{"data":{"id":"RA-05","name":"Vulnerability Monitoring and Scanning","family":"RA","family_name":"Risk Assessment","withdrawn":false,"description":"a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;\nb. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:\n1. Enumerating platforms, software flaws, and improper configurations;\n2. Formatting checklists and test procedures; and\n3. Measuring vulnerability impact;\nc. Analyze vulnerability scan reports and results from vulnerability monitoring;\nd. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;\ne. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and\nf. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.","supplemental_guidance":"Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers.\n\nVulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).\n\nVulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation.\n\nOrganizations may also employ the use of financial incentives (also known as \"bug bounties\") to further encourage external security researchers to report discovered vulnerabilities. Bug bounty programs can be tailored to the organization’s needs. Bounties can be operated indefinitely or over a defined period of time and can be offered to the general public or to a curated group. Organizations may run public and private bounties simultaneously and could choose to offer partially credentialed access to certain participants in order to evaluate security vulnerabilities from privileged vantage points.","enhancements":[{"id":"RA-05(01)","name":"Update Tool Capability","withdrawn":true,"incorporated_into":["RA-05"]},{"id":"RA-05(02)","name":"Update Vulnerabilities to Be Scanned","statement":"Update the system vulnerabilities to be scanned [Selection (one or more): [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported].","baselines":["low","moderate","high"]},{"id":"RA-05(03)","name":"Breadth and Depth of Coverage","statement":"Define the breadth and depth of vulnerability scanning coverage.","baselines":[]},{"id":"RA-05(04)","name":"Discoverable Information","statement":"Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].","baselines":["high"]},{"id":"RA-05(05)","name":"Privileged Access","statement":"Implement privileged access authorization to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].","baselines":["moderate","high"]},{"id":"RA-05(06)","name":"Automated Trend Analyses","statement":"Compare the results of multiple vulnerability scans using [Assignment: organization-defined automated mechanisms].","baselines":[]},{"id":"RA-05(07)","name":"Automated Detection and Notification of Unauthorized Components","withdrawn":true,"incorporated_into":["CM-08"]},{"id":"RA-05(08)","name":"Review Historic Audit Logs","statement":"Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time period].","baselines":[]},{"id":"RA-05(09)","name":"Penetration Testing and Analyses","withdrawn":true,"incorporated_into":["CA-08"]},{"id":"RA-05(10)","name":"Correlate Scanning Information","statement":"Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.","baselines":[]},{"id":"RA-05(11)","name":"Public Disclosure Program","statement":"Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.","baselines":["low","moderate","high"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"RA-05","name":"Vulnerability Monitoring and Scanning","description":"a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;\nb. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:\n1. Enumerating platforms, software flaws, and improper configurations;\n2. Formatting checklists and test procedures; and\n3. Measuring vulnerability impact;\nc. Analyze vulnerability scan reports and results from vulnerability monitoring;\nd. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;\ne. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and\nf. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.","discussion":"Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers.\n\nVulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).\n\nVulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation.\n\nOrganizations may also employ the use of financial incentives (also known as \"bug bounties\") to further encourage external security researchers to report discovered vulnerabilities. Bug bounty programs can be tailored to the organization’s needs. Bounties can be operated indefinitely or over a defined period of time and can be offered to the general public or to a curated group. Organizations may run public and private bounties simultaneously and could choose to offer partially credentialed access to certain participants in order to evaluate security vulnerabilities from privileged vantage points.","related_controls":["CA-02","CA-07","CA-08","CM-02","CM-04","CM-06","CM-08","RA-02","RA-03","SA-11","SA-15","SC-38","SI-02","SI-03","SI-04","SI-07","SR-11"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Vulnerability Scanning' Control text adds requirement to employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned Discussion expanded to explain vulnerability monitoring Incorporates withdrawn control RA-05(1)"}},"compliance_mappings":{"iso_27001_2022":["8.2","A.5.7","A.8.8"],"iso_27002_2022":["5.7","8.8"],"cobit_2019":["APO12"],"pci_dss_v4":["6.3","11.3"],"nist_csf_2":["GV.SC-10","ID.IM-01","ID.IM-02","ID.IM-03","ID.RA-01","ID.RA-08"],"cis_controls_v8":["CIS 7","CIS 7.1","CIS 7.5","CIS 7.6","CIS 7.7","CIS 16.2","CIS 16.6","CIS 18","CIS 18.4"],"soc2_tsc":["CC7.1","CC9.2-POF13"],"finos_ccc":["CCC-C10"],"iso_42001_2023":["A.6.2.4"],"iec_62443":["2-1 4.3"],"asd_e8":["E8-2","E8-2 ML1","E8-2 ML2","E8-2 ML3","E8-6","E8-6 ML1"],"nis2":["Art. 21(2)(e)"],"apra_cps_234":["Para 19-20"],"mas_trm":["13"],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.31","Hygiene.33","SecNumCloud.13.6"],"osfi_b13":["B-13.2.4","B-13.3.1"],"finma_circular":["IV.B.c(54)","IV.B.c(56)","IV.B.c(57)","IV.D(75)","IV.D(76)"],"gdpr":["Art.32(1)(d)"],"dora":["Art.9(3)","Art.13(1)","Art.25(1)"],"bio2":["5.7","8.8"],"rbi_csf":["Annex1.7","Annex1.18","ITGRCA.26"],"fisc":["FISC.O12"],"lgpd_bcb":["BCB.Art.6","BCB.Art.10","BCB.Art.19"],"hkma_tme1":["TME1.7.4"],"mlps_2":["8.1.4.4","8.1.10.3"],"dnb_good_practice":["DNB.4.2","DNB.16.1","DNB.19.2","DNB.22.1"],"cra":["CRA.I.2a","CRA.II.1","CRA.II.2","CRA.II.3","CRA.Info.5"],"swift_cscf":["SWIFT.2.7","SWIFT.7.3A"],"cbb_tm":["TM-4","TM-11"],"cbuae":["CR-7","CR-10"],"nca_ecc":["1-5","2-10","2-11","5-1"],"qatar_nia":["OS","RM"],"sama_csf":["1.8","1.9","3.5"],"uae_ia":["T2","T7"],"bog_cisd":["CISD-VI","CISD-X"],"bom_ctrm":["2.1","4.1","4.3"],"cbe_csf":["CRM-1","CTO-9","OVM-3"],"cbn_csf":["Part2.3","Part3.3"],"popia":["s19"],"sa_js2":["JS2-6.2","JS2-7.2","JS2-7.7","JS2-8.5"],"bot_cyber":["Ch3.2"],"cpmi_pfmi":["CG.DE","CG.ID","CG.SA","CG.TE","PFMI.P17"],"eba_ict":["3.4.6"],"ecb_croe":["CROE.2.2.1","CROE.2.4","CROE.2.6.1","CROE.2.6.2","CROE.2.7.1"],"ffiec_is":["II.A","II.A.2","II.C.11","III.A","IV.A","IV.A.2"],"hipaa_sr":["§164.308(a)(1)(ii)(A)","§164.308(a)(8)"],"iosco_cyber":["DET-3","ID-3","SA-1","SA-3","TEST-1"],"nydfs_500":["500.5","500.9"],"sebi_cscrf":["DE.DP","DE.VA","ID.RA","VAPT"],"cmmc_2":["RA","SI"],"nerc_cip":["CIP-010-4","CIP-014-3"],"nrc_73_54":["RG5.71-B-CM","RG5.71-C-PL"],"tsa_psd":["SD-1 Sec 3","SD-2 Sec D","SD-2 Sec G"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["THREAT"],"api_1164":["Sec 4"],"awia":["Sec 2013(a)"],"iaea_nss":["Sec 4"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.12"],"cbest":["CBEST.2","CBEST.6"],"tiber_eu":["TIBER.GTL","TIBER.RT","TIBER.TTI"],"pci_hsm":[],"common_criteria":["CC Part 3 — SAR"],"isae_3402":[],"fca_sysc_13":["SYSC 13.5.3"],"fda_21_cfr_11":[],"fda_cyber":["524B-2","CRA-1","MON-1","MON-2","SBOM-3","ST-1","ST-2","ST-3","ST-4","TM-1"],"hitrust_csf":["03.a","06.c","09.c","10.e"],"iso_27799":["12.5","18.4","H.3"],"lloyds_ms":["CRM.2","MS8.11","MS10.2"],"naic_ds":["4-monitoring","4A"],"nhs_dspt":["NDG-8.1","NDG-8.2","NDG-9.8","NDG-9.9"],"pra_ss1_23":[],"solvency_ii":["DR.266"],"owasp_masvs_v2":["MASVS-CODE-3"],"csa_ccm_v4":["AIS-05","AIS-07","TVM-01","TVM-03","TVM-05","TVM-06","TVM-07","TVM-08","TVM-09","TVM-10"],"csa_aicm":["AIS-05","AIS-07","AIS-10","MDS-03","MDS-08","TVM-01","TVM-03","TVM-05","TVM-06","TVM-07","TVM-08","TVM-09","TVM-10","TVM-11","TVM-12","TVM-13"],"ccss_v9":["2.01.1","2.01.2"],"mica":["Art.35(1)"],"basel_sco60":["SCO60.4","SCO60.13","SCO60.14","SCO60.21","SCO60.23","SCO60.51","SCO60.52","SCO60.64","SCO60.65","SCO60.74"],"bssc":["GSP-02","GSP-08","GSP-15","NOS-10","TIS-02"],"sec_custody_digital":["SEC-CD-09"],"dpdpa":["Act.8(5)","Rules.Sch1.B.7"]},"attack_techniques":[{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies open ports and exposed services before adversaries discover them, enabling proactive closure of unnecessary network services that would otherwise facilitate reconnaissance."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Scanning for WMI misconfigurations and unnecessary WMI exposure identifies systems where this execution mechanism is improperly secured, enabling remediation before adversary exploitation."},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies systems with improperly configured USB and removable media controls, enabling remediation of device access policy gaps that could allow physical exfiltration."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for improperly configured scheduled task permissions and identifying unauthorized scheduled jobs enables detection of persistence mechanisms and misconfigured task scheduler access."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning detects improperly restricted scripting environments and command interpreters, identifying systems where script execution policies are not enforced for remediation."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Regular vulnerability scanning identifies unpatched systems with known privilege escalation vulnerabilities, enabling prioritized patching before adversaries can exploit these weaknesses to escalate privileges."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies default credentials, overly permissive accounts, and authentication misconfigurations that adversaries exploit to gain access using valid account credentials."},{"id":"T1091","name":"Replication Through Removable Media","tactics":["initial-access","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning for improperly configured removable media controls and autorun settings identifies systems vulnerable to replication through removable media for initial access and lateral movement."},{"id":"T1092","name":"Communication Through Removable Media","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Scanning endpoints for unauthorized removable media connectivity and USB policy compliance identifies systems where adversaries could establish covert C2 channels through removable devices."},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies unnecessary developer utilities present on production systems that adversaries could abuse for trusted binary proxy execution to evade application controls."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning for exposed remote access services identifies VPN, RDP, and SSH endpoints with weak configurations or missing patches that adversaries target for initial access."},{"id":"T1137","name":"Office Application Startup","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning for Office application vulnerabilities and misconfigured macro settings identifies systems where adversaries could leverage Office startup mechanisms for persistence."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies browsers with unrestricted extension installation policies, enabling enforcement of extension whitelisting before adversaries install malicious extensions."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of public-facing applications identifies exploitable weaknesses (SQLi, RCE, deserialization flaws) before adversaries discover and exploit them for initial access."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning software inventories against known vulnerability databases and verifying software integrity identifies compromised supply chain components before they can be exploited in the environment."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning internal systems for vulnerabilities in network-exposed services identifies exploitable weaknesses that adversaries target for lateral movement through remote service exploitation."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies security control weaknesses that adversaries could exploit to evade defenses, enabling proactive hardening of defensive mechanisms."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning authentication services for known credential access vulnerabilities identifies weaknesses adversaries exploit to harvest credentials through authentication protocol flaws."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of collaboration platforms identifies access control misconfigurations and unpatched vulnerabilities in information repositories that adversaries exploit for data collection."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for unnecessary system binaries and identifying their versions against known vulnerabilities enables removal or restriction of tools adversaries abuse for proxy execution."},{"id":"T1221","name":"Template Injection","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning document processing applications for template injection vulnerabilities and verifying that external content loading is restricted identifies systems vulnerable to remote template exploitation."},{"id":"T1482","name":"Domain Trust Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of Active Directory configurations identifies overly permissive trust relationships and delegation settings that adversaries enumerate for lateral movement planning."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning domain and tenant configurations for policy weaknesses identifies misconfigured settings that adversaries could modify to weaken security controls or escalate privileges."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of web servers and application servers identifies unpatched software and misconfigurations that adversaries exploit to deploy server software components for persistence."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning container images and registries for known vulnerabilities and malicious content identifies implanted images before they are deployed into production environments."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning application configurations for OAuth and API token vulnerabilities identifies overly permissive token scopes and insecure storage that adversaries exploit to steal access tokens."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of cloud storage configurations identifies misconfigured bucket policies, public access settings, and overly permissive IAM roles that expose cloud data to unauthorized access."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for improperly configured system service permissions identifies services with weak ACLs that adversaries can modify to create or alter system processes for persistence."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for elevation control misconfigurations (sudo vulnerabilities, UAC bypass vectors, setuid weaknesses) identifies systems where adversaries can abuse privilege escalation mechanisms."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies unsecured credential storage locations including cleartext passwords in configuration files, scripts, and registry entries that adversaries harvest for authentication."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning network configurations for protocols vulnerable to interception (unencrypted LDAP, LLMNR, NBT-NS) identifies systems susceptible to adversary-in-the-middle attacks."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Scanning application configurations for insecure IPC settings identifies systems where inter-process communication mechanisms could be exploited for code execution."},{"id":"T1560","name":"Archive Collected Data","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Scanning for unauthorized archival tools and monitoring compression utility presence identifies systems where adversaries could stage and compress collected data before exfiltration."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning verifies that security tools are properly configured and operational, identifying systems where defensive capabilities could be impaired by adversaries."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning for improperly secured remote session configurations identifies systems with weak session management that adversaries could exploit for remote service session hijacking."},{"id":"T1566","name":"Phishing","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of email gateway and web filtering configurations identifies weaknesses in anti-phishing controls that adversaries could exploit to deliver social engineering payloads."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for insecure file permissions, unquoted service paths, and misconfigured search paths identifies execution flow hijacking opportunities before adversaries can exploit them."},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning cloud compute configurations for IAM policy weaknesses and misconfigured instance settings identifies vulnerabilities adversaries exploit to modify cloud infrastructure for defense evasion."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning container build environments for unauthorized image build capabilities identifies hosts where adversaries could create malicious container images that evade security scanning pipelines."},{"id":"T1011.001","name":"Exfiltration Over Bluetooth","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Scanning for enabled Bluetooth interfaces on systems that should not have wireless connectivity identifies endpoints vulnerable to Bluetooth-based data exfiltration."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies systems with improperly configured RDP settings (missing NLA, weak encryption) that adversaries exploit for lateral movement via Remote Desktop."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning for insecure DCOM configurations and overly permissive launch permissions identifies systems vulnerable to remote code execution through Distributed COM objects."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies SSH servers with weak configurations (password authentication enabled, outdated key exchange algorithms) that adversaries target for lateral movement."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning for exposed VNC services and weak authentication configurations identifies systems vulnerable to unauthorized remote graphical access for lateral movement."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning for improperly configured WinRM listeners and weak authentication settings identifies systems where adversaries could exploit Windows Remote Management for lateral movement."},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies systems with improperly configured USB device control policies, enabling remediation of endpoints vulnerable to USB-based data exfiltration."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for systems with the at service enabled and improperly restricted identifies endpoints where adversaries could use the legacy at scheduler for persistence."},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for improperly restricted crontab files and overly permissive cron directories identifies Linux systems where adversaries could establish persistence through cron jobs."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning Task Scheduler configurations for overly permissive ACLs identifies Windows systems where non-privileged accounts could create scheduled tasks for persistence."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning identifies systems with unrestricted PowerShell execution policies and missing Constrained Language Mode, highlighting endpoints vulnerable to PowerShell-based attacks."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Scanning for systems with unrestricted VBScript execution capabilities identifies endpoints where Visual Basic scripting is not properly constrained for adversary exploitation."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Scanning for systems with unrestricted JScript and JavaScript execution outside browsers identifies endpoints vulnerable to standalone JavaScript-based payload execution."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning SSH configurations for weak authorized_keys permissions and identifying unauthorized public keys detects potential adversary persistence through SSH key injection."},{"id":"T1127.001","name":"MSBuild","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for MSBuild availability on non-development systems identifies endpoints where adversaries could abuse this trusted developer utility for proxy execution."},{"id":"T1127.002","name":"ClickOnce","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for ClickOnce deployment capability on systems that should not have it identifies endpoints vulnerable to malicious .NET application deployment abuse."},{"id":"T1137.001","name":"Office Template Macros","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning Office installations for insecure template macro settings and detecting unauthorized template files identifies systems vulnerable to Office template macro persistence."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning development environments for compromised dependencies by verifying package integrity against known hashes and monitoring dependency sources identifies supply chain compromises."},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning installed software against vendor signatures and known-good checksums identifies tampered application binaries introduced through software supply chain compromise."},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Scanning container registries for vulnerable or unauthorized images with known malware signatures identifies malicious images before operators deploy them into production."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Vulnerability scanning of Confluence instances identifies access control misconfigurations and unpatched vulnerabilities that adversaries exploit to access sensitive wiki content."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Scanning SharePoint deployments for permission misconfigurations and unpatched vulnerabilities identifies weaknesses adversaries exploit to access document repositories."},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Scanning code repository access configurations and identifying overly permissive permissions detects misconfigurations that adversaries exploit to access source code and secrets."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Scanning messaging platform configurations for overly permissive access settings identifies weaknesses adversaries exploit to mine communications for sensitive information."},{"id":"T1218.003","name":"CMSTP","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for CMSTP presence on systems that do not require it identifies endpoints where adversaries could abuse this binary for application control bypass."},{"id":"T1218.004","name":"InstallUtil","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for InstallUtil presence on non-development systems identifies endpoints where adversaries could leverage this .NET utility for proxy execution."},{"id":"T1218.005","name":"Mshta","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for mshta.exe presence and HTA file handling configurations identifies systems vulnerable to HTML Application-based code execution attacks."},{"id":"T1218.008","name":"Odbcconf","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for odbcconf.exe presence on systems that do not require ODBC management identifies endpoints vulnerable to proxy execution through response file abuse."},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for Regsvcs/Regasm presence on non-development systems identifies endpoints where adversaries could leverage COM registration utilities for proxy execution."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for verclsid.exe presence and COM object registration integrity identifies systems vulnerable to proxy execution through COM object verification abuse."},{"id":"T1218.013","name":"Mavinject","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for mavinject.exe presence on systems identifies endpoints where adversaries could use this Microsoft binary for DLL injection into running processes."},{"id":"T1218.014","name":"MMC","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning MMC snap-in configurations and identifying unauthorized or vulnerable snap-ins detects systems where adversaries could leverage MMC for proxy execution."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for Electron-based applications with known vulnerabilities identifies endpoints where adversaries could exploit embedded Node.js runtimes for code execution."},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning database servers for unauthorized stored procedures and identifying SQL injection vulnerabilities detects persistence mechanisms and exploitation vectors in database layers."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning Exchange servers for unauthorized Transport Agents identifies malicious email pipeline components that adversaries install for persistent mail interception."},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning web server directories for unauthorized scripts and identifying file upload vulnerabilities detects web shells that adversaries deploy for persistent command execution."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning IIS configurations for unauthorized modules and handlers identifies malicious IIS components that adversaries install for persistent web server backdoor access."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning Terminal Services configurations for unauthorized DLL registrations identifies malicious components that load with every RDP session for persistence."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning network device firmware against known-good images identifies ROMMONkit-style implants that persist in the recovery partition of compromised network equipment."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Scanning network device boot configurations for unauthorized TFTP server references identifies devices vulnerable to network-based boot image replacement attacks."},{"id":"T1546.002","name":"Screensaver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning screensaver configurations for unauthorized executable references identifies systems where adversaries have replaced screensaver binaries for event-triggered persistence."},{"id":"T1546.014","name":"Emond","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning macOS systems for unauthorized emond rules identifies persistence mechanisms that trigger malicious actions through the Event Monitor daemon."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for unauthorized kernel modules and verifying module signatures identifies malicious kernel-level persistence mechanisms operating with ring-0 privileges."},{"id":"T1547.007","name":"Re-opened Applications","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning macOS saved application state directories for unauthorized entries identifies applications that adversaries have configured for automatic re-opening upon login."},{"id":"T1547.008","name":"LSASS Driver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning for unauthorized LSASS driver registrations identifies malicious drivers that load within the Local Security Authority process for credential interception."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning UAC configuration settings and identifying known UAC bypass vectors enables proactive remediation of privilege escalation paths that adversaries exploit."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning sudoers configurations for overly permissive rules and identifying sudo cache vulnerabilities detects privilege escalation opportunities adversaries exploit on Linux systems."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning macOS TCC database entries for unauthorized permission grants identifies systems where adversaries have manipulated privacy controls for unauthorized access."},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning file systems for credentials stored in plaintext files (configuration files, scripts, documents) identifies credential exposure that adversaries harvest during post-compromise operations."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning Windows registry for stored credentials and identifying applications that insecurely cache credentials in registry keys detects credential exposure adversaries exploit."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning file systems for private key files with overly permissive access controls identifies exposed cryptographic material adversaries harvest for authentication bypass."},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning for cached Group Policy Preferences XML files containing encrypted passwords identifies legacy credential exposure that adversaries easily decrypt with published AES keys."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Scanning Active Directory for accounts without Kerberos pre-authentication requirement identifies accounts vulnerable to AS-REP roasting offline credential attacks."},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Scanning Office configurations for DDE auto-execution settings and identifying systems where DDE links are not blocked detects susceptibility to Dynamic Data Exchange attacks."},{"id":"T1560.001","name":"Archive via Utility","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Scanning for unauthorized archival utilities and monitoring compression tool installations identifies systems where adversaries could stage data using archive utilities before exfiltration."},{"id":"T1562.010","name":"Downgrade Attack","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for protocol version configurations and identifying systems supporting deprecated security protocols detects vulnerability to downgrade attacks that weaken protection."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning SSH configurations for agent forwarding settings and ControlMaster configurations identifies systems vulnerable to SSH session hijacking for lateral movement."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Scanning RDP configurations for weak session security settings and unlimited disconnected session times identifies systems vulnerable to RDP session hijacking."},{"id":"T1574.001","name":"DLL Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning application directories for DLL planting opportunities and identifying missing SafeDllSearchMode configurations detects systems vulnerable to DLL search order hijacking."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning macOS application bundles for writable framework directories identifies Dylib hijacking opportunities where adversaries can inject malicious dynamic libraries."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning installer directories for weak file permissions identifies executables that adversaries could replace to achieve code execution during software installation."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning PATH environment variables for writable directories identifies interception opportunities where adversaries can place malicious executables in the search path."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning application search paths for writable directories and missing full path specifications identifies execution flow hijacking opportunities in application configurations."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning Windows services for unquoted binary paths identifies services where adversaries can exploit path interpretation to execute malicious binaries in parent directories."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Scanning service binary file permissions identifies executables with weak ACLs that adversaries could replace to achieve persistent code execution with service privileges."},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning cloud environments for unauthorized snapshot creation and identifying overly permissive snapshot permissions detects potential data extraction through cloud disk snapshots."},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning cloud environments for unauthorized instance creation and monitoring IAM policies for compute permissions identifies infrastructure that adversaries could manipulate."},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Scanning for cloud instance deletion permissions and monitoring termination protection settings identifies systems vulnerable to evidence destruction through instance deletion."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: nist_csf_2 GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"detective","used_by_patterns":["SP-001","SP-002","SP-006","SP-007","SP-008","SP-012","SP-016","SP-019","SP-021","SP-023","SP-025","SP-026","SP-028","SP-029","SP-030","SP-031","SP-035","SP-036","SP-037","SP-038","SP-042","SP-043","SP-046","SP-047","SP-048","SP-050","SP-053","SP-054"]}}