{"data":{"id":"CM-07","name":"Least Functionality","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and\nb. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].","supplemental_guidance":"Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see SA-08, SC-02, and SC-03).","enhancements":[{"id":"CM-07(01)","name":"Periodic Review","statement":"a. Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and\nb. Disable or remove [Assignment: organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure].","baselines":["moderate","high"]},{"id":"CM-07(02)","name":"Prevent Program Execution","statement":"Prevent program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].","baselines":["moderate","high"]},{"id":"CM-07(03)","name":"Registration Compliance","statement":"Ensure compliance with [Assignment: organization-defined registration requirements for functions, ports, protocols, and services].","baselines":[]},{"id":"CM-07(04)","name":"Unauthorized Software — Deny-by-exception","statement":"a. Identify [Assignment: organization-defined software programs not authorized to execute on the system];\nb. Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and\nc. Review and update the list of unauthorized software programs [Assignment: organization-defined frequency].","baselines":[]},{"id":"CM-07(05)","name":"Authorized Software — Allow-by-exception","statement":"a. Identify [Assignment: organization-defined software programs authorized to execute on the system];\nb. Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and\nc. Review and update the list of authorized software programs [Assignment: organization-defined frequency].","baselines":["moderate","high"]},{"id":"CM-07(06)","name":"Confined Environments with Limited Privileges","statement":"Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: organization-defined user-installed software].","baselines":[]},{"id":"CM-07(07)","name":"Code Execution in Protected Environments","statement":"Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] when such code is:\na. Obtained from sources with limited or no warranty; and/or\nb. Without the provision of source code.","baselines":[]},{"id":"CM-07(08)","name":"Binary or Machine Executable Code","statement":"a. Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and\nb. Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.","baselines":[]},{"id":"CM-07(09)","name":"Prohibiting The Use of Unauthorized Hardware","statement":"a. Identify [Assignment: organization-defined hardware components authorized for system use];\nb. Prohibit the use or connection of unauthorized hardware components;\nc. Review and update the list of authorized hardware components [Assignment: organization-defined frequency].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-07","name":"Least Functionality","description":"a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and\nb. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].","discussion":"Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see SA-08, SC-02, and SC-03).","related_controls":["AC-03","AC-04","CM-02","CM-05","CM-06","CM-11","RA-05","SA-04","SA-05","SA-08","SA-09","SA-15","SC-02","SC-03","SC-07","SC-37","SI-04"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Adds parameter text for 'mission' essential capabilities Discussion expanded slightly"}},"compliance_mappings":{"iso_27001_2022":["A.8.1","A.8.9","A.8.18","A.8.19"],"iso_27002_2022":["5.37","8.1","8.9","8.18","8.19"],"cobit_2019":["BAI10"],"pci_dss_v4":["1.2.5","2.2","2.2.5"],"nist_csf_2":["PR.PS-01","PR.PS-02","PR.PS-05"],"cis_controls_v8":["CIS 2","CIS 2.3","CIS 2.5","CIS 2.6","CIS 2.7","CIS 4","CIS 4.8","CIS 9.1","CIS 9.4","CIS 10.3","CIS 12"],"soc2_tsc":["CC6.1-POF7","CC6.7-POF1"],"finos_ccc":["CCC-C14"],"iso_42001_2023":["A.9.4"],"iec_62443":["3-3 SR 7.6","3-3 SR 7.7"],"asd_e8":["E8-1","E8-1 ML1","E8-1 ML2","E8-1 ML3","E8-3","E8-3 ML1","E8-3 ML2","E8-3 ML3","E8-4","E8-4 ML1","E8-4 ML2","E8-4 ML3"],"nis2":["Art. 21(2)(g)"],"apra_cps_234":[],"mas_trm":["11"],"pra_op_resilience":[],"bsi_grundschutz":["APP.1.1","NET.1.2","NET.3.1","SYS.1.1","SYS.2.1"],"anssi":["Hygiene.18","Hygiene.20","SecNumCloud.13.1"],"osfi_b13":["B-13.2.2","B-13.3.2"],"finma_circular":["IV.A(28)","IV.C(64)","IV.C(65)"],"gdpr":["Art.25(1)","Art.25(2)","Art.32(1)(b)"],"dora":["Art.7(1)","Art.9(1)"],"bio2":["5.37","8.1","8.9","8.18","8.19"],"rbi_csf":["Annex1.2","Annex1.5"],"fisc":["FISC.T7","FISC.T14"],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":["8.1.4.4","8.1.10.4"],"dnb_good_practice":["DNB.3.2","DNB.13.2","DNB.20.1"],"cra":["CRA.I.2b","CRA.I.2j","CRA.Info.8e"],"swift_cscf":["SWIFT.1.1","SWIFT.1.4","SWIFT.2.2","SWIFT.2.3","SWIFT.2.10"],"cbuae":["CR-7"],"nca_ecc":["2-3","2-6","2-14","5-1"],"qatar_nia":["OS"],"sama_csf":["3.3","3.5"],"uae_ia":["T7"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.2","3.12"],"cbe_csf":["CTO-6","CTO-7"],"cbn_csf":["Part3.3"],"popia":["s19"],"sa_js2":["JS2-7.2","JS2-8.4"],"bot_cyber":["Ch2.1","Ch2.6"],"cpmi_pfmi":["CG.PR"],"eba_ict":["3.4.4"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.10","II.C.11","II.C.13(e)","II.C.15(a)"],"sebi_cscrf":["PR.ES","PR.IP"],"cmmc_2":["CM"],"nerc_cip":["CIP-005-7","CIP-007-6"],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":[],"ieee_1686":["5.6","5.9"],"ferc_cip":["Order 887"],"doe_c2m2":["ASSET"],"api_1164":["Sec 7"],"awia":[],"iaea_nss":["Sec 5.4"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.6"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.1"],"fda_21_cfr_11":["§11.10(f)"],"fda_cyber":[],"hitrust_csf":["09.a"],"iso_27799":["6.3"],"lloyds_ms":["MS8.4","MS8.10"],"naic_ds":["4-config","4B"],"nhs_dspt":["NDG-4.4"],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.8"],"owasp_masvs_v2":["MASVS-PLATFORM-1","MASVS-PLATFORM-2"],"csa_ccm_v4":["UEM-02","UEM-10"],"csa_aicm":["UEM-02","UEM-10"],"ccss_v9":["1.02.1","1.05.4"],"mica":["Art.62(5)","Art.68(1)"],"basel_sco60":["SCO60.51","SCO60.64","SCO60.65"],"bssc":["NOS-03","TIS-03"],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting system functionality by removing or disabling unnecessary tools such as credential dumping utilities and limiting access to debugging interfaces directly reduces adversaries' ability to extract credential material from operating system memory and stores."},{"id":"T1008","name":"Fallback Channels","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Prohibiting unnecessary network protocols and restricting outbound port access eliminates the alternate communication pathways adversaries rely on as fallback channels when primary command-and-control infrastructure is disrupted."},{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Disabling unused network interfaces such as Wi-Fi, Bluetooth, and cellular radios on endpoints that do not require them prevents adversaries from exfiltrating data over alternative network media that bypass primary network monitoring."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting remote service protocols (RDP, SSH, SMB, WinRM) on systems where they are not operationally required eliminates lateral movement pathways that adversaries exploit to traverse the network after initial compromise."},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the availability of scripting engines, decompression utilities, and encoding tools on endpoints limits adversaries' ability to deobfuscate or decode files and payloads needed to execute their malicious operations."},{"id":"T1036","name":"Masquerading","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Limiting installed software to only essential applications and enforcing application whitelisting reduces the pool of legitimate binaries adversaries can impersonate or masquerade as to blend malicious executables into the environment."},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting the use of logon and startup script mechanisms that are not operationally necessary prevents adversaries from establishing persistence by inserting malicious code into boot or logon initialization scripts."},{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"mapping_type":"mitigates","mapping_rationale":"Removing or disabling packet capture tools and promiscuous-mode network interfaces on systems that do not require network analysis capabilities prevents adversaries from sniffing network traffic for credentials and sensitive data."},{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Minimizing exposed network services by disabling unnecessary ports and protocols directly reduces the attack surface discoverable through network service scanning, limiting the information adversaries can gather during reconnaissance."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting Windows Management Instrumentation on systems where it is not required for administration prevents adversaries from using WMI as an execution mechanism for running commands or scripts remotely."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound protocols to only those operationally necessary and blocking unauthorized ports prevents adversaries from using alternative protocols such as DNS, FTP, or ICMP tunnels to exfiltrate data outside normal C2 channels."},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting physical media interfaces (USB, optical drives) on endpoints that do not require removable media access prevents adversaries from exfiltrating collected data via physical devices."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to task scheduling mechanisms (Windows Task Scheduler, cron, at) to only authorized administrators prevents adversaries from creating scheduled tasks or jobs for persistent execution or privilege escalation."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Disabling or constraining scripting engines and command interpreters (PowerShell, WScript, bash, Python) through execution policies or application control rules directly prevents adversaries from executing malicious scripts on managed endpoints."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Reducing installed software and services to essential functionality minimizes the number of exploitable vulnerabilities present on the system, shrinking the attack surface available for privilege escalation exploits."},{"id":"T1071","name":"Application Layer Protocol","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting allowed outbound application-layer protocols to only those operationally required constrains adversaries' ability to establish command-and-control channels disguised within legitimate HTTP, DNS, or SMTP traffic."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Limiting access to software deployment tools such as SCCM, Ansible, or Puppet to only authorized administrative systems prevents adversaries from hijacking these high-privilege tools to distribute malicious payloads across the enterprise."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary accounts, removing default accounts, and restricting service accounts to minimum required privileges reduces the pool of valid credentials adversaries can compromise for initial access or persistence."},{"id":"T1080","name":"Taint Shared Content","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to shared network drives and limiting write permissions to only authorized users reduces opportunities for adversaries to taint shared content with malicious payloads that execute when accessed by other users."},{"id":"T1087","name":"Account Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary directory services, LDAP browsing, and user enumeration interfaces limits adversaries' ability to discover and enumerate accounts during post-compromise reconnaissance."},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking unnecessary proxy protocols and restricting outbound connectivity to approved gateways prevents adversaries from establishing internal or external proxy chains to relay C2 communications through the environment."},{"id":"T1092","name":"Communication Through Removable Media","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Disabling removable media interfaces on systems that do not require them prevents adversaries from using removable media as a covert channel for command-and-control communication with air-gapped networks."},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting allowed network protocols to only application-layer traffic necessary for operations and blocking raw socket access prevents adversaries from using non-application layer protocols for covert C2 channels."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting account management capabilities to essential administrative functions and restricting self-service account modification prevents adversaries from manipulating existing accounts to maintain persistent access or escalate privileges."},{"id":"T1102","name":"Web Service","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking or restricting access to external web services (cloud storage, social media, paste sites) not operationally required prevents adversaries from using legitimate web services as dead drops or C2 relay points."},{"id":"T1104","name":"Multi-Stage Channels","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound connectivity to only approved destinations and protocols disrupts multi-stage C2 channels that rely on connecting to different infrastructure components at various stages of the attack lifecycle."},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Limiting allowed file transfer protocols and blocking direct internet access from internal systems prevents adversaries from downloading additional tools, malware, or payloads from external infrastructure after initial compromise."},{"id":"T1106","name":"Native API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to Windows API functions through application control policies and removing unnecessary development tools prevents adversaries from directly invoking native OS APIs to execute malicious operations."},{"id":"T1112","name":"Modify Registry","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting registry editing tools and limiting write access to sensitive registry keys prevents adversaries from modifying the Windows registry to disable security controls, establish persistence, or store configuration data."},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting access to developer utilities such as MSBuild and dnx on production systems prevents adversaries from abusing these trusted tools to proxy execution of malicious code while bypassing application controls."},{"id":"T1129","name":"Shared Modules","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting the loading of shared modules and DLLs through application control policies prevents adversaries from executing malicious code by loading it as a shared library within the context of legitimate processes."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Disabling external remote access services (VPN, RDP gateways, Citrix) that are not operationally required reduces the entry points adversaries can exploit for initial access or maintaining persistent remote connections."},{"id":"T1135","name":"Network Share Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary file sharing protocols and limiting network share visibility reduces the information adversaries can gather when enumerating network shares for lateral movement or data collection targets."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting account creation privileges to only authorized administrators and disabling self-registration capabilities prevents adversaries from creating new accounts to establish persistent backdoor access."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Enforcing browser extension policies that restrict installation to organization-approved extensions prevents adversaries from installing malicious browser extensions that capture credentials or maintain persistence."},{"id":"T1187","name":"Forced Authentication","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Disabling protocols that respond to forced authentication requests (LLMNR, NBT-NS, WebDAV) prevents adversaries from coercing systems into revealing NTLM hashes through forced authentication techniques."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Minimizing the number of public-facing applications and services to only those essential for operations reduces the attack surface available for exploitation, limiting adversaries' initial access opportunities."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting software installation to approved sources and maintaining an allowlist of authorized applications limits the impact of supply chain compromises by preventing execution of tampered software components."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Disabling the Background Intelligent Transfer Service on systems where it is not required prevents adversaries from abusing BITS jobs for stealthy file transfers and persistent task execution."},{"id":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting network connectivity and access permissions for third-party partner connections to only the minimum required services limits the blast radius of compromised trusted relationships."},{"id":"T1204","name":"User Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Limiting available applications and restricting execution of file types commonly used in social engineering reduces the effectiveness of adversary campaigns relying on user execution of malicious content."},{"id":"T1205","name":"Traffic Signaling","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary network services and restricting firewall rules to only required traffic patterns prevents adversaries from using traffic signaling techniques like port knocking to activate dormant backdoors."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Reducing the number of exposed network services and patching those that remain minimizes the exploitable attack surface adversaries target for lateral movement through remote service exploitation."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to information repositories by removing unnecessary collaboration platforms and limiting repository permissions prevents adversaries from harvesting sensitive data from wikis, SharePoint, or other knowledge bases."},{"id":"T1216","name":"System Script Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting access to signed system scripts (PubPrn, SyncAppvPublishingServer) on endpoints prevents adversaries from abusing these trusted scripts to proxy execution of malicious code."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting unnecessary signed system binaries (mshta, certutil, regsvr32) prevents adversaries from using these trusted Microsoft tools to proxy execution of malicious payloads while evading application controls."},{"id":"T1219","name":"Remote Access Software","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking unauthorized remote access software (TeamViewer, AnyDesk, LogMeIn) and restricting installation to approved remote administration tools prevents adversaries from establishing persistent remote access channels."},{"id":"T1220","name":"XSL Script Processing","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting access to the MSXML library and XSL script processing on systems where they are not needed prevents adversaries from using XSL files to execute arbitrary code while bypassing security controls."},{"id":"T1221","name":"Template Injection","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting Office macro execution and blocking external template loading prevents adversaries from leveraging template injection to retrieve and execute malicious content from remote servers when documents are opened."},{"id":"T1482","name":"Domain Trust Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary Active Directory enumeration tools and restricting LDAP query access limits adversaries' ability to map domain trust relationships during post-compromise reconnaissance for lateral movement planning."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to domain policy and tenant configuration management tools to only essential administrators prevents adversaries from modifying domain or cloud tenant policies to weaken security controls or escalate privileges."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to stop or modify system services to only authorized administrators prevents adversaries from halting critical services such as security monitoring, backup, or recovery processes."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to system recovery tools (vssadmin, wbadmin, bcdedit) prevents adversaries from inhibiting system recovery by deleting shadow copies or disabling recovery boot options."},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary network services and protocols that could amplify or relay traffic reduces the system's potential to be leveraged in network denial of service attacks or impacted by volumetric flooding."},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting exposed services and endpoints to only essential functionality reduces the attack surface for application and service-level denial of service attacks that exhaust system resources."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting container image repositories to only approved registries and enforcing image signing policies prevents adversaries from implanting backdoored container images that execute malicious code when deployed."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary cloud storage services and restricting access to approved cloud platforms limits adversaries' ability to access and exfiltrate data from cloud storage buckets or blob containers."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound cloud service connectivity and limiting cross-account data transfer permissions prevents adversaries from transferring exfiltrated data to adversary-controlled cloud accounts."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create or modify system processes and services to only authorized administrators prevents adversaries from establishing persistence through new system-level daemons or services."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling or constraining elevation control mechanisms (sudo access, UAC bypass vectors, setuid binaries) to the minimum required reduces adversaries' ability to abuse these mechanisms for privilege escalation."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Removing unnecessary credential storage locations, disabling plaintext credential caching, and restricting access to sensitive configuration files limits the unsecured credential sources adversaries can harvest."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict code signing policies and restricting certificate store modifications prevents adversaries from subverting trust controls by installing unauthorized root certificates or modifying signing requirements."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to authentication infrastructure components (password filters, PAM modules, ADFS) prevents adversaries from modifying authentication processes to capture credentials or bypass security controls."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Disabling legacy protocols vulnerable to interception (LLMNR, NBT-NS, unencrypted LDAP) and enforcing encrypted communications reduces adversaries' ability to position themselves as adversary-in-the-middle."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary inter-process communication mechanisms (COM, DDE, XPC) on systems that do not require them prevents adversaries from abusing these channels to execute code within trusted process contexts."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify security tool configurations and preventing unauthorized changes to defensive components ensures adversaries cannot easily disable or impair endpoint protection or logging."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting remote session services on systems where they are not required prevents adversaries from hijacking existing authenticated sessions for lateral movement across the network."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to critical data stores and application databases to only essential service accounts limits adversaries' ability to manipulate stored or transmitted data for destructive purposes."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create and execute system services to only authorized administrators prevents adversaries from using service execution mechanisms to run malicious code with elevated privileges."},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary file sharing protocols and restricting internal network service access prevents adversaries from transferring attack utilities between compromised hosts via SMB, SCP, or similar tools."},{"id":"T1571","name":"Non-Standard Port","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound network connectivity to only standard approved ports forces adversary C2 traffic through monitored channels and prevents the use of non-standard ports to evade firewall rules."},{"id":"T1572","name":"Protocol Tunneling","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking tunneling protocols and restricting protocol encapsulation prevents adversaries from wrapping C2 traffic within allowed protocols to bypass network filtering controls."},{"id":"T1573","name":"Encrypted Channel","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound encrypted connections to only approved TLS endpoints and enforcing TLS inspection where appropriate limits adversaries from hiding C2 within encrypted channels that evade content inspection."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Removing unnecessary executables from writable directories, correcting insecure file permissions, and quoting service paths eliminates the path interception and DLL hijacking opportunities adversaries exploit to redirect execution flow."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device functionality to only essential routing and switching features and disabling unnecessary bridging capabilities prevents adversaries from reconfiguring devices to bridge network security boundaries."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware update capabilities to only authorized administrative processes and removing unnecessary management protocols prevents adversaries from modifying network device system images to implant persistent backdoors."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary management protocols such as SNMP and restricting access to device configuration interfaces prevents adversaries from extracting sensitive configuration data including credentials and network topology."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting container administration interfaces (kubectl, Docker CLI) to only authorized orchestration nodes and disabling direct container exec access prevents adversaries from executing commands within containers."},{"id":"T1610","name":"Deploy Container","tactics":["defense-evasion","execution"],"mapping_type":"mitigates","mapping_rationale":"Enforcing admission controllers and restricting container deployment to only approved images from trusted registries prevents adversaries from deploying malicious containers to execute code or evade host-based controls."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Constraining container runtime capabilities, enforcing seccomp profiles, and disabling privileged container mode limits adversaries' ability to escape container boundaries and gain access to the underlying host."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to build container images on production hosts and enforcing image policies through admission controllers prevents adversaries from building malicious images to evade security scanning."},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary container API endpoints and restricting orchestration dashboard access prevents adversaries from enumerating container infrastructure to map services, pods, and deployment configurations."},{"id":"T1622","name":"Debugger Evasion","tactics":["defense-evasion","discovery"],"mapping_type":"mitigates","mapping_rationale":"Removing debugging tools from production systems and restricting debug API access prevents adversaries from detecting or evading debugger-based analysis and security monitoring mechanisms."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to plist files and enforcing configuration profiles on macOS endpoints prevents adversaries from modifying property list files to disable security features or establish persistence."},{"id":"T1648","name":"Serverless Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create and modify serverless functions to only authorized DevOps pipelines prevents adversaries from executing arbitrary code through serverless compute platforms like Lambda or Azure Functions."},{"id":"T1653","name":"Power Settings","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to power management settings and enforcing organizational policies for sleep and hibernate behavior prevents adversaries from modifying power configurations to maintain persistent system uptime."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting tools capable of reading LSASS process memory and enabling Credential Guard directly prevents adversaries from extracting plaintext passwords and NTLM hashes from the LSASS process address space."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to SAM registry hive backup utilities and disabling unnecessary registry backup tools prevents adversaries from extracting local account password hashes from the Security Account Manager database."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Reducing the number of cached domain credentials stored locally via Group Policy and restricting access to credential cache files limits the material available for adversaries to extract and crack cached logon credentials."},{"id":"T1011.001","name":"Exfiltration Over Bluetooth","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Disabling Bluetooth radios and interfaces on systems that do not require wireless peripheral connectivity prevents adversaries from exfiltrating data over Bluetooth connections that bypass wired network monitoring."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Disabling port mirroring capabilities and restricting SPAN/TAP configuration access on network infrastructure prevents adversaries from configuring traffic duplication to silently copy and exfiltrate network communications."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling Remote Desktop Protocol on systems where remote graphical access is not operationally required eliminates a primary lateral movement vector adversaries use to move between Windows hosts with stolen credentials."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling SMB and administrative shares (C$, ADMIN$, IPC$) on systems that do not require file sharing eliminates a common lateral movement pathway used for remote code execution and credential harvesting."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting DCOM activation permissions and disabling unnecessary COM objects prevents adversaries from using Distributed COM to remotely instantiate objects and execute code on target systems across the network."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling VNC services on systems that do not require remote graphical access prevents adversaries from using VNC for lateral movement and persistent remote control of compromised endpoints."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling Windows Remote Management on systems where remote PowerShell access is not required prevents adversaries from using WS-Management protocol for remote command execution and lateral movement."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting direct cloud VM connectivity by disabling serial console access and limiting SSH/RDP to bastion hosts prevents adversaries from establishing direct connections to cloud VMs bypassing network controls."},{"id":"T1036.005","name":"Match Legitimate Name or Location","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing application whitelisting with path-based rules and hash verification prevents adversaries from placing malicious executables with legitimate names in expected file system locations to evade detection."},{"id":"T1036.007","name":"Double File Extension","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing file type verification beyond extensions and restricting execution of files with double extensions prevents adversaries from disguising malicious executables with misleading filename patterns."},{"id":"T1036.008","name":"Masquerade File Type","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting executable file types and enforcing MIME-type validation prevents adversaries from masquerading malicious files as benign document types by manipulating file headers or extensions."},{"id":"T1037.001","name":"Logon Script (Windows)","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting or disabling Windows logon script execution through Group Policy and limiting script directory write access prevents adversaries from planting malicious scripts that execute automatically during user logon."},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Blocking outbound encrypted protocols not operationally required prevents adversaries from exfiltrating data over symmetric encrypted channels outside normal C2 infrastructure."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound connectivity to only approved protocols and destinations prevents adversaries from using asymmetric encryption over non-C2 protocols to exfiltrate data while evading content inspection."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Blocking unencrypted outbound protocols not operationally necessary prevents adversaries from using cleartext protocols like FTP, HTTP, or DNS over non-standard ports to exfiltrate data."},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Disabling USB mass storage device access through device control policies prevents adversaries from copying collected data to USB drives for physical exfiltration outside the network perimeter."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the at command scheduler and disabling the at service on systems that do not require it prevents adversaries from using this legacy scheduling mechanism for persistence."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Task Scheduler permissions and disabling the ability for non-administrators to create scheduled tasks prevents adversaries from establishing persistent execution through Windows Scheduled Task creation."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Disabling or restricting Visual Basic Script execution through Windows Script Host settings and application control policies prevents adversaries from executing VBScript-based payloads for initial execution."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting JavaScript execution outside browser contexts by disabling Windows Script Host and JScript processing prevents adversaries from executing malicious JavaScript files as standalone scripts."},{"id":"T1059.009","name":"Cloud API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to cloud management CLIs and APIs to only authorized automation accounts limits adversaries' ability to execute cloud API commands for resource manipulation after credential compromise."},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Blocking or removing AutoHotKey and AutoIT scripting environments from systems that do not require them prevents adversaries from using these macro-capable interpreters to execute malicious automation scripts."},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound HTTP/HTTPS to only approved web proxies and blocking direct internet access prevents adversaries from establishing C2 channels over web protocols that blend with normal browsing traffic."},{"id":"T1071.002","name":"File Transfer Protocols","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Disabling FTP, FTPS, and SFTP client capabilities on systems that do not require file transfer functionality prevents adversaries from using file transfer protocols as covert C2 communication channels."},{"id":"T1071.003","name":"Mail Protocols","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound SMTP/IMAP/POP3 to only authorized mail servers prevents adversaries from establishing C2 channels disguised as email traffic or using mail protocols for data exfiltration."},{"id":"T1071.004","name":"DNS","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Enforcing DNS queries through approved resolvers and blocking direct outbound DNS prevents adversaries from using DNS queries and responses as a covert channel for C2 communication and data exfiltration."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary cloud service accounts, enforcing conditional access policies, and restricting cloud IAM roles to minimum required permissions reduces the cloud credential pool available for adversary exploitation."},{"id":"T1087.001","name":"Local Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to local user enumeration commands and tools limits adversaries' ability to discover local accounts that could be targeted for credential attacks or privilege escalation."},{"id":"T1087.002","name":"Domain Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting LDAP query permissions and disabling anonymous directory browsing limits adversaries' ability to enumerate domain accounts for targeted credential attacks or lateral movement."},{"id":"T1090.001","name":"Internal Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting internal proxy software and blocking unauthorized port forwarding prevents adversaries from establishing internal proxy nodes to relay C2 traffic through compromised systems deeper in the network."},{"id":"T1090.002","name":"External Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking outbound connections to unauthorized external proxy services and restricting proxy authentication prevents adversaries from routing C2 traffic through external proxy infrastructure to obscure its origin."},{"id":"T1090.003","name":"Multi-hop Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound connectivity and blocking Tor, I2P, and similar anonymization network traffic prevents adversaries from using multi-hop proxy chains to obfuscate C2 communication paths."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to add credentials (API keys, certificates, OAuth tokens) to cloud accounts to only authorized administrators prevents adversaries from implanting additional authentication material for persistent access."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to SSH authorized_keys files and enforcing centralized key management prevents adversaries from adding unauthorized SSH public keys to maintain persistent backdoor access to Linux systems."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify group memberships to authorized identity administrators prevents adversaries from adding compromised accounts to privileged groups for persistence and privilege escalation."},{"id":"T1102.001","name":"Dead Drop Resolver","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking access to web services commonly used as dead drop resolvers (Pastebin, GitHub Gists, social media) prevents adversaries from using these platforms to host C2 instructions that malware retrieves dynamically."},{"id":"T1102.002","name":"Bidirectional Communication","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound access to cloud platforms and web services not required for operations prevents adversaries from establishing bidirectional C2 communication through legitimate web services."},{"id":"T1102.003","name":"One-Way Communication","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Blocking outbound access to unnecessary web platforms and content hosting services prevents adversaries from using one-way communication channels through legitimate services to send commands to implants."},{"id":"T1127.002","name":"ClickOnce","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting ClickOnce deployment capability on systems that do not require it prevents adversaries from abusing this trusted .NET deployment mechanism to download and execute malicious assemblies."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain account creation to authorized identity management systems and preventing direct AD manipulation prevents adversaries from creating rogue domain accounts for persistent network access."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud IAM account creation to authorized identity governance pipelines prevents adversaries from provisioning new cloud accounts as persistent backdoors within the cloud environment."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting development tool installation and enforcing package integrity verification prevents adversaries from compromising software dependencies to inject malicious code during the build process."},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing software allowlists and verifying vendor signatures before installation limits the impact of software supply chain compromises by preventing execution of tampered application binaries."},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting browser capabilities, blocking access to known malicious URL categories, and limiting executable downloads reduces the effectiveness of social engineering attacks relying on users clicking malicious links."},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Enforcing application control policies that prevent execution of untrusted file types and restricting macro execution limits the impact of social engineering attacks that trick users into opening malicious files."},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting container image sources to approved registries and enforcing image signature verification prevents adversaries from tricking operators into deploying malicious container images."},{"id":"T1205.001","name":"Port Knocking","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary listening services and enforcing strict firewall rules prevents adversaries from implementing port knocking sequences that trigger hidden services to open covert access channels."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting Confluence deployments to only authorized instances and limiting access to need-to-know users prevents adversaries from mining Confluence wikis for sensitive organizational information."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Limiting SharePoint site provisioning and restricting document library access to authorized users prevents adversaries from accessing SharePoint repositories to harvest sensitive documents and data."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting CRM platform access to only authorized sales and support personnel and disabling unnecessary API integrations prevents adversaries from extracting customer data from CRM systems."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting messaging application deployments to approved platforms and limiting API access prevents adversaries from mining Slack, Teams, or other messaging applications for sensitive communications."},{"id":"T1216.001","name":"PubPrn","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting the PubPrn.vbs script on systems that do not require print publishing prevents adversaries from abusing this signed Microsoft script to download and execute remote scriptlets."},{"id":"T1216.002","name":"SyncAppvPublishingServer","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting SyncAppvPublishingServer on systems not using App-V prevents adversaries from abusing this signed utility to execute arbitrary PowerShell commands while bypassing constrained language mode."},{"id":"T1218.001","name":"Compiled HTML File","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting the HTML Help executable (hh.exe) and CHM file associations prevents adversaries from using compiled HTML files to execute malicious code through the trusted help system binary."},{"id":"T1218.002","name":"Control Panel","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting Control Panel item (.cpl) execution and limiting access to control panel applets prevents adversaries from using malicious CPL files to execute code through the trusted control panel mechanism."},{"id":"T1218.003","name":"CMSTP","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting CMSTP.exe on systems that do not require Connection Manager profile installation prevents adversaries from using this trusted binary to bypass application control and execute malicious code."},{"id":"T1218.004","name":"InstallUtil","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting InstallUtil.exe on non-development systems prevents adversaries from abusing this .NET installation utility to execute arbitrary code through custom installer components."},{"id":"T1218.005","name":"Mshta","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting mshta.exe on systems that do not require HTML Application execution prevents adversaries from using this trusted binary to execute malicious VBScript or JavaScript."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting msiexec.exe execution to only authorized software installation workflows prevents adversaries from abusing the Windows Installer service to execute malicious MSI packages or DLLs."},{"id":"T1218.008","name":"Odbcconf","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting odbcconf.exe on systems that do not require ODBC configuration prevents adversaries from using this trusted utility to register and execute malicious response files."},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing .NET framework registration utilities (regsvcs.exe, regasm.exe) from systems that do not require COM component registration prevents adversaries from using these signed binaries to execute unmanaged code."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting verclsid.exe on systems that do not require COM object verification prevents adversaries from using this trusted binary to execute malicious COM objects while bypassing security controls."},{"id":"T1218.013","name":"Mavinject","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Removing or restricting mavinject.exe on systems that do not require it prevents adversaries from using this signed Microsoft binary to inject malicious DLLs into running processes."},{"id":"T1218.014","name":"MMC","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting MMC snap-in execution and limiting access to management console files prevents adversaries from using MMC to load malicious snap-ins that execute code within the trusted MMC process."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting or removing unnecessary Electron-based applications reduces the attack surface adversaries can exploit to execute malicious JavaScript through the Node.js runtime embedded in these applications."},{"id":"T1498.001","name":"Direct Network Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary network-facing services and implementing ingress rate limiting reduces the system's exposure to direct network flood attacks that overwhelm bandwidth or processing capacity."},{"id":"T1498.002","name":"Reflection Amplification","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Disabling unnecessary UDP-based services (DNS, NTP, SSDP) that can be abused as amplification vectors prevents the system from being weaponized in reflection amplification DDoS attacks."},{"id":"T1499.001","name":"OS Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting the number of exposed TCP/UDP services reduces the available targets for OS exhaustion flood attacks that overwhelm the operating system's connection handling or memory allocation."},{"id":"T1499.002","name":"Service Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting publicly exposed services to only essential applications limits the endpoints adversaries can target with service exhaustion floods that consume server resources through legitimate-appearing requests."},{"id":"T1499.003","name":"Application Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Minimizing application complexity and removing unnecessary application features reduces the attack surface for application exhaustion floods that exploit resource-intensive operations."},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Reducing the number of running services and applications limits exploitable vulnerabilities that adversaries can leverage for application or system exploitation-based denial of service."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting IIS module and handler installation to only approved components and enforcing module signing prevents adversaries from installing malicious IIS components for persistent web server backdoor access."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to network device ROMMON interfaces and disabling unnecessary boot recovery modes prevents adversaries from installing persistent ROMMONkit implants that survive firmware updates."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Disabling TFTP boot capabilities on network devices that do not require network-based provisioning prevents adversaries from redirecting the boot process to load compromised firmware images."},{"id":"T1546.002","name":"Screensaver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling the screensaver on server systems and restricting screensaver executable selection on workstations prevents adversaries from replacing the screensaver binary with malicious executables for persistence."},{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting modifications to Mach-O binary headers and enforcing code signing on macOS prevents adversaries from adding LC_LOAD_DYLIB commands that force applications to load malicious dynamic libraries."},{"id":"T1546.008","name":"Accessibility Features","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting replacement of accessibility feature binaries (sethc.exe, utilman.exe, narrator.exe) through file integrity protection prevents adversaries from using these as persistence mechanisms at the login screen."},{"id":"T1546.009","name":"AppCert DLLs","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting AppCert DLL registration by protecting the AppCertDLLs registry key prevents adversaries from registering malicious DLLs that load into every process calling CreateProcess."},{"id":"T1546.010","name":"AppInit DLLs","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling AppInit DLLs through the registry (LoadAppInit_DLLs = 0) or enforcing Secure Boot prevents adversaries from registering DLLs that automatically load into every user-mode process."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification of Winlogon registry keys (Shell, Userinit, Notify) prevents adversaries from registering malicious helper DLLs that load with SYSTEM privileges during Windows logon."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting kernel module loading to signed modules only and limiting insmod/modprobe access prevents adversaries from loading malicious kernel modules or extensions that operate with ring-0 privileges."},{"id":"T1547.007","name":"Re-opened Applications","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disabling the macOS re-opened applications feature and restricting the saved application state directory prevents adversaries from abusing the application resume mechanism for persistence across reboots."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to shortcut files in startup folders and common desktop locations prevents adversaries from modifying shortcuts to point to malicious executables for persistence."},{"id":"T1548.001","name":"Setuid and Setgid","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Auditing and removing unnecessary setuid/setgid binaries and restricting the ability to set these permission bits prevents adversaries from exploiting elevated file permissions for privilege escalation on Unix systems."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting sudoers configuration, enforcing timestamp_timeout=0, and limiting sudo-eligible commands prevents adversaries from abusing cached sudo credentials or overly permissive sudo rules for privilege escalation."},{"id":"T1548.004","name":"Elevated Execution with Prompt","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting which applications can trigger macOS or Linux elevation prompts and enforcing authorization plugin policies limits adversaries' ability to abuse elevation dialogs for privilege escalation."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting modifications to the TCC database and enforcing SIP (System Integrity Protection) on macOS prevents adversaries from manipulating Transparency, Consent, and Control permissions to gain unauthorized access."},{"id":"T1552.003","name":"Bash History","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Configuring shells to not save command history (HISTSIZE=0) or restricting access to history files prevents adversaries from mining bash history for previously entered credentials and sensitive parameters."},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to cloud instance metadata endpoints (169.254.169.254) through firewall rules or IMDSv2 enforcement prevents adversaries from harvesting temporary credentials from cloud instance metadata APIs."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to container runtime APIs and Kubernetes secrets through RBAC policies prevents adversaries from querying container APIs to extract credentials mounted in pods or stored in orchestrator secrets."},{"id":"T1553.001","name":"Gatekeeper Bypass","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing Gatekeeper policies on macOS and preventing users from overriding code signing checks limits adversaries' ability to bypass macOS trust controls to execute unsigned or maliciously signed applications."},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Protecting SIP (Subject Interface Package) and trust provider DLL registrations through registry access controls prevents adversaries from hijacking Windows code signing verification to trust malicious binaries."},{"id":"T1553.004","name":"Install Root Certificate","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting certificate store write access to only authorized PKI administrators prevents adversaries from installing rogue root certificates that enable trust of adversary-signed code or MITM SSL interception."},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing Mark-of-the-Web (MOTW) propagation and preventing its removal through Group Policy prevents adversaries from stripping zone identifiers to bypass SmartScreen and other download security warnings."},{"id":"T1553.006","name":"Code Signing Policy Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification of code signing policies and enforcing WDAC/AppLocker configuration through tamper-proof Group Policy prevents adversaries from weakening code signing requirements to execute unsigned code."},{"id":"T1555.004","name":"Windows Credential Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to the Windows Credential Manager vault and limiting the use of stored credentials reduces adversaries' ability to extract saved web and network credentials from the Windows credential store."},{"id":"T1555.006","name":"Cloud Secrets Management Stores","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict IAM policies for cloud secrets management services (AWS Secrets Manager, Azure Key Vault) and restricting API access prevents adversaries from extracting secrets from cloud vault stores."},{"id":"T1556.002","name":"Password Filter DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to register password filter DLLs by protecting the LSA registry key prevents adversaries from installing malicious password filters that capture plaintext passwords during password changes."},{"id":"T1556.008","name":"Network Provider DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to register network provider DLLs by protecting the relevant registry keys prevents adversaries from installing malicious network providers that intercept authentication credentials."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification of conditional access policies to only authorized identity administrators and enforcing change approval workflows prevents adversaries from weakening authentication requirements for persistent access."},{"id":"T1557.001","name":"LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Disabling LLMNR and NBT-NS protocols across the enterprise and enforcing SMB signing prevents adversaries from poisoning name resolution responses to relay NTLM authentication to other services."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Implementing Dynamic ARP Inspection and port security on network switches prevents adversaries from poisoning ARP caches to redirect traffic through attacker-controlled systems for credential interception."},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Disabling rogue DHCP detection features and enabling DHCP snooping on switches prevents adversaries from deploying spoofed DHCP servers to redirect client traffic through adversary-controlled gateways."},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Disabling Dynamic Data Exchange in Office applications through registry settings and Group Policy prevents adversaries from using DDE fields in documents to execute commands without macros."},{"id":"T1559.003","name":"XPC Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting XPC service entitlements and enforcing sandboxing on macOS applications limits adversaries' ability to abuse cross-process communication through XPC services for code execution."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing tamper protection on security tools and restricting the ability to disable antivirus or EDR agents prevents adversaries from impairing defensive capabilities before executing their primary attack."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify Windows Event Log service configurations and protecting audit policy settings prevents adversaries from disabling event logging to hide their activities."},{"id":"T1562.003","name":"Impair Command History Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing command history logging and restricting the ability to modify shell history configuration prevents adversaries from impairing command history logging to conceal post-compromise activities."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify host and network firewall rules to only authorized administrators prevents adversaries from disabling or modifying firewall configurations to enable unauthorized traffic flows."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Protecting ETW provider registrations and restricting the ability to modify logging pipelines prevents adversaries from blocking security telemetry indicators from reaching SIEM and monitoring systems."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting boot configuration modifications and enforcing Secure Boot prevents adversaries from forcing Safe Mode boot that disables third-party security tools and endpoint protection agents."},{"id":"T1562.010","name":"Downgrade Attack","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify protocol version settings and enforcing minimum security standards prevents adversaries from downgrading protocol versions to exploit weaknesses in older implementations."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disabling SSH agent forwarding and restricting ControlMaster multiplexing on systems where they are not needed prevents adversaries from hijacking existing SSH sessions to move laterally."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting RDP session shadow capabilities and limiting disconnected session lifetimes prevents adversaries from hijacking disconnected or active RDP sessions for lateral movement."},{"id":"T1564.002","name":"Hidden Users","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to hide user accounts through registry manipulation (HKLM UserList) or user attribute modification prevents adversaries from creating concealed accounts for persistent access."},{"id":"T1564.003","name":"Hidden Window","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting applications from launching hidden windows and enforcing visible window requirements prevents adversaries from executing malicious processes in hidden windows to avoid user detection."},{"id":"T1564.006","name":"Run Virtual Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting virtualization software installation and limiting hypervisor access prevents adversaries from running malicious payloads within virtual machine instances that evade host-based security tools."},{"id":"T1564.008","name":"Email Hiding Rules","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create email rules programmatically and monitoring mailbox rule creation prevents adversaries from configuring email hiding rules that conceal indicators of compromise."},{"id":"T1564.009","name":"Resource Forking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the creation and modification of macOS resource forks and extended attributes limits adversaries' ability to hide malicious payloads within alternative data streams of legitimate files."},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting the services and processes running on systems to essential functions reduces the attack surface for runtime data manipulation by restricting the applications adversaries can target for in-memory data modification."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create and start Windows services to only authorized administrators and enforcing service binary signing prevents adversaries from executing code through the Service Control Manager."},{"id":"T1573.001","name":"Symmetric Cryptography","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Restricting outbound encrypted traffic to approved destinations and enforcing TLS inspection at network boundaries limits adversaries' ability to use symmetric encryption to conceal C2 traffic content."},{"id":"T1573.002","name":"Asymmetric Cryptography","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Enforcing certificate pinning and restricting outbound connections using unapproved certificates prevents adversaries from establishing asymmetric encrypted C2 channels with self-signed or rogue certificates."},{"id":"T1574.001","name":"DLL Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Removing DLLs from untrusted directories in the search path and enabling SafeDllSearchMode prevents adversaries from placing malicious DLLs where they will be loaded before legitimate ones through search order hijacking."},{"id":"T1574.006","name":"Dynamic Linker Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting environment variable modification (LD_PRELOAD, DYLD_INSERT_LIBRARIES) and enforcing library load restrictions prevents adversaries from using dynamic linker hijacking to inject malicious shared libraries."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Auditing and securing PATH environment variable entries and removing writable directories from the system PATH prevents adversaries from placing malicious executables in PATH locations that take precedence over legitimate ones."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Configuring applications with fully qualified paths for dependent binaries and removing unnecessary search path entries prevents adversaries from exploiting executable search order to execute malicious replacements."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Quoting all service binary paths in the Windows registry and fixing unquoted paths prevents adversaries from exploiting path interpretation ambiguity to execute malicious binaries in parent directories."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to set COR_PROFILER environment variables and monitoring .NET profiler registrations prevents adversaries from using the CLR profiling API to load malicious DLLs into .NET processes."},{"id":"T1574.014","name":"AppDomainManager","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting AppDomainManager configuration in .NET application config files and enforcing strong-name assembly verification prevents adversaries from hijacking .NET application domain initialization to load malicious assemblies."},{"id":"T1590.002","name":"DNS","tactics":["reconnaissance"],"mapping_type":"mitigates","mapping_rationale":"Minimizing publicly exposed DNS records and restricting zone transfer access limits the DNS reconnaissance information adversaries can gather about organizational infrastructure and services."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting NAT configuration capabilities on network devices to only authorized administrators and disabling unnecessary NAT traversal features prevents adversaries from manipulating address translation to bypass network segmentation."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware update interfaces to authenticated administrative access and enforcing firmware image integrity verification prevents adversaries from patching network device system images with malicious modifications."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing minimum firmware version requirements and restricting downgrade capabilities on network devices prevents adversaries from installing older, vulnerable firmware versions that contain exploitable weaknesses."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Disabling SNMP or restricting it to SNMPv3 with strong authentication prevents adversaries from performing MIB walks to extract device configuration data, credentials, and network topology information."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to device configuration management interfaces and disabling unencrypted management protocols prevents adversaries from dumping network device configurations containing credentials and routing details."}],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-008","SP-016","SP-023","SP-028","SP-030","SP-037","SP-038","SP-041","SP-047","SP-050","SP-051","SP-053"]}}