Threat intelligence / filtered
Course Of Action
11300 objects matching the active filter. Open an object to inspect its relationships and provenance.
Evidence stream
Filtered — Course Of Action
01Limit AI Workload Resource ConsumptionLimit the resources that an AI request, inference job, or agent workflow can consume. Set bounds on input size, batch size, execution time, memory, compute, and output size. Generative AI services should also limit context and output tokens…MitigationAML.M003602AI Red TeamEstablish an AI red team responsible for conducting recurring, authorized, and threat-informed red-teaming exercises to identify and remediate vulnerabilities in AI-enabled systems before deployment and throughout operation. AI red-teaming …MitigationAML.M003503Deepfake DetectionApply deepfake detection algorithms against any untrusted or user-provided data, especially in impactful applications such as biometric verification, to block generated content. Detectors may use a combination of approaches, including: - AI…MitigationAML.M003404Input and Output Validation for AI Agent ComponentsImplement validation on inputs and outputs for the tools and data sources used by AI agents. Validation includes enforcing a common data format, schema validation, checks for sensitive or prohibited information leakage, and data sanitizatio…MitigationAML.M003305Segmentation of AI Agent ComponentsDefine security boundaries around agentic tools and data sources with methods such as API access, container isolation, code execution sandboxing, and rate limiting of tool invocation. When sandboxing, limit resource and network access and b…MitigationAML.M003206Memory HardeningMemory Hardening protects persistent state used by AI agents, including saved preferences, episodic or semantic memories, conversation summaries, stored chat history, and agent-managed experience stores. Unlike guardrails that evaluate cont…MitigationAML.M003107Restrict AI Agent Tool Invocation on Untrusted DataUntrusted data can contain prompt injections that invoke an AI agent's tools, potentially causing confidentiality, integrity or availability violations. It is recommended that tool invocation be restricted or limited when untrusted data ent…MitigationAML.M003008Human In-the-Loop for AI Agent ActionsSystems should require the user or another human stakeholder to approve AI agent actions before the agent takes them. The human approver may be technical staff or business unit SMEs depending on the use case. Separate tools, such as dedicat…MitigationAML.M002909AI Agent Tools Permissions ConfigurationWhen deploying tools that will be shared across multiple AI agents, it is important to implement robust policies and controls on permissions for the tools. These controls include applying the principle of least privilege along with delegate…MitigationAML.M002810Single-User AI Agent Permissions ConfigurationWhen deploying an AI agent that acts as a representative of a user and performs actions on their behalf, it is important to implement robust policies and controls on permissions and lifecycle management of the agent. Lifecycle management in…MitigationAML.M002711Privileged AI Agent Permissions ConfigurationAI agents may be granted elevated privileges above that of a normal user to enable desired workflows. When deploying a privileged AI agent, or an agent that interacts with multiple users, it is important to implement robust policies and con…MitigationAML.M002612Maintain AI Dataset ProvenanceMaintain a detailed history of datasets used for AI applications. The history should include information about the dataset's source as well as a complete record of any modifications.MitigationAML.M002513AI Telemetry LoggingImplement logging of inputs and outputs of deployed AI models. When deploying AI agents, implement logging of the intermediate steps of agentic actions and decisions, data access and tool use, installation commands, and identity of the agen…MitigationAML.M002414AI Bill of MaterialsAn AI Bill of Materials (AI BOM) contains a full listing of artifacts and resources that were used in building the AI. The AI BOM can help mitigate supply chain risks and enable rapid response to reported vulnerabilities. This can include m…MitigationAML.M002315Generative AI Model AlignmentGenerative AI Model Alignment is the process of training or fine-tuning a generative model to guide its output toward a set of human values, goals, or ethical principles. Desired principles can be in alignment with safety, security, content…MitigationAML.M002216Generative AI GuidelinesGuidelines are instructions, policies, and behavioral constraints provided to a generative AI model to direct it toward desired outputs and away from unsafe, unreliable, or policy-violating behavior. Guidelines can help reduce risks related…MitigationAML.M002117Generative AI GuardrailsGuardrails are safety controls placed between users, tools, and generative AI models to evaluate prompts, retrieved context, model outputs, and agent actions before they are accepted, executed, or shown to a user. They can help block, modif…MitigationAML.M002018Control Access to AI Models and Data in ProductionRequire users to verify their identities before accessing a production model. Require authentication for API endpoints and monitor production model queries to ensure compliance with usage policies and to prevent model misuse.MitigationAML.M001919User TrainingEducate AI model developers to on AI supply chain risks and potentially malicious AI artifacts. Educate users on how to identify deepfakes and phishing attempts.MitigationAML.M001820AI Model Distribution MethodsDeploying AI models to edge devices can increase the attack surface of the system. Consider serving models in the cloud to reduce the level of access the adversary has to the model. Also consider computing features in the cloud to prevent g…MitigationAML.M001721Vulnerability ScanningVulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. File formats such as pickle files that are commonly used to store AI models can contain exploits that allow for arbitrary code execut…MitigationAML.M001622Predictive AI Adversarial Input DetectionDetect and block digital or physical adversarial examples submitted to predictive AI models. Adversarial examples are inputs modified or constructed to cause misclassification, missed detection, excessive computation, or another attacker-se…MitigationAML.M001523Verify AI ArtifactsVerify the cryptographic checksum of all AI artifacts to verify that the file was not modified by an attacker.MitigationAML.M001424Code SigningEnforce binary and application integrity with digital signature verification to prevent untrusted code from executing. Adversaries can embed malicious code in AI software or models. Developers should also cryptographically sign SBOM and AIB…MitigationAML.M001325Encrypt Sensitive InformationEncrypt sensitive data such as AI models to protect against adversaries attempting to access sensitive data.MitigationAML.M001226Restrict Library LoadingPrevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software. File formats such as pickle files…MitigationAML.M001127Predictive AI Input RestorationPreprocess predictive AI inference inputs to remove, reduce, or disrupt adversarial perturbations before the inputs are evaluated by the model. Restoration methods may include denoising, compression, reconstruction, resampling, feature sque…MitigationAML.M001028Predictive AI Multi-Sensor FusionUse independent physical sensors (ideally across multiple modalities or from several perspectives) to avoid relying on a single sensor that may be manipulated, obstructed, or disrupted by an adversary. Relevant sensors may include visible-l…MitigationAML.M000929Validate AI ModelValidate that AI models perform as intended by testing for backdoor triggers, potential for data leakage, or adversarial influence. Monitor AI model for concept drift and training data drift, which may indicate data tampering and poisoning.MitigationAML.M000830Sanitize Training DataDetect and remove or remediate poisoned training data. Training data should be sanitized prior to model training and recurrently for an active learning model. Implement a filter to limit ingested training data. Establish a content policy th…MitigationAML.M000731Predictive AI EnsemblesUse an ensemble of diverse predictive AI models to reduce reliance on a single model or model family and improve robustness against adversarial examples. Ensemble members should be sufficiently diverse, such as through different architectur…MitigationAML.M000632Control Access to AI Models and Data at RestEstablish access controls on internal model registries and limit internal access to production models. Limit access to training data only to approved users.MitigationAML.M000533Limit AI Service Query Volume and RateLimit the number and rate of requests that users can submit to an AI service. Apply limits by user, API key, tenant, device, or other authenticated identity. Use short-term rate, burst, and concurrency limits together with longer-term usage…MitigationAML.M000434Predictive AI Model HardeningDesign and train predictive AI models to maintain intended performance when presented with adversarial examples. Adversarial examples may include digitally perturbed inputs or physical countermeasures intended to cause misclassification, mi…MitigationAML.M000335Predictive AI Output ObfuscationReduce the fidelity and amount of information returned by predictive AI inference endpoints to make model discovery, extraction, replication, and black-box adversarial-example optimization more difficult. Limit outputs to those required by …MitigationAML.M000236Limit Model Artifact ReleaseLimit public release of technical project details including data, algorithms, model architectures, and model checkpoints that are used in production, or that are representative of those used in production.MitigationAML.M000137Limit Public Release of InformationLimit the public release of technical information about the AI stack used in an organization's products or services. Technical knowledge of how AI is used can be leveraged by adversaries to perform targeting and tailor attacks to the target…MitigationAML.M000038Component Object Model Hijacking MitigationDirect mitigation of this technique may not be recommended for a particular environment since COM objects are a legitimate part of the operating system and installed software. Blocking COM object changes may have unforeseen side effects to …MitigationT112239Encrypt Sensitive InformationProtect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can b…MitigationM104140Modify Existing Service MitigationUse auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them. Limit privileges of user accounts and groups so that only authorized administrators can interact with servic…MitigationT103141Data Encoding MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within proto…MitigationT113242Hidden Window MitigationWhitelist programs that are allowed to have this plist tag. All other programs should be considered suspicious.MitigationT114343Account Use PoliciesAccount Use Policies help mitigate unauthorized access by configuring and enforcing rules that govern how and when accounts can be used. These policies include enforcing account lockout mechanisms, restricting login times, and setting inact…MitigationM103644Redundant Access MitigationIdentify and block potentially malicious software that may be used as a remote access tool, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA M…MitigationT110845Port Knocking MitigationMitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.MitigationT120546Process Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Wi…MitigationT105747Custom Command and Control Protocol MitigationProperly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces. Network intrusion detec…MitigationT109448Exploitation for Client Execution MitigationBrowser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. (Citation: Windows Blogs Microsoft Edge Sandbox) (Citation: Ars Technica Pwn2Own 2017 VM Escape) Other types of virtualizatio…MitigationT120349Scheduled Task MitigationLimit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to…MitigationT105350Private Keys MitigationUse strong passphrases for private keys to make cracking difficult. When possible, store keys on separate cryptographic hardware instead of on the local system. Ensure only authorized keys are allowed access to critical resources and audit …MitigationT114551Taint Shared Content MitigationProtect shared folders by minimizing users who have write access. Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET). Reduce potential lateral move…MitigationT108052Replication Through Removable Media MitigationDisable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control) Id…MitigationT109153SIP and Trust Provider Hijacking MitigationEnsure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components. Also ensure that these values contain their full path to prevent [DLL Search Order Hijacking](https://at…MitigationT119854Modify Registry MitigationMisconfiguration of permissions in the Registry may lead to opportunities for an adversary to execute code, like through [Service Registry Permissions Weakness](https://attack.mitre.org/techniques/T1058). Ensure proper permissions are set f…MitigationT111255Indicator Blocking MitigationEnsure event tracers/forwarders (Citation: Microsoft ETW May 2018), firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls. Consider automatically relaunching forwarding mechanisms at…MitigationT105456InstallUtil MitigationInstallUtil may not be necessary within a given environment. Use application whitelisting configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.MitigationT111857Disable or Remove Feature or ProgramDisable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could b…MitigationM104258Stored Data Manipulation MitigationIdentify critical business and system processes that may be targeted by adversaries and work to secure the data related to those processes against tampering. Ensure least privilege principles are applied to important information resources t…MitigationT149259Two-Factor Authentication Interception MitigationRemove smart cards when not in use. Protect devices and services used to transmit and receive out-of-band codes. Identify and block potentially malicious software that may be used to intercept 2FA credentials on a system by using whitelisti…MitigationT111160Restrict Library LoadingRestricting library loading involves implementing security controls to ensure that only trusted and verified libraries (DLLs, shared objects, etc.) are loaded into processes. Adversaries often abuse Dynamic-Link Library (DLL) Injection, DLL…MitigationM104461Update SoftwareSoftware updates ensure systems are protected against known vulnerabilities by applying patches and upgrades provided by vendors. Regular updates reduce the attack surface and prevent adversaries from exploiting known security gaps. This in…MitigationM105162Exfiltration Over Physical Medium MitigationDisable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)MitigationT105263Active Directory ConfigurationImplement robust Active Directory (AD) configurations using group policies to secure user accounts, control access, and minimize the attack surface. AD configurations enable centralized control over account settings, logon policies, and per…MitigationM101564Launchctl MitigationPrevent users from installing their own launch agents or launch daemons and instead require them to be pushed out by group policy.MitigationT115265Path Interception MitigationEliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them (Citation: Microsoft …MitigationT103466Permission Groups Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about groups and permissions, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, …MitigationT106967Dylib Hijacking MitigationPrevent users from being able to write files to the search paths for applications, both in the folders where applications are run from and the standard dylib folders. If users can't write to these directories, then they can't intercept the …MitigationT115768Sudo Caching MitigationSetting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed. Similarly, ensuring that the tty_tickets setting is enabled will prevent this leakage across tty sessions.MitigationT120669Multiband Communication MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within proto…MitigationT102670Video Capture MitigationMitigating this technique specifically may be difficult as it requires fine-grained API control. Efforts should be focused on preventing unwanted or unknown code from executing on a system. Identify and block potentially malicious software …MitigationT112571Data from Network Shared Drive MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to collect data from a network share, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Wind…MitigationT103972System Service Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about services, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Win…MitigationT100773Change Default File Association MitigationDirect mitigation of this technique is not recommended since it is a legitimate function that can be performed by users for software preferences. Follow Microsoft's best practices for file associations. (Citation: MSDN File Associations) Id…MitigationT104274Service Execution MitigationEnsure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level. Also ensure that high permission level service binaries cannot be replaced or mo…MitigationT103575External Remote Services MitigationLimit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems. Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Disable…MitigationT113376Valid Accounts MitigationTake measures to detect or prevent techniques such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or installation of keyloggers to acquire credentials through [Input Capture](https://attack.mitre.org/techniques/T1056)…MitigationT107877Mshta MitigationMshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life. Use application whitelisting configured to block execution of mshta.exe if it is…MitigationT117078Exploit ProtectionDeploy capabilities that detect, block, and mitigate conditions indicative of software exploits. These capabilities aim to prevent exploitation by addressing vulnerabilities, monitoring anomalous behaviors, and applying exploit-mitigation t…MitigationM105079Network Service Scanning MitigationUse network intrusion detection/prevention systems to detect and prevent remote service scans. Ensure that unnecessary ports and services are closed and proper network segmentation is followed to protect critical servers and devices. Identi…MitigationT104680Data Obfuscation MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within proto…MitigationT100181PowerShell MitigationIt may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions. When PowerShe…MitigationT108682Deobfuscate/Decode Files or Information MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to deobfuscate or decode files or information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citat…MitigationT114083Execution through Module Load MitigationDirectly mitigating module loads and API calls related to module loads will likely have unintended side effects, such as preventing legitimate software from operating properly. Efforts should be focused on preventing adversary tools from ru…MitigationT112984Application Shimming MitigationThere currently aren't a lot of ways to mitigate application shimming. Disabling the Shim Engine isn't recommended because Windows depends on shimming for interoperability and software may become unstable or not work. Microsoft released an …MitigationT113885Remote File Copy MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the netwo…MitigationT110586AuditAuditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the envi…MitigationM104787Extra Window Memory Injection MitigationThis type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific API calls will likely have unintended side effects, such …MitigationT118188BITS Jobs MitigationThis type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, disabling all BITS functionality will likely have unintended side effects, su…MitigationT119789Software Packing MitigationEnsure updated virus definitions. Create custom signatures for observed malware. Employ heuristic-based malware detection. Identify and prevent execution of potentially malicious software that may have been packed by using whitelisting (Cit…MitigationT104590Application Deployment Software MitigationGrant access to application deployment systems only to a limited number of authorized administrators. Ensure proper system and access isolation for critical network systems through use of firewalls, account privilege separation, group polic…MitigationT101791Spearphishing via Service MitigationDetermine if certain social media sites, personal webmail services, or other service that can be used for spearphishing is necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a …MitigationT119492Template Injection MitigationConsider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents (Citation: Microsoft Disable Macros), though this setting may not mitigate the [Forced Authentication](https://attack.mitr…MitigationT122193System Information Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about the operating system and underlying hardware, and audit and/or block them by using whitelisting (Citation: Beechey 2010) t…MitigationT108294Access Token Manipulation MitigationAccess tokens are an integral part of the security system within Windows and cannot be turned off. However, an attacker must already have administrator level access on the local system to make full use of this technique; be sure to restrict…MitigationT113495Environmental Keying MitigationThis technique likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chai…MitigationT148096Local Job Scheduling MitigationLimit privileges of user accounts and remediate Privilege Escalation vectors so only authorized users can create scheduled jobs. Identify and block unnecessary system utilities or potentially malicious software that may be used to schedule …MitigationT116897Rc.common MitigationLimit privileges of user accounts so only authorized users can edit the rc.common file.MitigationT116398System Network Connections Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about network connections, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Ci…MitigationT104999Accessibility Features MitigationTo use this technique remotely, an adversary must use it in conjunction with RDP. Ensure that Network Level Authentication is enabled to force the remote desktop session to authenticate before the session is created and the login screen dis…MitigationT1015100Bypass User Account Control MitigationRemove users from the local administrator group on systems. Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques su…MitigationT1088101Security Software Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about local security software, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker,…MitigationT1063102Pass the Hash MitigationMonitor systems and domain logs for unusual credential logon activity. Prevent access to [Valid Accounts](https://attack.mitre.org/techniques/T1078). Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accou…MitigationT1075103Web Shell MitigationEnsure that externally facing Web servers are patched regularly to prevent adversary access through [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) to gain remote code access or through file inclusion weak…MitigationT1100104Inhibit System Recovery MitigationConsider technical controls to prevent the disabling of services or deletion of files involved in system recovery. Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to …MitigationT1490105Data Transfer Size Limits MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are o…MitigationT1030106Application Isolation and SandboxingApplication Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code…MitigationM1048107SID-History Injection MitigationClean up SID-History attributes after legitimate account migration is complete. Consider applying SID Filtering to interforest trusts, such as forest trusts and external trusts, to exclude SID-History from requests to access domain resource…MitigationT1178108Communication Through Removable Media MitigationDisable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)MitigationT1092109New Service MitigationLimit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new services. Identify and block unnecessary system utilities or potentially malicious software that may be used to cr…MitigationT1050110DCShadow MitigationThis type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of AD design features. For example, mitigating specific AD API calls will likely have unintended side effects, such as preventi…MitigationT1207111Software ConfigurationSoftware configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practic…MitigationM1054112Browser Extensions MitigationOnly install browser extensions from trusted sources that can be verified. Ensure extensions that are installed are the intended ones as many malicious extensions will masquerade as legitimate ones. Browser extensions for some browsers can …MitigationT1176113Multi-factor AuthenticationMulti-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - *Something you know*: Passwords, PINs. -…MitigationM1032114Remote Access Tools MitigationProperly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access tools. Network intrusion detection and prevention systems that use network signatures may be able to prev…MitigationT1219115Credential Dumping Mitigation### Windows Monitor/harden access to LSASS and SAM table with tools that allow process whitelisting. Limit credential overlap across systems to prevent lateral movement opportunities using [Valid Accounts](https://attack.mitre.org/technique…MitigationT1003116Compile After Delivery MitigationThis type of technique cannot be easily mitigated with preventive controls or patched since it is based on the abuse of operating system design features. For example, blocking all file compilation may have unintended side effects, such as p…MitigationT1500117Spearphishing Link MitigationBecause this technique involves user interaction on the endpoint, it's difficult to fully mitigate. However, there are potential mitigations. Users can be trained to identify social engineering techniques and spearphishing emails with malic…MitigationT1192118Bash History MitigationThere are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands: set +o history and set -o history to start logging again; unset HISTFILE being added …MitigationT1139119NTFS File Attributes MitigationIt may be difficult or inadvisable to block access to EA and ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Symantec ADS May 2009) Efforts should be focused on preventing potentially malicious software from running. Identify and block …MitigationT1096120Graphical User Interface MitigationPrevent adversaries from gaining access to credentials through Credential Access that can be used to log into remote desktop sessions on systems. Identify unnecessary system utilities, third-party tools, or potentially malicious software th…MitigationT1061121Exfiltration Over Other Network Medium MitigationEnsure host-based sensors maintain visibility into usage of all network adapters and prevent the creation of new ones where possible. (Citation: Microsoft GPO Bluetooth FEB 2009) (Citation: TechRepublic Wireless GPO FEB 2009)MitigationT1011122Regsvcs/Regasm MitigationRegsvcs and Regasm may not be necessary within a given environment. Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.MitigationT1121123Standard Cryptographic Protocol MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Use of encryption protocols may make typical network-ba…MitigationT1032124Antivirus/AntimalwareAntivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints …MitigationM1049125Custom Cryptographic Protocol MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Since the custom protocol used may not adhere to typica…MitigationT1024126Kerberoasting MitigationEnsure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. (Citation: AdSecurity Cracking Kerberos Dec 2015) Also consider using Group Managed Service Accounts or…MitigationT1208127Restrict Registry PermissionsRestricting registry permissions involves configuring access control settings for sensitive registry keys and hives to ensure that only authorized users or processes can make modifications. By limiting access, organizations can prevent unau…MitigationM1024128Time Providers MitigationIdentify and block potentially malicious software that may be executed as a time provider by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capabl…MitigationT1209129Shortcut Modification MitigationLimit permissions for who can create symbolic links in Windows to appropriate groups such as Administrators and necessary groups for virtualization. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Secu…MitigationT1023130Uncommonly Used Port MitigationProperly configure firewalls and proxies to limit outgoing traffic to only necessary ports. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mit…MitigationT1065131Security Support Provider MitigationWindows 8.1, Windows Server 2012 R2, and later versions may make LSA run as a Protected Process Light (PPL) by setting the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL , which requires all SSP DLLs to be signed by Microso…MitigationT1101132Screensaver MitigationBlock .scr files from being executed from non-standard locations. Set Group Policy to force users to have a dedicated screensaver where local changes should not override the settings to prevent changes. Use Group Policy to disable screensav…MitigationT1180133Privileged Account ManagementPrivileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions…MitigationM1026134Logon Scripts MitigationRestrict write access to logon scripts to specific administrators. Prevent access to administrator accounts by mitigating Credential Access techniques and limiting account access and permissions of [Valid Accounts](https://attack.mitre.org/…MitigationT1037135Remote System Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information on remotely available systems, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker,…MitigationT1018136Create Account MitigationUse and enforce multifactor authentication. Follow guidelines to prevent or limit adversary access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) that may be used to create privileged accounts within an environment. Adversar…MitigationT1136137Restrict File and Directory PermissionsRestricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can r…MitigationM1022138Supply Chain Compromise MitigationApply supply chain risk management (SCRM) practices and procedures (Citation: MITRE SE Guide 2014), such as supply chain analysis and appropriate risk management, throughout the life-cycle of a system. Leverage established software developm…MitigationT1195139DLL Search Order Hijacking MitigationDisallow loading of remote DLLs. (Citation: Microsoft DLL Preloading) This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+. (Citation: Microsoft DLL Search) Path Algorithm Enable Safe DLL Se…MitigationT1038140Bootkit MitigationEnsure proper permissions are in place to help prevent adversary access to privileged accounts necessary to perform this action. Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from be…MitigationT1067141Rootkit MitigationIdentify potentially malicious software that may contain rootkit functionality, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker)…MitigationT1014142AppCert DLLs MitigationIdentify and block potentially malicious software that may be executed through AppCert DLLs by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capa…MitigationT1182143Man in the Browser MitigationSince browser pivoting requires a high integrity process to launch from, restricting user permissions and addressing Privilege Escalation and [Bypass User Account Control](https://attack.mitre.org/techniques/T1088) opportunities can limit t…MitigationT1185144Network Share Connection Removal MitigationFollow best practices for mitigation of activity related to establishing [Windows Admin Shares](https://attack.mitre.org/techniques/T1077). Identify unnecessary system utilities or potentially malicious software that may be used to leverage…MitigationT1126145Startup Items MitigationSince StartupItems are deprecated, preventing all users from writing to the /Library/StartupItems directory would prevent any startup items from getting registered. Similarly, appropriate permissions should be applied such that only specifi…MitigationT1165146Authentication Package MitigationWindows 8.1, Windows Server 2012 R2, and later versions, may make LSA run as a Protected Process Light (PPL) by setting the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL , which requires all DLLs loaded by LSA to be signed…MitigationT1131147User Account ManagementUser Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized acces…MitigationM1018148Service Registry Permissions Weakness MitigationEnsure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation. Identify and block potentially malicious software that may be executed through service ab…MitigationT1058149Exploitation for Privilege Escalation MitigationUpdate software regularly by employing patch management for internal enterprise endpoints and servers. Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days a…MitigationT1068150Exfiltration Over Command and Control Channel MitigationMitigations for command and control apply. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures a…MitigationT1041151CMSTP MitigationCMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation). Consider using application whitelisting configured to block execution of CMSTP.exe if it is not required for a given system or netw…MitigationT1191152Distributed Component Object Model MitigationModify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AppID_GUID} associated with the process-wide security of individual COM applications. (Citation: Microsoft Process Wide Com Keys) Modify…MitigationT1175153Behavior Prevention on EndpointBehavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying s…MitigationM1040154Password PoliciesSet and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This m…MitigationM1027155File System Logical Offsets MitigationIdentify potentially malicious software that may be used to access logical drives in this manner, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation:…MitigationT1006156Spearphishing Attachment MitigationNetwork intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avo…MitigationT1193157Rundll32 MitigationMicrosoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass whitelisting. (Citation: Secure Host Baseline EMET)MitigationT1085158Automated Collection MitigationEncryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is…MitigationT1119159Registry Run Keys / Startup Folder MitigationIdentify and block potentially malicious software that may be executed through run key or startup folder persistence using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppL…MitigationT1060160Input Prompt MitigationThis technique exploits users' tendencies to always supply credentials when prompted, which makes it very difficult to mitigate. Use user training as a way to bring awareness and raise suspicion for potentially malicious events (ex: Office …MitigationT1141161Threat Intelligence ProgramA Threat Intelligence Program enables organizations to proactively identify, analyze, and act on cyber threats by leveraging internal and external data sources. The program supports decision-making processes, prioritizes defenses, and impro…MitigationM1019162Network SegmentationNetwork segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restr…MitigationM1030163Hidden Files and Directories MitigationMitigation of this technique may be difficult and unadvised due to the the legitimate use of hidden files and directories.MitigationT1158164Systemd Service MitigationThe creation and modification of systemd service unit files is generally reserved for administrators such as the Linux root user and other users with superuser privileges. Limit user access to system utilities such as systemctl to only user…MitigationT1501165Code Signing MitigationProcess whitelisting and trusted publishers to verify authenticity of software can help prevent signed malicious or untrusted code from executing on a system. (Citation: NSA MS AppLocker) (Citation: TechNet Trusted Publishers) (Citation: Se…MitigationT1116166System Time Discovery MitigationBenign software uses legitimate processes to gather system time. Efforts should be focused on preventing unwanted or unknown code from executing on a system. Some common tools, such as net.exe, may be blocked by policy to prevent common way…MitigationT1124167Endpoint Denial of Service MitigationLeverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.(Citation: CERT-EU DDoS March 2017) Filter boundary traffic by blocking source addresses sou…MitigationT1499168Dynamic Data Exchange MitigationRegistry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017) (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: GitHub …MitigationT1173169Out-of-Band Communications ChannelEstablish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an al…MitigationM1060170Trap MitigationDue to potential legitimate uses of trap commands, it's may be difficult to mitigate use of this technique.MitigationT1154171Data from Local System MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to collect data from the local system, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Win…MitigationT1005172Boot IntegrityBoot Integrity ensures that a system starts securely by verifying the integrity of its boot process, operating system, and associated components. This mitigation focuses on leveraging secure boot mechanisms, hardware-rooted trust, and runti…MitigationM1046173Process Hollowing MitigationThis type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating specific API calls will likely have unintended side effects, such …MitigationT1093174Commonly Used Port MitigationNetwork intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within proto…MitigationT1043175SSL/TLS InspectionSSL/TLS inspection involves decrypting encrypted network traffic to examine its content for signs of malicious activity. This capability is crucial for detecting threats that use encryption to evade detection, such as phishing, malware, or …MitigationM1020176Hooking MitigationThis type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features. For example, mitigating all hooking will likely have unintended side effects, such as prev…MitigationT1179177LSASS Driver MitigationOn Windows 8.1 and Server 2012 R2, enable LSA Protection by setting the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to dword:00000001 . (Citation: Microsoft LSA Protection Mar 2014) LSA Protection ensures t…MitigationT1177178Drive-by Compromise MitigationDrive-by compromise relies on there being a vulnerable piece of software on the client end systems. Use modern browsers with security features turned on. Ensure all browsers and plugins kept updated can help prevent the exploit phase of thi…MitigationT1189179DLL Side-Loading MitigationUpdate software regularly. Install software in write-protected locations. Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.MitigationT1073180Trusted Relationship MitigationNetwork segmentation can be used to isolate infrastructure components that do not require broad network access. Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and i…MitigationT1199181Pre-compromisePre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These acti…MitigationM1056182Do Not MitigateThe Do Not Mitigate category highlights scenarios where attempting to mitigate a specific technique may inadvertently increase the organization's security risk or operational instability. This could happen due to the complexity of the syste…MitigationM1055183LC_LOAD_DYLIB Addition MitigationEnforce that all binaries be signed by the correct Apple Developer IDs, and whitelist applications via known hashes. Binaries can also be baselined for what dynamic libraries they require, and if an app requires a new dynamic library that w…MitigationT1161184XSL Script Processing Mitigation[Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and/or msxsl.exe may or may not be used within a given environment. Disabling WMI may cause system instability and should be evaluated to assess the impact to a…MitigationT1220185Multi-hop Proxy MitigationTraffic to known anonymity networks and C2 infrastructure can be blocked through the use of network black and white lists. It should be noted that this kind of blocking may be circumvented by other techniques like [Domain Fronting](https://…MitigationT1188186Privileged Process IntegrityPrivileged Process Integrity focuses on defending highly privileged processes (e.g., system services, antivirus, or authentication processes) from tampering, injection, or compromise by adversaries. These processes often interact with criti…MitigationM1025187Firmware Corruption MitigationPrevent adversary access to privileged accounts or access necessary to perform this technique. Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification. Patch the BIOS and other firmware …MitigationT1495188Forced Authentication MitigationBlock SMB traffic from exiting an enterprise network with egress filtering or by blocking TCP ports 139, 445 and UDP port 137. Filter or block WebDAV protocol traffic from exiting the network. If access to external resources over SMB and We…MitigationT1187189LC_MAIN Hijacking MitigationEnforce valid digital signatures for signed code on all applications and only trust applications with signatures from trusted parties.MitigationT1149190Indicator Removal on Host MitigationAutomatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storag…MitigationT1070191System Network Configuration Discovery MitigationIdentify unnecessary system utilities or potentially malicious software that may be used to acquire information about a system's network configuration, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like A…MitigationT1016192Component Firmware MitigationPrevent adversary access to privileged accounts or access necessary to perform this technique. Consider removing and replacing system components suspected of being compromised.MitigationT1109193Exploit Public-Facing Application MitigationApplication isolation and least privilege help lesson the impact of an exploit. Application isolation will limit what other processes and system features the exploited target can access, and least privilege for service accounts will limit w…MitigationT1190194Network Denial of Service MitigationWhen flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provide…MitigationT1498195Data Loss PreventionData Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally…MitigationM1057196Domain Fronting MitigationIf it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be Domain Fronting. In order to use domain fronting, attackers will likely need to deploy additional tools to compromised systems. (Cita…MitigationT1172197Netsh Helper DLL MitigationIdentify and block potentially malicious software that may persist in this manner by using whitelisting (Citation: Beechey 2010) tools capable of monitoring DLL loads by Windows utilities like AppLocker. (Citation: Windows Commands JPCERT) …MitigationT1128198Re-opened Applications MitigationHolding the Shift key while logging in prevents apps from opening automatically (Citation: Re-Open windows on Mac). This feature can be disabled entirely with the following terminal command: defaults write -g ApplePersistence -bool no .MitigationT1164199Environment Variable PermissionsRestrict the modification of environment variables to authorized users and processes by enforcing strict permissions and policies. This ensures the integrity of environment variables, preventing adversaries from abusing or altering them for…MitigationM1039200Defacement MitigationImplementing best practices for websites such as defending against [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) (Citation: OWASP Top 10 2017). Consider implementing IT disaster recovery plans that contain p…MitigationT1491