{"data":{"id":"AC-02","name":"Account Management","family":"AC","family_name":"Access Control","withdrawn":false,"description":"a. Define and document the types of accounts allowed and specifically prohibited for use within the system;\nb. Assign account managers;\nc. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership;\nd. Specify:\n1. Authorized users of the system;\n2. Group and role membership; and\n3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account;\ne. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts;\nf. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];\ng. Monitor the use of accounts;\nh. Notify account managers and [Assignment: organization-defined personnel or roles] within:\n1. [Assignment: organization-defined time period] when accounts are no longer required;\n2. [Assignment: organization-defined time period] when users are terminated or transferred; and\n3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;\ni. Authorize access to the system based on:\n1. A valid access authorization;\n2. Intended system usage; and\n3. [Assignment: organization-defined attributes (as required)];\nj. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency];\nk. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and\nl. Align account management processes with personnel termination and transfer processes.","supplemental_guidance":"Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.\n\nWhere access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability.\n\nTemporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.","enhancements":[{"id":"AC-02(01)","name":"Automated System Account Management","statement":"Support the management of system accounts using [Assignment: organization-defined automated mechanisms].","baselines":["moderate","high"]},{"id":"AC-02(02)","name":"Automated Temporary and Emergency Account Management","statement":"Automatically [Selection (one): remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].","baselines":["moderate","high"]},{"id":"AC-02(03)","name":"Disable Accounts","statement":"Disable accounts within [Assignment: organization-defined time period] when the accounts:\na. Have expired;\nb. Are no longer associated with a user or individual;\nc. Are in violation of organizational policy; or\nd. Have been inactive for [Assignment: organization-defined time period].","baselines":["moderate","high"]},{"id":"AC-02(04)","name":"Automated Audit Actions","statement":"Automatically audit account creation, modification, enabling, disabling, and removal actions.","baselines":["moderate","high"]},{"id":"AC-02(05)","name":"Inactivity Logout","statement":"Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].","baselines":["moderate","high"]},{"id":"AC-02(06)","name":"Dynamic Privilege Management","statement":"Implement [Assignment: organization-defined dynamic privilege management capabilities].","baselines":[]},{"id":"AC-02(07)","name":"Privileged User Accounts","statement":"a. Establish and administer privileged user accounts in accordance with [Selection (one): a role-based access scheme; an attribute-based access scheme];\nb. Monitor privileged role or attribute assignments;\nc. Monitor changes to roles or attributes; and\nd. Revoke access when privileged role or attribute assignments are no longer appropriate.","baselines":[]},{"id":"AC-02(08)","name":"Dynamic Account Management","statement":"Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically.","baselines":[]},{"id":"AC-02(09)","name":"Restrictions on Use of Shared and Group Accounts","statement":"Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions for establishing shared and group accounts].","baselines":[]},{"id":"AC-02(10)","name":"Shared and Group Account Credential Change","withdrawn":true,"incorporated_into":["AC-02"]},{"id":"AC-02(11)","name":"Usage Conditions","statement":"Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].","baselines":["high"]},{"id":"AC-02(12)","name":"Account Monitoring for Atypical Usage","statement":"a. Monitor system accounts for [Assignment: organization-defined atypical usage]; and\nb. Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].","baselines":["high"]},{"id":"AC-02(13)","name":"Disable Accounts for High-risk Individuals","statement":"Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].","baselines":["moderate","high"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-02","name":"Account Management","description":"a. Define and document the types of accounts allowed and specifically prohibited for use within the system;\nb. Assign account managers;\nc. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership;\nd. Specify:\n1. Authorized users of the system;\n2. Group and role membership; and\n3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account;\ne. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts;\nf. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria];\ng. Monitor the use of accounts;\nh. Notify account managers and [Assignment: organization-defined personnel or roles] within:\n1. [Assignment: organization-defined time period] when accounts are no longer required;\n2. [Assignment: organization-defined time period] when users are terminated or transferred; and\n3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;\ni. Authorize access to the system based on:\n1. A valid access authorization;\n2. Intended system usage; and\n3. [Assignment: organization-defined attributes (as required)];\nj. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency];\nk. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and\nl. Align account management processes with personnel termination and transfer processes.","discussion":"Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts.\n\nWhere access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability.\n\nTemporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training.","related_controls":["AC-03","AC-05","AC-06","AC-17","AC-18","AC-20","AC-24","AU-02","AU-12","CM-05","IA-02","IA-04","IA-05","IA-08","MA-03","MA-05","PE-02","PL-04","PS-02","PS-04","PS-05","PS-07","PT-02","PT-03","SC-07","SC-12","SC-13","SC-37"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Removes parameter for system account types  Adds prerequisite and criteria parameter for group and role membership Adds access authorizations parameter for attributes (as required) for each account Adds parameters to notify account managers and organization-defined personnel or roles within time-period when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual Adds control text with a new parameter requiring authorize access to the system based on a valid access authorization, intended system usage; and attributes (as required)  Adds control text requiring alignment of account management processes with personnel termination and transfer processes Incorporates withdrawn control AC-02(10)"}},"compliance_mappings":{"iso_27001_2022":["A.5.15","A.5.16","A.5.18","A.8.2"],"iso_27002_2022":["5.15","5.18","8.2"],"cobit_2019":["DSS05"],"pci_dss_v4":["2.2.1","2.2.2","7.2","8.2","8.6"],"nist_csf_2":["DE.CM-01","DE.CM-03","PR.AA-01","PR.AA-05","PR.DS-10"],"cis_controls_v8":["CIS 4.7","CIS 5","CIS 5.1","CIS 5.3","CIS 5.5","CIS 5.6","CIS 6","CIS 6.1","CIS 6.2","CIS 6.6","CIS 6.7","CIS 6.8","CIS 12.5"],"soc2_tsc":["CC6.1","CC6.6","CC6.6-POF2"],"finos_ccc":["CCC-C11"],"iso_42001_2023":["A.3.2"],"iec_62443":["3-3 SR 1.3"],"asd_e8":["E8-5","E8-5 ML1","E8-5 ML2","E8-5 ML3"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 22-23"],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.2","ORP.4"],"anssi":["Hygiene.6","Hygiene.7","Hygiene.11","Hygiene.13","Hygiene.32","SecNumCloud.10.2"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.B.d(60)","IV.C(61)"],"gdpr":["Art.5(1)(f)","Art.25(2)","Art.32(1)(b)","Art.32(4)"],"dora":["Art.9(4)(c)","Art.9(4)(d)"],"bio2":["5.15","5.18","8.2"],"rbi_csf":["Annex1.8","ITGRCA.19"],"fisc":["FISC.T2"],"lgpd_bcb":["BCB.Art.3","BCB.PIX","LGPD.Art.46"],"hkma_tme1":["TME1.8.1","TME1.8.2"],"mlps_2":["8.1.4.2","8.1.7.2"],"dnb_good_practice":["DNB.8.5","DNB.17.2"],"cra":["CRA.I.2d"],"swift_cscf":["SWIFT.1.2","SWIFT.2.11A","SWIFT.5.1"],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-IX","CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CD-1","CTO-1"],"cbn_csf":["Part3.2"],"popia":["s19"],"sa_js2":["JS2-7.1"],"bcbs_239":["Principle 11"],"bot_cyber":["Ch2.2","Ch8.2"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.2"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.7","II.C.7(b)","II.C.15"],"hipaa_sr":["§164.308(a)(3)(i)","§164.308(a)(3)(ii)(A)","§164.308(a)(3)(ii)(B)","§164.308(a)(3)(ii)(C)","§164.308(a)(4)(i)","§164.308(a)(4)(ii)(B)","§164.308(a)(4)(ii)(C)","§164.312(a)(1)","§164.312(a)(2)(i)","§164.312(a)(2)(ii)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.7"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC"],"nerc_cip":["CIP-004-7","CIP-007-6"],"nrc_73_54":["RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":["5.1"],"ferc_cip":["Order 850"],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":["AWWA Sec 3"],"iaea_nss":["Sec 5.2","Sec 5.3"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.4"],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.10(d)","§11.10(g)","§11.100(a)","§11.200(a)(2)","§11.300(a)","§11.300(b)","§11.300(c)"],"fda_cyber":["SA-1"],"hitrust_csf":["01.a","02.c"],"iso_27799":["7.3","9.1","9.2","9.3"],"lloyds_ms":["MS8.3"],"naic_ds":["4-access","4B"],"nhs_dspt":["NDG-4.1","NDG-4.2"],"pra_ss1_23":["P2.4","P-IT.1"],"solvency_ii":["EIOPA-ICT-4.4"],"owasp_masvs_v2":[],"csa_ccm_v4":["IAM-03","IAM-05","IAM-06","IAM-07","IAM-08","IAM-10","IAM-11","IAM-13","LOG-12"],"csa_aicm":["IAM-03","IAM-05","IAM-06","IAM-07","IAM-08","IAM-10","IAM-11","IAM-13","IAM-17","IAM-18","LOG-12"],"ccss_v9":["1.04.1","1.04.2","1.06.2"],"mica":["Art.67(1)","Art.86(1)"],"basel_sco60":["SCO60.55","SCO60.62"],"bssc":["GSP-11","KMS-06","NOS-05"],"sec_custody_digital":["SEC-CD-02","SEC-CD-05","SEC-CD-16"],"dpdpa":["Rules.6(1)(b)"]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Regular access reviews and timely deactivation of unnecessary accounts reduces the number of valid credential targets available for adversaries attempting to dump credentials from operating system stores."},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing need-to-know access through structured account provisioning and role-based permissions limits which accounts can access sensitive local system data, reducing collection opportunities for compromised accounts."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Disciplined account lifecycle management ensures that only authorized users maintain active remote service access, reducing the pool of credentials adversaries can exploit for lateral movement via RDP, SSH, or SMB."},{"id":"T1025","name":"Data from Removable Media","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting account permissions and enforcing removable media access policies through account-based controls limits which authenticated users can access removable media, reducing data collection scope."},{"id":"T1036","name":"Masquerading","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Systematic account management practices including naming conventions and regular audits help identify accounts with names that deviate from organizational standards, revealing potential masquerading attempts."},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting account permissions to minimum necessary access limits the volume and sensitivity of data a compromised account can access and subsequently exfiltrate over C2 channels."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting WMI access through account management policies to only designated administrative accounts prevents unauthorized users from executing commands remotely via Windows Management Instrumentation."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Account-based access controls and egress restrictions tied to user identity limit which accounts can initiate outbound connections, constraining exfiltration over alternative protocols to authorized personnel."},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Account management policies governing removable media access ensure that only authorized accounts can write to physical media, limiting adversaries' ability to exfiltrate data through USB devices."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting task scheduler access to authorized administrator accounts prevents adversaries using compromised standard user accounts from creating scheduled tasks for persistence or execution."},{"id":"T1055","name":"Process Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Limiting administrative privileges through structured account management reduces the number of accounts with the elevated permissions required to perform cross-process injection techniques."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting script interpreter access through account-based policies and limiting command shell privileges to designated administrators prevents unauthorized accounts from executing arbitrary commands."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Maintaining minimal account privileges through disciplined provisioning ensures that even if an account is exploited, the initial privilege level limits the impact of successful exploitation."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Account management practices that enforce separation of duties and audit trail protection prevent adversaries from using compromised accounts to clear logs or remove indicators of their activity."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to software deployment tools through strict account provisioning ensures only authorized administrative accounts can use deployment infrastructure, preventing adversary hijacking."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Disciplined account lifecycle management including regular access reviews, prompt disabling of dormant accounts, and revocation upon personnel transfer reduces the pool of valid credentials available for adversary exploitation."},{"id":"T1087","name":"Account Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting directory service enumeration permissions and hiding sensitive account attributes limits the information adversaries can discover when attempting to enumerate organizational accounts."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing account modification approval workflows and monitoring account attribute changes prevents adversaries from silently manipulating account permissions, group memberships, or authentication settings."},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Account lockout policies, strong password requirements, and timely disabling of unused accounts directly mitigate brute force attacks by reducing the number of active accounts susceptible to credential guessing."},{"id":"T1134","name":"Access Token Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting accounts that hold SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege through disciplined privilege assignment limits the accounts adversaries can leverage for access token manipulation."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Centralized account creation workflows with mandatory approval processes detect and prevent unauthorized account creation, ensuring adversaries cannot establish new accounts for persistent access."},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Prompt session termination for inactive accounts and enforcing session timeouts limits the window during which adversaries can hijack active browser sessions of legitimate users."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Regularly reviewing and disabling service accounts associated with public-facing applications ensures that default or unnecessary accounts are not left exposed as exploitation targets."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Account management practices that restrict installation privileges and enforce least privilege for developer accounts limit the impact of supply chain compromises on the broader environment."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting BITS administration to authorized accounts and monitoring BITS job creation by non-standard accounts enables detection of adversary abuse of the Background Intelligent Transfer Service."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting authenticated access to internal services through disciplined account provisioning limits the accounts adversaries can leverage when exploiting remote services for lateral movement."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Prompt deactivation of compromised or unnecessary accounts reduces the credential targets available for adversaries attempting to exploit authentication vulnerabilities for credential access."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing repository access controls through account-based permissions and regular access reviews limits which accounts can access sensitive information repositories like wikis and document stores."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting administrative accounts that can install or execute system binaries limits which accounts adversaries can leverage for proxy execution through trusted signed binaries."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Account management practices that enforce separation of duties prevent standard user accounts from modifying critical file and directory permissions, limiting adversary impact on access controls."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain and tenant administration to designated accounts with strong authentication and monitoring ensures adversaries cannot easily modify domain policies through compromised standard accounts."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting service management privileges to designated operations accounts prevents adversaries from using compromised user accounts to stop critical services and disrupt operations."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Limiting accounts with permissions to modify backup and recovery configurations prevents adversaries from using compromised accounts to delete shadow copies or disable recovery mechanisms."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware update privileges to designated hardware administration accounts prevents adversaries from using compromised accounts to corrupt firmware on endpoint devices."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Account management for server administration ensures only authorized accounts can install or modify server software components, preventing adversaries from deploying web shells or backdoor plugins."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting container registry push permissions to authorized CI/CD service accounts prevents adversaries from using compromised developer accounts to implant malicious container images."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Regular review and rotation of application access tokens and service account credentials limits the window during which stolen tokens remain valid for unauthorized access."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing cloud storage access through account-based IAM policies with regular permission reviews ensures only authorized accounts can access cloud storage objects containing sensitive data."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting cross-account data transfer permissions through IAM policies prevents compromised accounts from transferring organizational data to adversary-controlled cloud accounts."},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud console access to authorized accounts with MFA enforcement limits adversaries' ability to use compromised credentials to access cloud service dashboards for reconnaissance."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware and boot configuration modification to designated administrative accounts prevents adversaries from using compromised accounts to establish pre-OS boot persistence."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting service creation and modification privileges to designated administrative accounts prevents adversaries from creating or modifying system processes using compromised standard accounts."},{"id":"T1546","name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the accounts that can modify event-triggered execution mechanisms (registry keys, WMI subscriptions) prevents adversaries from establishing persistence through event handlers."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Maintaining minimal privilege assignments through structured account management ensures that standard user accounts cannot abuse elevation control mechanisms for privilege escalation."},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Prompt invalidation of authentication tokens and sessions upon account termination or role change prevents adversaries from using stale alternate authentication material for lateral movement."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing credential hygiene through account management policies including password rotation, credential vault usage, and prohibition of credential storage in plaintext files reduces harvesting opportunities."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting certificate management and code signing operations to designated PKI administrator accounts prevents adversaries from using compromised accounts to install unauthorized trust anchors."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Account management controls that enforce separation of duties for authentication infrastructure prevent adversaries from using compromised accounts to modify domain controller or PAM configurations."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting service account permissions, enforcing AES Kerberos encryption, and disabling accounts vulnerable to Kerberoasting prevents adversaries from stealing or forging Kerberos tickets."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting COM and IPC permissions through account-based access controls limits which accounts can leverage inter-process communication for execution within other application contexts."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting security tool administration to designated security accounts and enforcing tamper protection prevents adversaries from using compromised accounts to disable defensive capabilities."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Session management policies including idle session termination and restricting concurrent sessions limit the opportunities for adversaries to hijack active remote service sessions."},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Account-based egress controls and DLP policies tied to user identity restrict which accounts can upload data to external web services, limiting exfiltration opportunities."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting service execution capabilities (sc.exe, launchctl) to authorized administrative accounts prevents adversaries from using compromised standard accounts to execute code through system services."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write permissions on application directories and service binary paths through account-based file system controls prevents adversaries from hijacking execution flow through file replacement."},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud compute modification permissions to designated cloud operations accounts prevents adversaries from creating, modifying, or deleting cloud instances to evade detection."},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud enumeration permissions through IAM policies prevents adversaries from using compromised accounts to discover cloud infrastructure resources and identify exploitation targets."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device administration accounts and enforcing strong authentication for configuration changes prevents adversaries from reconfiguring devices to bridge network boundaries."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device firmware management to authorized accounts with privileged access prevents adversaries from modifying system images through compromised standard accounts."},{"id":"T1606","name":"Forge Web Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Prompt revocation of compromised accounts and enforcement of short-lived tokens limits adversaries' ability to forge and use web credentials like cookies or SAML tokens for persistent access."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting container administration access through RBAC policies ensures only authorized accounts can execute commands within containers, preventing adversary abuse of container management tools."},{"id":"T1610","name":"Deploy Container","tactics":["defense-evasion","execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting container deployment permissions to authorized CI/CD service accounts prevents adversaries from using compromised accounts to deploy malicious containers in the environment."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting accounts that can run privileged containers and enforcing Pod Security Standards prevents adversaries from deploying containers configured to escape to the underlying host."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting container image build permissions to designated CI/CD pipelines prevents adversaries from building malicious images on production hosts using compromised accounts."},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting Kubernetes API access through account-based RBAC policies limits the accounts adversaries can use to enumerate container resources and map the deployment landscape."},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud storage listing permissions through IAM policies prevents adversaries from using compromised accounts to enumerate cloud storage objects and identify exfiltration targets."},{"id":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Account management policies that enforce phishing-resistant MFA and implement number matching prevent adversaries from generating fraudulent MFA requests to fatigue users into approving access."},{"id":"T1648","name":"Serverless Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting serverless function creation and modification to authorized DevOps accounts prevents adversaries from deploying malicious functions using compromised developer credentials."},{"id":"T1651","name":"Cloud Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud administration CLI access to designated accounts with strong authentication prevents adversaries from using compromised credentials to execute infrastructure management commands."},{"id":"T1654","name":"Log Enumeration","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting log access permissions through account management ensures that only authorized security and operations accounts can read audit logs, limiting adversary reconnaissance of monitoring coverage."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting administrative account usage and enforcing credential isolation policies limits the accounts whose LSASS process memory contains high-value credential material for adversary extraction."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Minimizing local administrative accounts and enforcing unique local admin passwords through LAPS reduces the value of SAM database extraction since captured hashes cannot be reused across systems."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain controller access to only authorized domain administrator accounts limits adversaries' ability to extract the NTDS.dit database containing all domain password hashes."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Minimizing accounts with local administrative access and enforcing credential isolation limits the LSA secrets available for extraction, as fewer service accounts store credentials locally."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Reducing cached domain credentials through Group Policy (CachedLogonsCount) and promptly disabling departed user accounts limits the cached credential material available for offline cracking."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain replication permissions (Replicating Directory Changes) to only designated domain controller accounts prevents adversaries from performing DCSync attacks with compromised accounts."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to /proc filesystem entries and enforcing ptrace_scope limitations through account controls prevents non-root accounts from reading sensitive process memory on Linux systems."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing restrictive file permissions on /etc/shadow and restricting sudo access to the root account prevents compromised user accounts from accessing password hash files on Linux systems."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device management access to authorized accounts prevents adversaries from configuring traffic mirroring or port SPAN sessions to duplicate and exfiltrate network traffic."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting RDP access to designated accounts and enforcing Network Level Authentication ensures only authorized users can establish Remote Desktop sessions for legitimate administration."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting administrative share access by limiting accounts in the local administrators group and enforcing credential hygiene prevents adversaries from using stolen credentials for SMB lateral movement."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting DCOM launch and activation permissions to authorized administrative accounts prevents adversaries from leveraging compromised credentials to execute code remotely through COM objects."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Managing SSH access through centralized key management and restricting authorized_keys modifications prevents adversaries from using compromised accounts to establish unauthorized SSH sessions."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting VNC authentication to designated accounts and disabling unattended access modes ensures only authorized administrators can establish VNC sessions for remote management."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting WinRM access to designated administrative accounts and limiting remote PowerShell session creation prevents adversaries from using compromised credentials for WS-Management lateral movement."},{"id":"T1021.007","name":"Cloud Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Managing cloud service access through IAM role assignments and enforcing conditional access policies prevents adversaries from using compromised cloud credentials for cross-service lateral movement."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting direct cloud VM access by managing serial console and OS Login permissions prevents adversaries from using compromised cloud accounts to bypass network-based access controls."},{"id":"T1036.003","name":"Rename System Utilities","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Account management practices that audit tool usage by account enable detection of renamed system utilities being executed by accounts that do not normally use administrative tools."},{"id":"T1036.005","name":"Match Legitimate Name or Location","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Monitoring account activity patterns and correlating process execution with account privileges helps identify when compromised accounts execute binaries masquerading as legitimate system files."},{"id":"T1036.010","name":"Masquerade Account Name","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Enforcing account naming conventions and reviewing account creation against organizational standards enables detection of adversary-created accounts with names designed to mimic legitimate system or service accounts."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting account permissions for outbound network connections and tying egress DLP policies to user identity limits the data compromised accounts can exfiltrate over encrypted non-C2 protocols."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Enforcing account-based network access policies that restrict outbound cleartext protocol usage limits adversaries' ability to exfiltrate data over unencrypted protocols using compromised accounts."},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Restricting USB device access through account-based device policies ensures only designated accounts can write to USB storage devices, preventing unauthorized data exfiltration via removable media."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting at command access to designated service accounts and monitoring scheduled job creation detects adversary attempts to establish persistence through legacy scheduling mechanisms."},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting crontab editing permissions to authorized accounts and monitoring cron job modifications prevents adversaries from establishing persistence through unauthorized cron entries on Linux systems."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Task Scheduler access to designated administrative accounts and monitoring task creation prevents adversaries from using compromised standard accounts to establish scheduled task persistence."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting systemd timer creation to authorized accounts and monitoring new timer unit files prevents adversaries from establishing persistence through unauthorized systemd timer services."},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Kubernetes job and CronJob creation through RBAC policies prevents adversaries from scheduling malicious container orchestration jobs using compromised service accounts."},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting ptrace capabilities to designated debugging accounts and enforcing YAMA ptrace_scope prevents adversaries from using compromised accounts to inject code via ptrace system calls."},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting web portal administration accounts and enforcing input field security prevents adversaries from injecting credential capture mechanisms into web portal login pages."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting PowerShell execution privileges to designated administrative accounts and enforcing Constrained Language Mode for standard users limits adversary ability to run PowerShell-based attacks."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting AppleScript execution permissions through account-based controls on macOS prevents compromised standard accounts from running AppleScript commands for system manipulation."},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting command shell access for standard user accounts and enforcing restricted shells limits adversaries' ability to execute Windows command shell commands for post-compromise operations."},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting shell access to designated administrator accounts and enforcing restricted shell environments prevents compromised accounts from executing arbitrary Unix shell commands."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting VBScript execution through account-based policies and limiting WSH access prevents adversaries from using compromised standard accounts to run Visual Basic scripts."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting Python installation and execution to designated developer accounts limits adversaries' ability to use compromised standard accounts to run Python-based malicious scripts."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting JScript and Node.js execution through account-based application control prevents compromised accounts from running JavaScript outside sanctioned browser contexts."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device CLI access to designated network administrator accounts with strong authentication prevents adversaries from executing device commands with compromised credentials."},{"id":"T1059.009","name":"Cloud API","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud CLI and API access to authorized service accounts with conditional access policies prevents adversaries from executing cloud commands with compromised developer credentials."},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting AutoHotKey and AutoIT execution privileges to authorized automation accounts prevents adversaries from running macro-based scripts under compromised standard user contexts."},{"id":"T1059.011","name":"Lua","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting Lua interpreter access to designated application accounts limits adversaries' ability to execute Lua scripts for post-compromise automation and payload execution."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting event log management permissions to designated security accounts prevents adversaries from using compromised accounts to clear Windows Event Logs and destroy audit trails."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting log file access on Linux and macOS to root and designated syslog accounts prevents adversaries from using compromised accounts to clear system logs and hide their activities."},{"id":"T1070.003","name":"Clear Command History","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to modify shell history files and enforcing immutable logging ensures compromised accounts cannot clear command history to conceal post-compromise activities."},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network configuration management to designated accounts prevents adversaries from clearing network connection histories and saved connection profiles to hide lateral movement."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting mailbox administration to designated Exchange/Office 365 administrators prevents adversaries from clearing mailbox data or purging deleted items to destroy evidence."},{"id":"T1070.009","name":"Clear Persistence","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting registry and file system modification privileges prevents adversaries from using compromised accounts to remove persistence mechanisms to cover their tracks before exfiltration."},{"id":"T1078.001","name":"Default Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Identifying and disabling default accounts (Administrator, Guest, default service accounts) or changing their credentials prevents adversaries from leveraging factory-default credentials for initial access."},{"id":"T1078.002","name":"Domain Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Regular review of domain account usage, prompt disabling of departed employees, and monitoring unusual domain authentication patterns limits adversary exploitation of compromised domain credentials."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing unique local administrator passwords through LAPS and disabling unnecessary local accounts prevents adversaries from using compromised local credentials to access multiple systems."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Regular review of cloud IAM account permissions, enforcing MFA, and promptly revoking departed users' cloud access limits adversary exploitation of compromised cloud account credentials."},{"id":"T1087.004","name":"Cloud Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud IAM enumeration permissions and enforcing least-privilege API access prevents adversaries from discovering and enumerating cloud accounts across the organization's tenants."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Monitoring and restricting the addition of cloud credentials (access keys, certificates) to service accounts prevents adversaries from implanting alternate authentication methods for persistent cloud access."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Monitoring email delegation changes and restricting the ability to add delegate permissions prevents adversaries from configuring email forwarding to maintain access to sensitive communications."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud role assignments to authorized identity governance processes and monitoring role changes prevents adversaries from elevating compromised account privileges through additional cloud roles."},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing device registration policies and monitoring new device enrollments prevents adversaries from registering unauthorized devices to gain compliant access that bypasses conditional access policies."},{"id":"T1098.006","name":"Additional Container Cluster Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Kubernetes ClusterRole and RoleBinding modifications through RBAC and monitoring role changes prevents adversaries from adding container cluster roles to compromised service accounts."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Monitoring group membership changes and restricting group modification to authorized identity management processes prevents adversaries from adding compromised accounts to privileged local or domain groups."},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Account lockout policies and monitoring for failed authentication attempts across accounts enable detection and blocking of password guessing attacks targeting specific user accounts."},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strong password complexity requirements and modern hashing algorithms makes offline password cracking computationally infeasible for adversaries who have obtained password hashes."},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Account lockout policies, intelligent lockout, and monitoring for authentication failures across many accounts detect and block password spraying campaigns attempting common passwords against multiple users."},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing unique passwords per service and monitoring for bulk authentication failures detects credential stuffing attacks that replay stolen credential pairs from other breach databases."},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting accounts with token impersonation privileges (SeImpersonatePrivilege) through disciplined account management limits the accounts adversaries can leverage for token theft."},{"id":"T1134.002","name":"Create Process with Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting accounts that can create processes under different security contexts limits adversaries' ability to spawn new processes using stolen or manufactured tokens."},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting accounts with token creation privileges and monitoring for unusual token activity detects adversaries creating and impersonating tokens to operate under different security contexts."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Monitoring local account creation events and restricting local administrator group membership prevents adversaries from establishing persistence through unauthorized local account creation."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Centralizing domain account provisioning through approved identity management workflows and monitoring AD account creation events prevents adversaries from creating rogue domain accounts."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud IAM account creation through policy-based controls and monitoring for unauthorized account provisioning prevents adversaries from creating cloud accounts for persistent access."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing Confluence space permissions through account-based access controls and regular permission reviews prevents compromised accounts from accessing sensitive wiki documentation."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing SharePoint site and library permissions through account management ensures only authorized accounts can access document repositories, limiting data collection scope."},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting code repository access through account-based permissions and SSH key management prevents compromised accounts from accessing source code and configuration repositories."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Enforcing CRM access controls through account-based role assignments prevents compromised accounts from extracting sensitive customer data from CRM platforms like Salesforce."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting messaging application access through account provisioning and enforcing workspace membership policies prevents adversaries from mining chat histories for sensitive information."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting msiexec execution through account-based application control policies prevents standard user accounts from installing malicious MSI packages that bypass security controls."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting the installation and execution of Electron applications through account-based controls limits which users can run applications that embed potentially exploitable Node.js runtimes."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cacls, icacls, and takeown usage to designated administrative accounts prevents adversaries from using compromised accounts to modify Windows file permissions and weaken ACLs."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting chmod, chown, and chattr usage through account permissions prevents adversaries from using compromised accounts to modify Unix file permissions and access protected files."},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud storage lifecycle policy modification to authorized accounts prevents adversaries from configuring automatic deletion rules that destroy data as a destructive impact technique."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting Exchange Transport Agent installation to authorized administrative accounts prevents adversaries from deploying malicious agents that intercept or modify email traffic for persistence."},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting web server administration accounts and monitoring for unauthorized file uploads prevents adversaries from deploying web shells that provide persistent command execution capabilities."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting Terminal Services DLL registration to authorized administrator accounts prevents adversaries from installing malicious DLLs that load with every RDP session."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware modification to designated hardware administration accounts prevents adversaries from using compromised accounts to install persistent implants in system BIOS or UEFI firmware."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting boot configuration and bootloader modification to designated accounts prevents adversaries from installing bootkits that load malicious code before the operating system."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting TFTP server and network boot configuration to authorized network accounts prevents adversaries from redirecting devices to boot from adversary-controlled firmware images."},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting macOS Launch Agent creation to authorized administrative accounts prevents adversaries from registering persistent agents that execute malicious code during user logon."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting systemd service unit creation to root and authorized accounts prevents adversaries from installing persistent systemd services that execute with elevated privileges on Linux systems."},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Windows Service creation through account controls (SeServiceLogonRight) and monitoring for new service registration prevents adversary installation of persistent malicious services."},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting macOS Launch Daemon creation to root-level accounts prevents adversaries from registering persistent daemons that execute with root privileges during system boot."},{"id":"T1543.005","name":"Container Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting container service creation through Kubernetes RBAC ensures only authorized accounts can deploy persistent container services within the orchestration platform."},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting WMI event subscription creation to authorized administrative accounts prevents adversaries from establishing persistence through WMI event consumers that trigger malicious actions."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting modification of Winlogon registry keys to system and designated administrative accounts prevents adversaries from registering malicious helper DLLs that load at logon."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting kernel module loading to root accounts with verified authentication prevents adversaries from loading unsigned kernel modules that operate at the highest system privilege level."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to Startup folder contents through account-based NTFS permissions prevents adversaries from modifying shortcuts to achieve persistence across system reboots."},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Print Spooler configuration and print processor registration to authorized accounts prevents adversaries from installing malicious print processors for SYSTEM-level persistence."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to XDG autostart directories to authorized accounts prevents adversaries from creating desktop autostart entries that execute malicious applications at user login."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting accounts in the local administrators group and enforcing strong UAC policies reduces the accounts adversaries can leverage to bypass User Account Control for privilege escalation."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting sudo access through careful sudoers management and enforcing re-authentication prevents adversaries from abusing cached sudo credentials for privilege escalation on Linux systems."},{"id":"T1548.005","name":"Temporary Elevated Cloud Access","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Monitoring and restricting cloud role escalation requests and enforcing just-in-time access approval workflows prevents adversaries from abusing temporary elevated cloud access mechanisms."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting TCC database modification to authorized system processes and enforcing SIP prevents adversaries from manipulating macOS privacy permissions through compromised user accounts."},{"id":"T1550.002","name":"Pass the Hash","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Prompt rotation of account passwords and enforcement of Credential Guard limits the validity window of captured NTLM hashes, reducing the effectiveness of pass-the-hash lateral movement."},{"id":"T1550.003","name":"Pass the Ticket","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Enforcing short Kerberos ticket lifetimes and restricting delegation permissions limits the window during which adversaries can use stolen Kerberos tickets for pass-the-ticket attacks."},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Account management policies that prohibit credential storage in files and enforce credential vault usage reduce the plaintext credentials available for adversary harvesting from file systems."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Regular auditing of registry entries for stored credentials and enforcing policies against credential storage in registry keys limits adversary access to credentials in the Windows registry."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing centralized key management and restricting private key file permissions through account controls prevents adversaries from harvesting unprotected private keys for authentication bypass."},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Disabling reversible encryption in Group Policy Preferences and removing cached GPP XML files eliminates the credential material adversaries extract from Group Policy Preferences."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting container API access and Kubernetes secrets through RBAC policies prevents compromised service accounts from accessing credentials stored in container orchestration secrets."},{"id":"T1555.005","name":"Password Managers","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting account access to password manager vaults and enforcing master password policies limits adversaries' ability to extract stored credentials from password management applications."},{"id":"T1555.006","name":"Cloud Secrets Management Stores","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strict IAM policies for cloud secrets management services and restricting API key access prevents compromised accounts from retrieving secrets from cloud vault stores."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain controller administration to designated Tier 0 accounts and monitoring authentication subsystem changes prevents adversaries from modifying DC authentication mechanisms."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting PAM configuration modification to root and designated accounts prevents adversaries from inserting malicious Pluggable Authentication Modules that capture or bypass credentials."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device authentication configuration to authorized accounts prevents adversaries from modifying TACACS+ or RADIUS settings to capture or bypass authentication."},{"id":"T1556.005","name":"Reversible Encryption","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting Active Directory encryption configuration to designated domain administrators prevents adversaries from enabling reversible encryption that allows recovery of plaintext passwords."},{"id":"T1556.006","name":"Multi-Factor Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Monitoring MFA configuration changes and restricting MFA administration to authorized security accounts prevents adversaries from weakening or bypassing multi-factor authentication requirements."},{"id":"T1556.007","name":"Hybrid Identity","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Monitoring hybrid identity synchronization (Azure AD Connect) account configuration and restricting modification rights prevents adversaries from manipulating hybrid authentication flows."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Monitoring conditional access policy modifications and restricting identity administration prevents adversaries from weakening authentication policies to maintain persistent access without strong credentials."},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Promptly rotating the KRBTGT account password and restricting domain admin accounts limits adversaries' ability to forge Golden Tickets that grant unrestricted domain access."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strong service account passwords and restricting SPNs to authorized services limits adversaries' ability to forge Silver Tickets for targeted service authentication bypass."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Managing service accounts with long, random passwords and using Group Managed Service Accounts makes offline cracking of Kerberoast-captured service ticket hashes computationally infeasible."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Ensuring all accounts require Kerberos pre-authentication prevents adversaries from requesting AS-REP responses that can be cracked offline to recover account passwords."},{"id":"T1558.005","name":"Ccache Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to Kerberos ccache files through file permissions and enforcing ticket encryption prevents adversaries from stealing cached credential material from Linux systems."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting COM object instantiation permissions through account-based DCOM configuration prevents compromised accounts from leveraging Component Object Model for cross-process execution."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting security tool administration to designated security accounts with tamper protection prevents adversaries from using compromised accounts to disable or modify endpoint protection."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting Event Log service configuration to SYSTEM and designated security accounts prevents adversaries from disabling Windows event logging to blind monitoring capabilities."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firewall administration to designated network security accounts prevents adversaries from using compromised accounts to disable or modify system firewall rules."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting ETW configuration and event channel access to designated accounts prevents adversaries from blocking security indicators from reaching detection and response systems."},{"id":"T1562.007","name":"Disable or Modify Cloud Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud firewall and security group management to designated cloud security accounts prevents adversaries from modifying cloud network controls to enable unauthorized access."},{"id":"T1562.008","name":"Disable or Modify Cloud Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud logging configuration (CloudTrail, Azure Monitor) to authorized security accounts prevents adversaries from disabling audit logging to hide their cloud activities."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting boot configuration (bcdedit) access to authorized accounts prevents adversaries from forcing Safe Mode boot that disables third-party security tools on startup."},{"id":"T1562.012","name":"Disable or Modify Linux Audit System","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting auditd and Linux audit system configuration to root accounts prevents adversaries from disabling kernel-level audit logging to hide their system activities."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Managing SSH sessions with agent forwarding controls and monitoring active connections prevents adversaries from hijacking established SSH sessions for lateral movement."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Enforcing RDP session policies including timeouts, limited concurrent sessions, and NLA prevents adversaries from hijacking disconnected RDP sessions for unauthorized access."},{"id":"T1566.003","name":"Spearphishing via Service","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Account management practices that verify new connections on collaboration platforms and restrict external messaging prevent social engineering through third-party communication services."},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting launchctl usage to designated administrative accounts on macOS prevents compromised standard accounts from loading or unloading services through the launchd system."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting Windows service execution (sc.exe, services.msc) to designated administrative accounts prevents adversaries from using compromised accounts to execute code through the Service Control Manager."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to application bundle framework directories through account-based permissions prevents adversaries from placing malicious dylibs for macOS Dylib Hijacking."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Enforcing proper file permissions on installer directories and restricting write access to application installation paths prevents adversaries from exploiting installer file permission weaknesses."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting PATH environment variable modification to administrative accounts and monitoring PATH changes prevents adversaries from interposing malicious executables in PATH directories."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to directories in application search paths through account-based controls prevents adversaries from placing malicious executables that take precedence through search order."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting service binary path modification to authorized accounts and monitoring for unquoted path entries prevents adversaries from exploiting service path interpretation ambiguities."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to service executable files and directories through NTFS permissions prevents adversaries from replacing service binaries to achieve persistence and privilege escalation."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting environment variable modification (COR_PROFILER) to authorized accounts prevents adversaries from registering malicious .NET profiling DLLs for code injection."},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud snapshot creation permissions to authorized accounts prevents adversaries from creating disk snapshots that can be mounted to extract data from other instances."},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud instance creation to authorized accounts and enforcing instance launch templates prevents adversaries from spinning up rogue compute instances for data processing."},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud instance termination to authorized operations accounts prevents adversaries from deleting instances to disrupt services or destroy forensic evidence."},{"id":"T1578.005","name":"Modify Cloud Compute Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud compute configuration modification to authorized accounts prevents adversaries from altering instance settings to disable security features or enable unauthorized access."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting NAT configuration on network devices to authorized network accounts prevents adversaries from manipulating address translation to bypass network segmentation controls."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware update and patch capabilities to authorized network engineering accounts prevents adversaries from deploying modified system images to network infrastructure."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firmware version management to authorized accounts and enforcing minimum version policies prevents adversaries from downgrading device firmware to exploit known vulnerabilities."},{"id":"T1606.001","name":"Web Cookies","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing short cookie lifetimes and monitoring cookie-based authentication through account activity analytics helps detect adversaries using forged web cookies for unauthorized access."},{"id":"T1606.002","name":"SAML Tokens","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting SAML signing certificate access and monitoring federation trust configurations prevents adversaries from forging SAML tokens (Golden SAML) for cross-service authentication bypass."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.16, A.8.2 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 DE.CM-01, PR.AA-01, PR.DS-10 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-011","SP-013","SP-015","SP-019","SP-021","SP-022","SP-025","SP-026","SP-028","SP-029","SP-031","SP-032","SP-034","SP-036","SP-037","SP-044","SP-054"]}}