries from modifying the authentication process to capture credentials or bypass controls."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce mutual TLS, disable legacy protocols (LLMNR, NBT-NS), enable SMB signing, and require encrypted communications prevent adversaries from positioning themselves as intermediaries to intercept or relay authentication traffic."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening of Kerberos settings—enforcing AES encryption, reducing ticket lifetimes, and restricting delegation—limits the effectiveness of Kerberoasting, golden ticket, and silver ticket attacks by reducing the window and material available for ticket theft or forgery."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict COM object registration, disable DDE in Office applications, and limit IPC mechanism access prevent adversaries from abusing inter-process communication channels for code execution."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce tamper protection on security tools, restrict modification of audit policies, and lock firewall configurations prevent adversaries from impairing defensive capabilities by disabling or modifying security controls."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce session timeout policies, disable session reconnection for unauthorized users, and require re-authentication for existing sessions prevent adversaries from hijacking active remote service sessions for lateral movement."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce data integrity controls—checksums, write-once policies, and mandatory access controls on critical data stores—detect and prevent adversary manipulation of stored, transmitted, or runtime data."},{"id":"T1566","name":"Phishing","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restrictive email gateway configuration settings—attachment filtering, URL rewriting, DMARC/DKIM/SPF enforcement, and sandboxed content analysis—reduce the success rate of phishing attacks delivering malicious payloads or credential harvesting links."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict service execution privileges, enforce binary signing for service binaries, and limit service control manager access prevent adversaries from executing arbitrary code through system service mechanisms."},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts administrative share access, enforces network segmentation, and limits SMB/WinRM connectivity between workstations prevents adversaries from transferring tools and malware laterally between compromised systems."},{"id":"T1571","name":"Non-Standard Port","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Firewall and proxy configuration settings that enforce destination port whitelisting and block outbound connections on non-standard ports prevent adversaries from establishing C2 channels on unexpected ports to evade basic network monitoring."},{"id":"T1572","name":"Protocol Tunneling","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing deep packet inspection, TLS interception at proxy boundaries, and blocking unauthorized tunneling protocols prevent adversaries from encapsulating C2 traffic within legitimate protocol tunnels."},{"id":"T1573","name":"Encrypted Channel","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enabling TLS inspection at network boundaries, enforcing certificate pinning, and restricting unapproved encryption libraries enable detection of adversary-controlled encrypted C2 channels that would otherwise evade content inspection."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict DLL search order, set proper directory permissions, and implement binary path quoting prevent adversaries from hijacking execution flow through DLL side-loading, path interception, or library injection."},{"id":"T1598","name":"Phishing for Information","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Restrictive email and web configuration settings—URL filtering, attachment scanning, and sender verification policies—reduce the effectiveness of phishing-for-information campaigns that target employees to gather intelligence for subsequent attacks."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Hardened network device configurations that enforce routing policy integrity, restrict management access, and prevent unauthorized NAT modifications prevent adversaries from bridging network boundaries to bypass segmentation controls."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing firmware integrity validation, restricting image modification capabilities, and enabling secure boot on network devices prevent adversaries from modifying system images to maintain persistent, undetectable access on network infrastructure."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict SNMP access (enforcing SNMPv3 with authentication), limit management protocol exposure, and enforce encrypted configuration backups prevent adversaries from extracting device configurations containing sensitive network architecture and credential information."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restrictive container runtime configuration settings—disabling privileged containers, enforcing read-only root filesystems, and restricting container admin command access—prevent adversaries from executing arbitrary commands within container environments."},{"id":"T1610","name":"Deploy Container","tactics":["defense-evasion","execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that restrict container deployment to approved images from trusted registries, enforce image signing, and require security scanning before deployment prevent adversaries from deploying malicious containers for code execution or defense evasion."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Hardened container configuration settings—enforcing seccomp profiles, disabling privileged mode, restricting kernel capabilities, and implementing namespace isolation—prevent adversaries from escaping container boundaries to compromise the underlying host system."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict local image build capabilities, enforce build pipeline controls, and require signed base images prevent adversaries from building malicious container images directly on compromised hosts to evade detection."},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restrictive RBAC configuration on container orchestration platforms that limits discovery API access and restricts namespace visibility prevents adversaries from enumerating container infrastructure, services, and resources during reconnaissance."},{"id":"T1622","name":"Debugger Evasion","tactics":["defense-evasion","discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict debug tool availability, disable debugging interfaces on production systems, and enforce anti-debugging protections prevent adversaries from detecting or evading debugger-based analysis and security monitoring tools."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce plist file integrity through System Integrity Protection, restrict plist modification permissions, and monitor property list changes prevent adversaries from modifying macOS plist files to alter system behavior or disable security features."},{"id":"T1648","name":"Serverless Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restrictive cloud configuration settings that enforce IAM role restrictions on serverless function creation, require code review for function deployments, and limit function permissions prevent adversaries from leveraging serverless execution for stealthy code execution."},{"id":"T1001.001","name":"Junk Data","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict protocol compliance and content inspection at network boundaries detect and block junk data padding appended to legitimate protocol traffic, disrupting adversary attempts to obfuscate C2 communications with noise."},{"id":"T1001.002","name":"Steganography","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Enforcing deep content inspection configurations and restricting file transfer to approved types at network boundaries enables detection of steganographic payloads hidden within image, audio, or video files used for covert C2 data exchange."},{"id":"T1001.003","name":"Protocol or Service Impersonation","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict protocol validation and service identification at network boundaries detect traffic impersonating legitimate services, preventing adversaries from disguising C2 channels as authorized protocol communications."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enabling LSA Protection (RunAsPPL), Credential Guard, and restricting SeDebugPrivilege prevent adversaries from accessing the LSASS process memory space to extract plaintext passwords, NTLM hashes, and Kerberos tickets."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Hardened configurations that restrict SAM database access permissions, enable encryption of the SAM hive, and limit local administrator access prevent adversaries from extracting cached password hashes from the Security Account Manager."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict access controls on the NTDS.dit file, restrict ntdsutil usage, and limit Volume Shadow Copy access on domain controllers prevent adversaries from extracting the Active Directory credential database."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts access to LSA Secrets registry keys, enforces additional protection on service account credentials, and limits debug privileges prevents adversaries from extracting cached service account passwords and domain trust keys from LSA storage."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that reduce the number of cached domain logon credentials (CachedLogonsCount), enforce credential encryption, and restrict local admin access prevent adversaries from extracting cached domain credentials for offline cracking."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts directory replication permissions, enforces AdminSDHolder protections, and monitors replication requests prevents adversaries from using DCSync to simulate domain controller replication and extract all domain password hashes."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict /proc filesystem access through mount options, enforce mandatory access controls (SELinux/AppArmor), and limit ptrace capabilities prevent adversaries from reading process memory to extract credentials on Linux systems."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing restrictive file permissions on /etc/passwd and /etc/shadow, enabling strong password hashing algorithms, and restricting root access prevent adversaries from reading password hash files on Linux systems."},{"id":"T1011.001","name":"Exfiltration Over Bluetooth","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that disable Bluetooth interfaces on endpoints, restrict Bluetooth device pairing, and enforce device control rules prevent adversaries from exfiltrating data through Bluetooth connections to nearby receiving devices."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict port mirroring capabilities, limit SPAN session creation to authorized administrators, and enforce monitoring of network tap configurations prevent adversaries from duplicating network traffic for covert exfiltration."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Hardened RDP configuration settings—enforcing Network Level Authentication, restricting RDP access to specific groups, limiting concurrent sessions, and disabling clipboard redirection—prevent adversaries from abusing Remote Desktop Protocol for lateral movement."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable default administrative shares, enforce SMB signing, and restrict SMB access through host-based firewall rules prevent adversaries from leveraging SMB and Windows admin shares for lateral movement."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict DCOM launch and access permissions, limit remote COM object activation, and enforce firewall rules for DCOM ports prevent adversaries from using Distributed Component Object Model for lateral code execution."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Hardened SSH configuration settings—disabling password authentication, enforcing key-based access with restricted key permissions, limiting SSH access by user and source IP, and disabling agent forwarding—prevent adversaries from leveraging SSH for lateral movement."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable VNC services by default, enforce strong authentication for VNC connections, and restrict VNC access through firewall rules prevent adversaries from using Virtual Network Computing for graphical remote access during lateral movement."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restrictive WinRM configuration settings—disabling the service on non-managed endpoints, enforcing HTTPS transport, restricting allowed remote management IP ranges, and requiring Kerberos authentication—prevent adversaries from using Windows Remote Management for lateral movement."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Cloud configuration settings that restrict direct VM serial console access, enforce bastion host architectures, and require IAM role-based access prevent adversaries from establishing direct connections to cloud virtual machines bypassing standard network controls."},{"id":"T1027.010","name":"Command Obfuscation","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce PowerShell constrained language mode, enable script block logging, and restrict obfuscated command execution help detect and prevent adversaries from using encoding and string manipulation to obfuscate malicious commands."},{"id":"T1036.001","name":"Invalid Code Signature","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict code signing validation, maintaining trusted publisher lists, and blocking execution of binaries with invalid or revoked signatures prevent adversaries from masquerading malware with forged or invalid code signatures."},{"id":"T1036.003","name":"Rename System Utilities","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies using application whitelisting that validate executables by hash and path—not just filename—prevent adversaries from renaming system utilities to evade detection rules that rely on process name-based monitoring."},{"id":"T1036.005","name":"Match Legitimate Name or Location","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Application control configurations that validate binaries by cryptographic hash and expected location detect adversaries placing malicious executables in legitimate system directories or naming them to match trusted software."},{"id":"T1036.007","name":"Double File Extension","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce visible file extensions, restrict double-extension execution, and block known masquerading patterns prevent adversaries from deceiving users with files named to hide their true executable extension."},{"id":"T1036.010","name":"Masquerade Account Name","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict account naming conventions and monitoring for accounts mimicking service or system accounts detect adversaries creating accounts with names designed to blend in with legitimate accounts."},{"id":"T1037.002","name":"Login Hook","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict login hook creation on macOS, enforce SIP protection on hook directories, and monitor LoginHook plist modifications prevent adversaries from establishing persistence through macOS login hook mechanisms."},{"id":"T1037.003","name":"Network Logon Script","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings that restrict network logon script locations to secured, read-only shares, enforce script signing, and limit Group Policy script modification rights prevent adversaries from planting malicious network logon scripts."},{"id":"T1037.004","name":"RC Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that restricts write access to RC script directories (/etc/rc.d, /etc/init.d), enforces integrity monitoring on init scripts, and limits root-level script modifications prevents adversaries from embedding persistence in Unix RC scripts."},{"id":"T1037.005","name":"Startup Items","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict access to macOS startup item directories, enforce System Integrity Protection, and monitor StartupItems plist modifications prevent adversaries from installing persistent startup items on macOS systems."},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict egress filtering that blocks unapproved encrypted protocols and restricts outbound connections to authorized destinations prevent adversaries from exfiltrating data through symmetric encrypted non-C2 protocol channels."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict outbound connectivity to approved ports and protocols, enforce TLS inspection at proxy boundaries, and block unauthorized certificate usage prevent data exfiltration over asymmetric encrypted non-C2 protocol channels."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Egress filtering configurations that whitelist approved unencrypted protocols and block unexpected protocol usage—such as FTP, TFTP, or raw HTTP to external destinations—prevent adversaries from exfiltrating data over cleartext non-C2 channels."},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Configuration policies that disable USB mass storage class drivers, enforce device control through endpoint management, and restrict removable media write access prevent adversaries from copying sensitive data to USB devices for physical exfiltration."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict at command usage to authorized users, disable the atd service where unnecessary, and enforce monitoring of at job creation prevent adversaries from scheduling persistent tasks through the at scheduling utility."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Hardened configuration settings that restrict Task Scheduler permissions, require administrative approval for scheduled task creation, and enforce monitoring of schtasks.exe usage prevent adversaries from creating Windows scheduled tasks for persistence and execution."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict systemd timer creation to authorized administrators, enforce file integrity monitoring on timer unit files, and limit systemd-run capabilities prevent adversaries from abusing systemd timers for persistent scheduled execution."},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict ptrace capabilities through kernel parameters (kernel.yama.ptrace_scope), enforce mandatory access controls, and limit debugging privileges prevent adversaries from using ptrace system calls to inject code into running processes on Linux."},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening of web portal authentication pages—enforcing Content Security Policy headers, restricting form action targets, and implementing subresource integrity checks—prevents adversaries from injecting credential capture scripts into web authentication interfaces."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing PowerShell constrained language mode, requiring script signing, enabling enhanced script block logging, and restricting PowerShell execution policies prevent adversaries from leveraging PowerShell for malicious command execution."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict AppleScript execution through application sandboxing, enforce Gatekeeper policies, and limit osascript usage to authorized processes prevent adversaries from using AppleScript as a command execution vector on macOS."},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict cmd.exe execution through application control policies, disable command shell access for standard users, and enforce process creation monitoring limit adversaries' ability to use the Windows command shell for execution."},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing restricted shell environments, limiting PATH variables, and applying mandatory access controls (SELinux/AppArmor) on shell interpreters constrain adversary ability to execute malicious commands through Unix shells."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable VBScript execution through Windows Script Host configuration, enforce macro blocking in Office applications, and restrict wscript.exe/cscript.exe through application control prevent Visual Basic-based script execution."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Python interpreter access, remove Python from standard user environments, and enforce application whitelisting that blocks unauthorized interpreter execution prevent adversaries from leveraging Python for malicious code execution."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict JavaScript execution contexts, disable Windows Script Host, enforce browser content security policies, and limit Node.js availability prevent adversaries from using JavaScript engines for malicious code execution."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Hardened network device configurations that enforce role-based CLI access, require strong authentication, restrict management interface exposure, and enable command authorization prevent adversaries from executing unauthorized commands on network infrastructure devices."},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict execution of AutoHotKey and AutoIT interpreters through application whitelisting, block unsigned automation scripts, and monitor for suspicious automation tool usage prevent adversaries from leveraging these scripting frameworks."},{"id":"T1059.011","name":"Lua","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Lua interpreter availability, enforce application whitelisting to block unauthorized Lua execution, and monitor embedded Lua engines prevent adversaries from using Lua scripting for malicious code execution."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing immutable Windows event log forwarding, restricting wevtutil permissions, and implementing tamper-protected central logging prevent adversaries from clearing Windows event logs to erase evidence of their activities."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce centralized syslog forwarding, restrict write access to log directories, and implement append-only log storage prevent adversaries from clearing Linux or Mac system logs to remove forensic evidence."},{"id":"T1070.003","name":"Clear Command History","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce persistent command history logging, restrict modification of history files, and forward command logs to a central SIEM prevent adversaries from clearing command history to hide executed commands."},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce centralized logging of network connection events, restrict access to network configuration tools, and implement immutable network audit trails prevent adversaries from clearing network connection history and configurations."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce mailbox audit logging, restrict mailbox cleanup permissions, and implement immutable email audit trails prevent adversaries from clearing mailbox data to remove evidence of email-based collection or communication."},{"id":"T1070.009","name":"Clear Persistence","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing integrity monitoring on persistence mechanism locations—registry, scheduled tasks, services—with immutable audit logging of changes, detect adversary attempts to clean up persistence artifacts after achieving their objectives."},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing web proxy inspection, blocking direct HTTP/HTTPS connections bypassing the proxy, and implementing URL categorization detect and disrupt C2 communications disguised as standard web protocol traffic."},{"id":"T1071.002","name":"File Transfer Protocols","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict FTP/SFTP/SCP to approved destinations, block unauthorized file transfer protocol usage, and enforce proxy-based inspection of file transfers prevent adversaries from using file transfer protocols for C2 communications."},{"id":"T1071.003","name":"Mail Protocols","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing mail relay restrictions, blocking direct SMTP/IMAP connections to external servers, and requiring authenticated mail gateway usage prevent adversaries from using mail protocols as covert C2 channels."},{"id":"T1071.004","name":"DNS","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing DNS query restrictions through approved resolvers, blocking direct external DNS queries, and implementing DNS inspection detect adversary C2 channels that encode commands and data within DNS queries and responses."},{"id":"T1078.002","name":"Domain Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strong password policies on domain accounts, implementing privileged access workstations, and requiring MFA for domain authentication reduce the pool of exploitable domain accounts available for adversary initial access and lateral movement."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce unique local administrator passwords (LAPS), disable default local accounts, and implement strong password requirements reduce adversary ability to leverage compromised local account credentials across multiple systems."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Cloud configuration settings enforcing conditional access policies, requiring MFA for all cloud account access, and implementing just-in-time access provisioning reduce the attack surface for adversaries attempting to use compromised cloud credentials."},{"id":"T1087.001","name":"Local Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that hide local user lists from login screens, restrict net user enumeration, and limit local account information disclosure prevent adversaries from discovering local account names for targeted credential attacks."},{"id":"T1087.002","name":"Domain Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict LDAP anonymous binding, limit Active Directory query permissions, and enforce audit logging on directory enumeration prevent adversaries from discovering domain account structures for targeted lateral movement."},{"id":"T1090.001","name":"Internal Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing internal network segmentation, restricting port forwarding capabilities, and blocking unauthorized proxy services prevent adversaries from deploying internal proxy relays to route C2 traffic through compromised internal hosts."},{"id":"T1090.002","name":"External Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Strict egress filtering configurations that whitelist approved external destinations, block outbound connections to uncategorized infrastructure, and enforce proxy authentication prevent adversaries from routing C2 through external proxy servers."},{"id":"T1090.003","name":"Multi-hop Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that block outbound connections to Tor exit nodes, restrict anonymous proxy services, and enforce deep traffic inspection prevent adversaries from using multi-hop proxy chains to obscure C2 infrastructure origin."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict IAM policies that restrict credential creation privileges, require MFA for API key generation, and implement approval workflows prevent adversaries from adding additional cloud credentials for persistent access."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict mailbox delegation changes, enforce approval workflows for email forwarding rules, and monitor Exchange permission modifications prevent adversaries from adding email delegate permissions for persistent mailbox access."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing separation of duties for cloud role assignments, requiring multi-party approval for privilege escalation, and implementing just-in-time role activation prevent adversaries from assigning additional cloud roles to maintain elevated access."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict write access to SSH authorized_keys files, enforce file integrity monitoring on .ssh directories, and limit SSH key management to authorized processes prevent adversaries from adding unauthorized SSH keys for persistent access."},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing device registration policies that restrict enrollment to compliant, corporate-managed devices, require administrator approval, and implement conditional access prevent adversaries from registering rogue devices for persistent network access."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict group membership modification to authorized administrators, enforce approval workflows for security group changes, and monitor group additions prevent adversaries from adding accounts to privileged groups for persistent access."},{"id":"T1102.001","name":"Dead Drop Resolver","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict and inspect access to web services commonly used as dead drop resolvers, enforce SSL inspection, and block access to uncategorized URLs prevent adversaries from retrieving C2 instructions from legitimate web platforms."},{"id":"T1102.002","name":"Bidirectional Communication","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing web content filtering, blocking access to known C2-hosting web services, and implementing SSL inspection detect and prevent adversaries from establishing bidirectional command-and-control through legitimate web service APIs."},{"id":"T1102.003","name":"One-Way Communication","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict outbound API access to approved web services, enforce proxy authentication, and implement content inspection prevent adversaries from using legitimate web platforms for one-way C2 communication channels."},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration-enforced account lockout policies with progressive delays, CAPTCHA requirements, and rate limiting on authentication endpoints directly limit the number of password guessing attempts an adversary can perform before triggering detection."},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strong password hashing algorithms (bcrypt, Argon2), salt requirements, and stretched key derivation significantly increase the computational cost of offline password cracking against stolen credential databases."},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing smart lockout policies that detect distributed authentication attempts across multiple accounts, combined with rate limiting and anomalous login alerting, mitigate password spraying attacks targeting many accounts with common passwords."},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing breach detection responses, blocking known compromised credentials, and implementing adaptive authentication that challenges logins from unfamiliar patterns mitigate credential stuffing attacks using credentials leaked from other services."},{"id":"T1114.002","name":"Remote Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict remote email access to approved protocols and clients, enforce MFA for webmail access, and limit Exchange Web Services permissions prevent adversaries from remotely collecting email content across the organization."},{"id":"T1114.003","name":"Email Forwarding Rule","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict email forwarding rule creation, disable auto-forwarding to external domains, and enforce administrator approval for mail flow rules prevent adversaries from establishing persistent email forwarding for ongoing data collection."},{"id":"T1127.001","name":"MSBuild","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict MSBuild execution through application control policies, block MSBuild for non-developer endpoints, and monitor MSBuild invocations prevent adversaries from abusing this trusted developer utility to compile and execute malicious code inline."},{"id":"T1127.002","name":"ClickOnce","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict ClickOnce application deployment, enforce trust prompts for unsigned applications, and block execution from untrusted internet zones prevent adversaries from leveraging ClickOnce for proxy execution."},{"id":"T1132.001","name":"Standard Encoding","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing proxy-based content inspection that detect Base64 and standard encoding patterns in C2 traffic, combined with protocol compliance validation, identify adversary use of standard encoding to obfuscate command-and-control data."},{"id":"T1132.002","name":"Non-Standard Encoding","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing deep content inspection and anomaly detection on outbound traffic identify non-standard or custom encoding schemes used by adversaries to encode C2 data in ways that evade standard signature-based detection."},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict SeImpersonatePrivilege assignment, enforce UAC integrity levels, and limit access to token manipulation APIs prevent adversaries from stealing or impersonating security tokens of higher-privileged users or services."},{"id":"T1134.002","name":"Create Process with Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings restricting CreateProcessWithToken API access, enforcing least-privilege service account configurations, and limiting token manipulation privileges prevent adversaries from spawning new processes under stolen token contexts."},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict LogonUser API access, enforce strict service account policies, and limit the creation of impersonation tokens to authorized service processes prevent adversaries from forging tokens to operate under different security contexts."},{"id":"T1134.005","name":"SID-History Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict SID-History modification permissions, enable SID filtering on domain trusts, and monitor SID-History attribute changes prevent adversaries from injecting privileged SIDs to escalate access across trust boundaries."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict local account creation to authorized administrators, enforce approval workflows for new accounts, and implement real-time alerting on local account creation events prevent adversaries from creating persistent local backdoor accounts."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict domain account creation privileges, enforce OU-based delegation controls, and implement alerting on unauthorized account creation in Active Directory prevent adversaries from creating rogue domain accounts for persistence."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing IAM policies that restrict cloud account creation, require multi-party approval for new identities, and implement automated alerting on new cloud account provisioning prevent adversaries from creating persistent cloud accounts."},{"id":"T1137.001","name":"Office Template Macros","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Office template locations to trusted paths, block macros from untrusted sources, and enforce template signing requirements prevent adversaries from planting malicious Office template macros for persistent code execution."},{"id":"T1137.002","name":"Office Test","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict the Office Test registry key path, enforce Group Policy protections on Office configuration, and monitor for test DLL loading prevent adversaries from using the Office Test persistence mechanism to execute arbitrary DLLs."},{"id":"T1137.003","name":"Outlook Forms","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict custom Outlook form deployment, enforce form trust settings, and block execution of forms from untrusted sources prevent adversaries from installing malicious Outlook forms for persistent code execution within the email client."},{"id":"T1137.004","name":"Outlook Home Page","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable or restrict the Outlook Home Page feature, enforce Group Policy controls on Outlook web view settings, and monitor home page URL modifications prevent adversaries from embedding malicious HTML in Outlook folder home pages."},{"id":"T1137.005","name":"Outlook Rules","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Outlook rule creation, disable rules that invoke applications, and enforce administrator review of mail flow rules prevent adversaries from establishing persistent Outlook rules that execute malicious commands upon email receipt."},{"id":"T1137.006","name":"Add-ins","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Office add-in installation to trusted publishers, enforce Group Policy add-in management, and block unsigned add-in loading prevent adversaries from deploying malicious add-ins for persistent code execution within Office applications."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing package manager integrity verification, restricting dependency sources to trusted registries, and implementing software bill of materials validation detect and prevent compromised software dependencies from entering the build pipeline."},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing URL filtering, link preview sanitization, and browser-based click protection warn users and block navigation to malicious links, reducing the success rate of adversary social engineering through link-based execution."},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing attachment blocking by file type, mandatory sandboxed execution of downloaded files, and SmartScreen warnings reduce the likelihood of users successfully executing malicious files delivered by adversaries."},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing container image signing, trusted registry restrictions, and automated vulnerability scanning prevent users from inadvertently deploying malicious container images that contain adversary payloads."},{"id":"T1205.001","name":"Port Knocking","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration hardening that disables port knocking services, enforces strict stateful firewall rules that ignore out-of-sequence packet patterns, and locks down management interfaces prevents adversaries from using port knocking sequences to activate hidden services."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce strict access controls on Confluence spaces, implement content-level permissions, and restrict API access limit adversary ability to harvest sensitive organizational knowledge from Confluence instances."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce granular SharePoint site permissions, restrict external sharing, and limit search crawl scope prevent adversaries from collecting sensitive documents and data from SharePoint repositories."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing role-based access controls on CRM platforms, restricting data export capabilities, and limiting API query permissions prevent adversaries from harvesting customer data and business intelligence from CRM systems."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict messaging application integrations, enforce data loss prevention policies on messaging platforms, and limit message export capabilities prevent adversaries from collecting sensitive conversations from messaging applications."},{"id":"T1216.001","name":"PubPrn","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that block PubPrn.vbs execution through application control policies, restrict Windows Script Host for cscript-based system scripts, and monitor script proxy execution prevent adversaries from abusing PubPrn for remote script execution."},{"id":"T1216.002","name":"SyncAppvPublishingServer","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict SyncAppvPublishingServer execution, block unnecessary App-V components through application control, and monitor PowerShell invocation through App-V scripts prevent adversaries from using this utility to proxy malicious execution."},{"id":"T1218.001","name":"Compiled HTML File","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that block or restrict hh.exe execution, enforce application control on CHM file processing, and disable HTML Help for non-essential users prevent adversaries from using compiled HTML files to execute embedded scripts."},{"id":"T1218.002","name":"Control Panel","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict access to control panel items, enforce application control on .cpl file execution, and monitor control.exe invocations prevent adversaries from executing malicious DLLs through the Windows Control Panel mechanism."},{"id":"T1218.003","name":"CMSTP","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict CMSTP.exe execution through application control policies and monitor for profile installation commands prevent adversaries from abusing the Connection Manager Profile Installer to bypass application whitelisting."},{"id":"T1218.004","name":"InstallUtil","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict InstallUtil.exe execution to authorized deployment processes and enforce application control policies blocking .NET installer utility abuse prevent adversaries from executing code through the .NET installation framework."},{"id":"T1218.005","name":"Mshta","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict or block mshta.exe execution through application control, disable HTA file associations, and enforce script execution restrictions prevent adversaries from using Microsoft HTML Application Host to execute malicious scripts."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict msiexec execution to approved installation sources, enforce MSI signing requirements, and block remote MSI installation prevent adversaries from using the Windows Installer for proxy execution of malicious packages."},{"id":"T1218.008","name":"Odbcconf","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Odbcconf.exe execution through application control policies and monitor for DLL registration via ODBC commands prevent adversaries from abusing this utility to execute arbitrary DLLs through response file processing."},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Regsvcs.exe and Regasm.exe execution, limit .NET COM registration to authorized processes, and monitor for suspicious assembly registration prevent adversaries from abusing these utilities for code execution."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Verclsid.exe execution, block COM object verification for untrusted CLSIDs, and implement application control covering this utility prevent adversaries from using it to proxy execution of malicious COM objects."},{"id":"T1218.013","name":"Mavinject","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Mavinject.exe execution through application control policies and monitor for DLL injection via this utility prevent adversaries from using it to inject malicious DLLs into running processes."},{"id":"T1218.014","name":"MMC","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict MMC snap-in loading to approved management console files, enforce application control on mmc.exe parameters, and block unsigned .msc files prevent adversaries from leveraging MMC for proxy execution."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Electron application installation to approved packages, enforce code signing for Electron apps, and monitor for suspicious Electron-based execution prevent adversaries from abusing Electron's Node.js integration for defense evasion."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing mandatory access controls, restricting icacls/cacls usage to administrators, and implementing file integrity monitoring prevent adversaries from modifying Windows file and directory permissions to access protected files."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing mandatory access controls (SELinux/AppArmor), restricting chmod/chown to authorized users, and monitoring permission changes prevent adversaries from modifying Linux/Mac file permissions to access restricted resources."},{"id":"T1498.001","name":"Direct Network Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce connection rate limiting, SYN cookie protections, and traffic scrubbing at network boundaries mitigate direct network flood attacks by filtering high-volume malicious traffic before it saturates network capacity."},{"id":"T1498.002","name":"Reflection Amplification","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that implement BCP38 ingress filtering, restrict responses to amplification-susceptible services, and enforce rate limiting prevent adversaries from leveraging reflection amplification for volumetric denial of service."},{"id":"T1499.001","name":"OS Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing OS-level connection limits, TCP stack hardening with SYN cookies, and resource reservation for critical services prevent adversaries from exhausting operating system resources through network connection flooding."},{"id":"T1499.002","name":"Service Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings implementing service-level rate limiting, request throttling, and connection pooling constraints prevent adversaries from overwhelming specific services with excessive requests designed to exhaust service processing capacity."},{"id":"T1499.003","name":"Application Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing application-layer rate limiting, request size restrictions, and computational resource quotas prevent adversaries from consuming application resources through crafted requests that trigger expensive processing operations."},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings maintaining up-to-date patches, enabling exploit protection mechanisms, and implementing input validation prevent adversaries from exploiting software vulnerabilities to crash applications or systems for denial of service."},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict SQL stored procedure creation and modification privileges, enforce procedure signing, and implement monitoring of procedure changes prevent adversaries from implanting malicious SQL stored procedures for persistent server-side execution."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Exchange transport agent installation, enforce agent signing requirements, and monitor transport pipeline modifications prevent adversaries from deploying malicious transport agents for persistent email interception."},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Hardened web server configuration settings—restricting write access to web directories, disabling script execution in upload folders, and enforcing file integrity monitoring—prevent adversaries from deploying web shells for persistent remote access."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict IIS module installation, enforce module signing requirements, and monitor changes to the IIS handler pipeline prevent adversaries from deploying malicious IIS components for persistent traffic interception."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Terminal Services DLL registration, enforce integrity checking on RDP-related libraries, and monitor Terminal Services configuration changes prevent adversaries from loading malicious DLLs through the Terminal Services subsystem."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce UEFI Secure Boot, require signed firmware updates, and enable firmware write protections prevent adversaries from modifying system firmware to establish persistence that survives OS reinstallation."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing Secure Boot with UEFI, enabling Measured Boot attestation, and restricting bootloader modifications prevent adversaries from installing bootkits that execute before the OS kernel loads, evading all OS-level security controls."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce ROM Monitor integrity validation, restrict ROMMON access, and implement secure boot chain verification on network devices prevent adversaries from installing ROMMONkits for persistent network infrastructure compromise."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict TFTP boot server sources, enforce authenticated boot image retrieval, and validate boot image integrity prevent adversaries from replacing network device boot images with malicious versions loaded via TFTP."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings restricting systemd service file creation, enforcing service file integrity monitoring, and requiring signed unit files prevent adversaries from creating or modifying systemd services for persistence and privilege escalation on Linux."},{"id":"T1546.002","name":"Screensaver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable or restrict screensaver executable modification, enforce Group Policy control over screensaver configuration, and monitor screensaver registry keys prevent adversaries from replacing the screensaver with a malicious payload for persistence."},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict WMI event subscription creation to authorized administrators, enforce WMI namespace permissions, and monitor for persistent WMI event consumers prevent adversaries from establishing persistence through WMI event-triggered execution."},{"id":"T1546.004","name":"Unix Shell Configuration Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing integrity monitoring on shell configuration files (.bashrc, .zshrc, .profile) and restricting write access to user profile directories prevent adversaries from persisting through Unix shell configuration modification."},{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing code signing for dynamic libraries, restricting modification of Mach-O binary headers, and implementing SIP protections prevent adversaries from adding LC_LOAD_DYLIB entries for persistent dynamic library loading on macOS."},{"id":"T1546.008","name":"Accessibility Features","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that protect accessibility feature binaries (sethc.exe, utilman.exe) through integrity monitoring, restrict replacement of accessibility executables, and enforce WRP protections prevent adversaries from hijacking accessibility features for backdoor access."},{"id":"T1546.013","name":"PowerShell Profile","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing integrity monitoring on PowerShell profile files and restricting write access to profile directories prevent adversaries from inserting malicious code into PowerShell profiles for persistent execution on every PowerShell session."},{"id":"T1546.014","name":"Emond","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict access to the emond rules directory, enforce file integrity monitoring on event monitor configurations, and disable emond when unnecessary prevent adversaries from leveraging the Event Monitor Daemon for persistence on macOS."},{"id":"T1546.016","name":"Installer Packages","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict installer package execution to approved sources, enforce package signing requirements, and monitor custom installer actions prevent adversaries from embedding malicious code in installer packages executed during software installation."},{"id":"T1547.002","name":"Authentication Package","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict authentication package registration in the LSA registry key, enforce integrity monitoring on authentication DLLs, and block unsigned authentication packages prevent adversaries from installing malicious authentication packages for persistence."},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict time provider DLL registration, enforce integrity checks on W32Time service configuration, and monitor time provider registry modifications prevent adversaries from loading malicious DLLs through the Windows Time service provider mechanism."},{"id":"T1547.005","name":"Security Support Provider","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Security Support Provider DLL registration, enforce integrity monitoring on SSP/AP registry keys, and block unsigned security packages prevent adversaries from installing malicious SSPs to intercept credentials during authentication."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce kernel module signing requirements, restrict module loading to approved modules, and implement integrity verification on kernel extensions prevent adversaries from loading malicious kernel modules for rootkit-level persistence."},{"id":"T1547.007","name":"Re-opened Applications","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict modification of the LoginWindow plist and re-opened applications list, and limit plist write access prevent adversaries from configuring malicious applications to reopen at login on macOS."},{"id":"T1547.008","name":"LSASS Driver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce LSASS protection (RunAsPPL), restrict driver loading through code signing requirements, and implement integrity monitoring on LSASS driver configurations prevent adversaries from loading malicious drivers into the LSASS process."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce integrity monitoring on shortcut files, restrict modifications to startup folder contents, and implement application control on shortcut targets prevent adversaries from modifying shortcuts to execute malicious payloads upon user login."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict write access to XDG autostart directories, enforce integrity monitoring on .desktop files, and implement application control on autostart entries prevent adversaries from establishing persistence through Linux desktop autostart mechanisms."},{"id":"T1548.001","name":"Setuid and Setgid","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that audit and restrict setuid/setgid bit assignments, enforce mount options (nosuid) on user-writable partitions, and monitor for new setuid binaries prevent adversaries from exploiting misconfigured setuid/setgid permissions for privilege escalation."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce UAC at the highest notification level, disable auto-elevation for administrative accounts, and restrict COM object elevation prevent adversaries from bypassing User Account Control through auto-elevation exploits."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict sudo access to specific commands via sudoers files, disable timestamp-based sudo caching, and enforce password requirements for each invocation prevent adversaries from abusing sudo or its credential cache for privilege elevation."},{"id":"T1548.004","name":"Elevated Execution with Prompt","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict authorization plugin usage on macOS, enforce Gatekeeper policies, and configure elevation prompts to require full credential re-entry prevent adversaries from abusing system-native elevation prompts for unauthorized privilege escalation."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing System Integrity Protection, restricting TCC database modification, and monitoring TCC authorization changes prevent adversaries from manipulating macOS Transparency, Consent, and Control frameworks to gain unauthorized resource access."},{"id":"T1550.001","name":"Application Access Token","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce short token lifetimes, implement token binding to client certificates, and restrict OAuth scope assignments reduce the utility of stolen application access tokens by limiting their validity window and authorization scope."},{"id":"T1550.002","name":"Pass the Hash","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable NTLM authentication where possible, enforce Credential Guard to protect hash storage, and implement admin-tier segmentation prevent adversaries from using stolen NTLM password hashes for pass-the-hash lateral movement."},{"id":"T1550.003","name":"Pass the Ticket","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing reduced Kerberos ticket lifetimes, restricting delegation permissions, and enabling PAC validation prevent adversaries from using stolen or forged Kerberos tickets for pass-the-ticket authentication to access remote services."},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing file permission restrictions on configuration files, implementing secrets scanning in repositories, and mandating credential vault usage prevent adversaries from discovering credentials stored in plaintext files or scripts."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict registry access permissions on credential-storing keys, enforce registry auditing, and mandate migration of registry-stored credentials to secure vaults prevent adversaries from extracting credentials from Windows registry values."},{"id":"T1552.003","name":"Bash History","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable persistent bash history or redirect it to centralized, access-controlled logging, and restrict read access to history files prevent adversaries from harvesting credentials and sensitive commands from shell history files."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce restrictive file permissions on SSH private keys and certificates, implement hardware-backed key storage, and restrict key directory access prevent adversaries from stealing private keys used for authentication."},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict cloud instance metadata API access through IMDSv2 enforcement requiring session tokens, implement metadata endpoint restrictions, and limit IAM role permissions prevent adversaries from harvesting credentials from cloud metadata services."},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that remove or encrypt sensitive data in Group Policy Preferences XML files, enforce LAPS for local administrator passwords, and restrict SYSVOL access prevent adversaries from extracting cached credentials from Group Policy Preferences."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict container API access through RBAC, enforce mutual TLS for API server communications, and limit service account token mounting prevent adversaries from extracting credentials through exposed container orchestration APIs."},{"id":"T1553.001","name":"Gatekeeper Bypass","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing Gatekeeper strictness on macOS, requiring notarized applications, and restricting quarantine attribute removal prevent adversaries from bypassing Gatekeeper code verification to execute untrusted applications."},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that protect Subject Interface Package and trust provider DLL registry entries, enforce integrity monitoring on trust verification components, and restrict CryptSIPDll modifications prevent adversaries from hijacking Windows trust validation."},{"id":"T1553.004","name":"Install Root Certificate","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict certificate store modification to authorized administrators, enforce certificate pinning for critical connections, and monitor trusted root certificate additions prevent adversaries from installing rogue root certificates."},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing Mark-of-the-Web enforcement, restricting NTFS alternate data stream manipulation, and configuring SmartScreen to block web-downloaded files without MOTW attributes prevent adversaries from bypassing web download protections."},{"id":"T1555.004","name":"Windows Credential Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict access to Windows Credential Manager APIs, enforce Credential Guard for credential isolation, and monitor credential vault access prevent adversaries from extracting stored credentials from Windows Credential Manager."},{"id":"T1555.005","name":"Password Managers","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce access controls on password manager databases, require hardware key-based master authentication, and monitor bulk credential export operations limit adversary ability to extract credentials from password management applications."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that protect domain controller authentication DLLs through integrity monitoring, restrict password filter installations, and enforce code signing for authentication modules prevent adversaries from installing skeleton key mechanisms on domain controllers."},{"id":"T1556.002","name":"Password Filter DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict password filter DLL registration in the LSA registry key, enforce integrity monitoring on notification packages, and require signed DLLs prevent adversaries from installing malicious password filters that capture plaintext credentials."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce integrity monitoring on PAM module directories, restrict PAM module installation to authorized administrators, and implement centralized PAM policy management prevent adversaries from modifying Pluggable Authentication Modules."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Hardened network device authentication configurations—enforcing local authentication database integrity, restricting TACACS+/RADIUS modifications, and implementing multi-factor authentication—prevent adversaries from modifying network device authentication to create backdoor access."},{"id":"T1556.008","name":"Network Provider DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict Network Provider DLL registration, enforce integrity monitoring on network provider registry entries, and require code signing for provider DLLs prevent adversaries from installing malicious network provider DLLs that intercept credentials."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce change management for conditional access policies, restrict policy modification to privileged administrators with MFA, and implement alerting on policy changes prevent adversaries from weakening conditional access policies."},{"id":"T1557.001","name":"LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable LLMNR and NBT-NS name resolution, enforce SMB signing, and require Kerberos authentication prevent adversaries from poisoning multicast name resolution responses to intercept and relay authentication credentials."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce Dynamic ARP Inspection, restrict static ARP modifications, and implement network segmentation with port security prevent adversaries from poisoning ARP caches to redirect network traffic for credential interception."},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce DHCP snooping, restrict rogue DHCP server deployment through port security, and implement 802.1X network access control prevent adversaries from deploying spoofed DHCP servers to redirect victim traffic for interception."},{"id":"T1557.004","name":"Evil Twin","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce 802.1X enterprise wireless authentication, restrict rogue access point deployment through wireless IDS, and implement certificate-based network verification prevent adversaries from creating evil twin access points to intercept wireless credentials."},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing frequent KRBTGT password rotation, reducing maximum ticket lifetime, and implementing PAC validation prevent adversaries from forging golden tickets by limiting the validity window of Kerberos TGT compromises."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing service account password complexity, reducing service ticket lifetimes, and implementing service-specific encryption requirements prevent adversaries from forging silver tickets by limiting material available for service ticket forgery."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing AES-256 Kerberos encryption (disabling RC4), using Group Managed Service Accounts with automated rotation, and limiting SPN exposure reduce the volume and crackability of service tickets vulnerable to Kerberoasting."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings requiring Kerberos pre-authentication for all accounts, enforcing strong password policies, and implementing AES encryption prevent adversaries from requesting and offline-cracking AS-REP responses for accounts with pre-authentication disabled."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict COM object registration, enforce DCOM launch permissions, and limit cross-process COM activation prevent adversaries from abusing Component Object Model interfaces for inter-process code execution."},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that disable DDE in Office applications through registry and Group Policy enforcement, block DDE auto-update links, and restrict OLE connections prevent adversaries from exploiting Dynamic Data Exchange for document-based code execution."},{"id":"T1559.003","name":"XPC Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict XPC service entitlements, enforce code signing for XPC services, and limit inter-process communication scope prevent adversaries from abusing macOS XPC Services for unauthorized inter-process command execution."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing tamper protection on security tools, preventing local modification of endpoint protection agents, and restricting uninstallation privileges prevent adversaries from disabling or modifying security tools to operate undetected."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing protected event log configurations, restricting access to the EventLog service, and implementing audit policy lockdown prevent adversaries from disabling Windows event logging to operate without generating audit records."},{"id":"T1562.003","name":"Impair Command History Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing persistent command history logging, restricting modification of history configuration variables, and redirecting command history to protected storage prevent adversaries from disabling shell command history logging."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing firewall change management, restricting local firewall modification privileges, and implementing configuration integrity monitoring prevent adversaries from disabling or modifying firewalls to enable unauthorized traffic flows."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing ETW provider protection, restricting modification of event tracing configurations, and implementing tamper detection on logging pipelines prevent adversaries from blocking security event indicators to evade detection."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict boot configuration modifications, enforce BitLocker with boot integrity validation, and disable safe mode access for non-administrators prevent adversaries from booting in safe mode to disable security tools."},{"id":"T1562.010","name":"Downgrade Attack","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce minimum protocol versions, disable legacy authentication methods, and restrict negotiation fallback prevent adversaries from forcing protocol downgrades that weaken encryption and authentication security."},{"id":"T1562.011","name":"Spoof Security Alerting","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce integrity validation on security alerting mechanisms, implement out-of-band alert verification, and restrict modification of SIEM notification channels prevent adversaries from spoofing security alerts."},{"id":"T1562.012","name":"Disable or Modify Linux Audit System","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing Linux audit daemon protection, restricting modification of audit rules and configurations, and implementing immutable audit configurations prevent adversaries from disabling the Linux audit system to evade detection."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing SSH session timeout, disabling SSH agent forwarding, requiring per-session authentication, and restricting SSH multiplexing prevent adversaries from hijacking existing SSH sessions for lateral movement."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing RDP session timeout and disconnection policies, restricting session reconnection to authenticated users, and requiring NLA prevent adversaries from hijacking disconnected or active RDP sessions for lateral movement."},{"id":"T1564.002","name":"Hidden Users","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict hidden user account creation, enforce visibility of all accounts in system management tools, and monitor for UserID values below standard thresholds detect adversary creation of hidden user accounts."},{"id":"T1564.006","name":"Run Virtual Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict virtual machine installation capabilities, enforce hypervisor access controls, and monitor for unauthorized VM creation prevent adversaries from running malicious virtual instances to evade host-level endpoint security."},{"id":"T1564.007","name":"VBA Stomping","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that enforce macro source code integrity checks, restrict VBA project access, and enable macro compilation validation detect adversaries using VBA stomping to replace macro source code while preserving malicious p-code."},{"id":"T1564.009","name":"Resource Forking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing file integrity monitoring that includes resource fork analysis, restricting alternate data stream creation, and monitoring for suspicious resource fork manipulation detect adversaries hiding payloads in macOS resource forks."},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing database integrity controls, implementing write-once storage for critical records, and restricting data modification privileges prevent adversaries from manipulating stored data to impact business operations or integrity."},{"id":"T1565.002","name":"Transmitted Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing transport layer encryption, implementing message authentication codes, and enabling network integrity monitoring prevent adversaries from modifying data in transit to corrupt communications or inject false information."},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing runtime application integrity verification, implementing memory protection mechanisms, and restricting process debugging capabilities prevent adversaries from manipulating data during processing to alter application behavior."},{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restrictive email configuration settings—blocking dangerous attachment types, enforcing attachment sandboxing, implementing DMARC/DKIM/SPF validation, and disabling macro execution—prevent delivery of malicious spearphishing attachments to end users."},{"id":"T1566.002","name":"Spearphishing Link","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing URL rewriting, link scanning at time of click, and blocking access to uncategorized or newly registered domains reduce the effectiveness of spearphishing links designed to deliver malware or harvest credentials."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings that restrict service installation privileges, enforce service binary path validation and signing requirements, and limit service control manager access prevent adversaries from executing malicious code through the Windows service control mechanism."},{"id":"T1573.001","name":"Symmetric Cryptography","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enabling TLS/SSL inspection at proxy boundaries and restricting approved symmetric cipher suites enable detection of adversary C2 channels using symmetric encryption to hide communication content from network monitoring."},{"id":"T1573.002","name":"Asymmetric Cryptography","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing certificate transparency validation, implementing TLS inspection, and restricting approved asymmetric algorithms enable detection of adversary C2 channels using asymmetric encryption that would otherwise evade content inspection."},{"id":"T1574.001","name":"DLL Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing SafeDllSearchMode, restricting DLL loading to known paths, and implementing KnownDLLs protections prevent adversaries from placing malicious DLLs in directories searched before legitimate library locations."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing dylib loading restrictions on macOS, implementing DYLD_INSERT_LIBRARIES controls, and requiring code signing for dynamic libraries prevent adversaries from hijacking dylib loading order for persistent code execution."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict file permissions on installer directories, restricting write access to installation paths, and implementing integrity monitoring on installer executables prevent adversaries from exploiting weak file permissions on installer binaries."},{"id":"T1574.006","name":"Dynamic Linker Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings restricting dynamic linker environment variables (LD_PRELOAD, DYLD_INSERT_LIBRARIES), enforcing secure library loading paths, and implementing mandatory access controls prevent adversaries from hijacking the dynamic linker to inject malicious shared libraries."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict PATH environment variable management, restricting PATH modification privileges, and implementing absolute path requirements for critical executables prevent adversaries from placing malicious executables in PATH directories."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing safe search order for executables, implementing application whitelisting by path and hash, and restricting write access to directories in the system search path prevent path interception through search order exploitation."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing proper quoting of all service binary paths, implementing automated detection of unquoted paths, and restricting directory creation in path segments prevent adversaries from exploiting unquoted service paths."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing restrictive ACLs on service executable files, implementing file integrity monitoring on service binaries, and restricting permission modification on service-related files prevent adversaries from replacing service executables."},{"id":"T1574.014","name":"AppDomainManager","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings restricting AppDomainManager registration in .NET configuration files, enforcing integrity checks on .NET assembly loading, and monitoring for suspicious configurations prevent adversaries from hijacking .NET application domain managers."},{"id":"T1590.002","name":"DNS","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings restricting DNS zone transfer permissions, implementing DNS response rate limiting, and enforcing DNSSEC prevent adversaries from gathering DNS intelligence about organizational network infrastructure during reconnaissance."},{"id":"T1598.002","name":"Spearphishing Attachment","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Restrictive email configuration settings—attachment sandboxing, DMARC enforcement, and sender reputation filtering—reduce the effectiveness of spearphishing attachments sent during reconnaissance to elicit information before a targeted attack."},{"id":"T1598.003","name":"Spearphishing Link","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing URL filtering, link reputation checking, and blocking clicks to newly registered domains reduce the effectiveness of spearphishing links sent during reconnaissance to harvest credentials or gather intelligence."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing strict NAT and routing policies, restricting network device management access, and implementing routing integrity validation prevent adversaries from modifying NAT configurations to traverse network boundaries."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing firmware image signature verification, restricting write access to device firmware, and maintaining hash-based integrity baselines prevent adversaries from patching network device system images to inject backdoors."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing minimum firmware version requirements, restricting firmware downgrade operations, and implementing version-aware boot validation prevent adversaries from downgrading system images to versions with known vulnerabilities."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings enforcing SNMPv3 with strong authentication and encryption, restricting SNMP community strings, and limiting MIB query access prevent adversaries from extracting sensitive device configuration data through SNMP MIB dumps."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Configuration settings restricting network management protocol access, enforcing encrypted configuration backup channels, and implementing access controls on device configuration repositories prevent adversaries from extracting network device configurations."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: nist_csf_2 DE.CM-09 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-012","SP-015","SP-017","SP-025","SP-028","SP-029","SP-032","SP-033","SP-035","SP-038","SP-039","SP-041","SP-050","SP-052"]}}