{"data":{"id":"AC-05","name":"Separation of Duties","family":"AC","family_name":"Access Control","withdrawn":false,"description":"a. Identify and document [Assignment: organization-defined duties of individuals requiring separation]; and\nb. Define system access authorizations to support separation of duties.","supplemental_guidance":"Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission or business functions and support functions among different individuals or roles, conducting system support functions with different individuals, and ensuring that security personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of systems and system components when developing policy on separation of duties. Separation of duties is enforced through the account management activities in AC-2, access control mechanisms in AC-3, and identity management activities in IA-2, IA-4, and IA-12.","enhancements":[],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-05","name":"Separation of Duties","description":"a. Identify and document [Assignment: organization-defined duties of individuals requiring separation]; and\nb. Define system access authorizations to support separation of duties.","discussion":"Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission or business functions and support functions among different individuals or roles, conducting system support functions with different individuals, and ensuring that security personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of systems and system components when developing policy on separation of duties. Separation of duties is enforced through the account management activities in AC-2, access control mechanisms in AC-3, and identity management activities in IA-2, IA-4, and IA-12.","related_controls":["AC-02","AC-03","AC-06","AU-09","CM-05","CM-11","CP-09","IA-02","IA-04","IA-05","IA-12","MA-03","MA-05","PS-02","SA-08","SA-17"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Revises parameter to identify and document duties of individuals requiring separation Adds reference to multiple systems and organizations, and that separation of duties policy should span systems and application domains. Adds reference to AC-02 and AC-03 as enforcement mechanisms."}},"compliance_mappings":{"iso_27001_2022":["A.5.3"],"iso_27002_2022":["5.3","8.2"],"cobit_2019":["DSS05","DSS06"],"pci_dss_v4":["7.2"],"nist_csf_2":["PR.AA-05"],"cis_controls_v8":["CIS 5"],"soc2_tsc":["CC5.1","CC6.6","CC6.6-POF2"],"finos_ccc":[],"iso_42001_2023":["A.3.2"],"iec_62443":["3-3 SR 1.3"],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.2","ORP.1","ORP.4"],"anssi":["Hygiene.15","Hygiene.17","SecNumCloud.10.4"],"osfi_b13":["B-13.1.1","B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.B.d(60)"],"gdpr":["Art.5(1)(f)","Art.24(1)","Art.32(1)(b)"],"dora":["Art.9(4)(c)","Art.9(4)(d)"],"bio2":["5.3","8.2"],"rbi_csf":["Annex1.8","ITGRCA.19"],"fisc":["FISC.T2"],"lgpd_bcb":["BCB.Art.3","LGPD.Art.46"],"hkma_tme1":["TME1.8.1","TME1.8.2"],"mlps_2":["8.1.4.2","8.1.10.4"],"dnb_good_practice":["DNB.7.1","DNB.17.2"],"cra":[],"swift_cscf":["SWIFT.1.2","SWIFT.5.1"],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC"],"sama_csf":["1.5","3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CD-1","CTO-1"],"cbn_csf":["Part3.2","Part9"],"popia":["s19"],"sa_js2":["JS2-7.1"],"bcbs_239":["Principle 1"],"bot_cyber":["Ch2.2"],"cpmi_pfmi":["CG.PR"],"eba_ict":["3.4.2"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.7","II.C.7(b)","II.C.7(c)"],"hipaa_sr":["§164.308(a)(3)(i)","§164.308(a)(3)(ii)(A)","§164.308(a)(4)(ii)(C)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.7"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC"],"nerc_cip":[],"nrc_73_54":["RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":["5.1"],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":[],"iaea_nss":["Sec 5.3"],"pci_pts":[],"fips_140":["FIPS 140-3 §7.4"],"cbest":[],"tiber_eu":[],"pci_hsm":["1","5","6"],"common_criteria":["CC Part 2 — FDP","CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.6.2","SYSC 13.7.3"],"fda_21_cfr_11":["§11.10(d)","§11.10(g)"],"fda_cyber":[],"hitrust_csf":["01.a"],"iso_27799":["9.3"],"lloyds_ms":["MS2.1","MS5.1","MS8.3"],"naic_ds":["4-access","4B"],"nhs_dspt":["NDG-4.1","NDG-4.4"],"pra_ss1_23":["P2.2","P2.4","P4.1","P-IT.1"],"solvency_ii":["EIOPA-ICT-4.4"],"owasp_masvs_v2":[],"csa_ccm_v4":["IAM-04","IAM-09"],"csa_aicm":["IAM-04","IAM-09","IAM-19"],"ccss_v9":["1.02.2","1.04.3","1.05.3"],"mica":["Art.36(1)","Art.63(2)","Art.65(1)","Art.86(1)","Art.92(1)"],"basel_sco60":["SCO60.55","SCO60.60","SCO60.61","SCO60.62","SCO60.63","SCO60.66"],"bssc":["GSP-11","KMS-04","KMS-06"],"sec_custody_digital":["SEC-CD-02","SEC-CD-03","SEC-CD-04","SEC-CD-05","SEC-CD-16","SEC-CD-19"],"dpdpa":[]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties ensures that no single role has both the access to credential stores and the ability to suppress audit trails, making credential dumping operations more detectable because the adversary must compromise multiple accounts with distinct privileges."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Dividing remote service administration across distinct roles ensures that credentials granting remote access are limited in scope, reducing the lateral movement value of any single compromised account by restricting which services each role can access."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts WMI execution privileges to designated administrative roles, preventing standard users from leveraging Windows Management Instrumentation for remote command execution and limiting the blast radius of account compromise."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting scheduled task creation and modification to dedicated administrative roles prevents regular users from establishing persistent scheduled jobs, requiring adversaries to compromise specifically privileged accounts to achieve persistence through task scheduling."},{"id":"T1055","name":"Process Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits process injection capabilities by restricting debug and memory manipulation privileges to specific roles, preventing adversaries with standard user access from injecting code into higher-privileged processes."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts scripting interpreter access to roles that require it for legitimate operations, preventing general users from executing scripts and limiting the adversary's ability to use compromised standard accounts for script-based attacks."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separating audit management from operational roles ensures that users cannot delete or modify their own audit trails, requiring adversaries to compromise both an operational account and a separate audit administration account to remove indicators."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts software deployment tool access to dedicated deployment roles, preventing adversaries who compromise standard administrative accounts from leveraging enterprise deployment infrastructure for lateral movement."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation ensures that valid accounts are scoped to specific functions, so even if adversaries obtain legitimate credentials, the compromised account provides limited access rather than broad cross-functional privileges enabling widespread lateral movement."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting account manipulation capabilities to dedicated identity management roles prevents adversaries with general administrative access from adding credentials, modifying permissions, or creating persistence through account modifications."},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits the value of brute-forced credentials by ensuring that compromised accounts provide access only to their designated function, preventing a single credential compromise from yielding broad organisational access."},{"id":"T1134","name":"Access Token Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits access token manipulation by restricting token creation and impersonation privileges to specific service accounts, preventing adversaries from creating or stealing tokens that grant cross-functional access."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting account creation to dedicated identity management roles prevents adversaries with general administrative access from establishing persistent backdoor accounts, as account provisioning requires a separately authorised role."},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits the data accessible through hijacked browser sessions by ensuring that each user role has access only to its designated applications and data, reducing the collection value of any single session compromise."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation between application development, deployment, and administration reduces the impact of public-facing application exploitation, as compromised application service accounts lack the cross-functional privileges needed for deeper penetration."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting BITS administration to dedicated roles prevents adversaries who compromise standard accounts from creating BITS transfer jobs for persistence or data exfiltration, as the necessary privileges are separated from general user access."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits the lateral movement value of exploited remote services by ensuring that service accounts have narrowly scoped privileges, preventing a single service exploitation from providing broad network access."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Duty separation enforces need-to-know access controls on information repositories, ensuring that compromised accounts can only access data relevant to their specific role rather than providing unrestricted collection across all repositories."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to system binary proxy execution tools to designated administrative roles prevents standard users from leveraging signed binaries for defense evasion, limiting adversary options when operating with non-privileged accounts."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts permission modification capabilities to designated security administrators, preventing adversaries with standard or application-level access from weakening file and directory protections to facilitate data access."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain and tenant policy modification to dedicated identity governance roles prevents adversaries with general administrative access from altering domain trust relationships or conditional access policies for privilege escalation."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Duty separation ensures that service management privileges are restricted to designated operations roles, preventing adversaries who compromise standard accounts from stopping critical services to cause operational disruption."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Separating firmware management from general system administration restricts firmware update privileges to dedicated roles, preventing adversaries with standard admin access from corrupting firmware on critical infrastructure."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts server component installation to designated deployment roles, preventing adversaries with general server access from installing persistent web shells, transport agents, or other malicious server components."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting container image management to dedicated DevOps roles prevents adversaries with general infrastructure access from implanting backdoored images into container registries used for production deployments."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits the scope of application access tokens to specific service functions, reducing the value of stolen tokens and preventing a single token compromise from granting cross-functional API access."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts cloud storage access by role, ensuring that compromised accounts can only access data repositories relevant to their designated function rather than providing broad cloud data collection capabilities."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts cloud data transfer permissions to designated data management roles, preventing adversaries with standard cloud accounts from transferring data to external cloud accounts for exfiltration."},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud service dashboard access to designated cloud administrators limits the discovery value of compromised accounts, preventing adversaries from enumerating organisational cloud infrastructure through management console access."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties ensures that boot-level configuration changes require dedicated firmware management roles, preventing adversaries with general administrative access from modifying pre-OS boot components for persistent defense evasion."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting system process creation and modification to designated service management roles prevents adversaries with standard accounts from establishing persistence through new or modified services, daemons, or launch agents."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits access to elevation control configuration, ensuring that adversaries must compromise specifically privileged accounts to modify sudo policies, UAC settings, or other privilege escalation mechanisms."},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts the scope of alternate authentication materials such as tokens and hashes, ensuring that even if adversaries obtain these credentials, they provide limited cross-functional access."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation reduces the incidence of unsecured credentials by restricting credential management to dedicated roles, ensuring that sensitive authentication materials are not scattered across accounts with broader access patterns."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting authentication infrastructure management to dedicated identity security roles prevents adversaries with general administrative access from modifying authentication processes to install credential-harvesting backdoors."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits access to Kerberos infrastructure management, ensuring that service account password management and KDC administration are restricted to roles where these operations are auditable and controlled."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits inter-process communication privileges by restricting COM and DDE access to roles that require it, preventing adversaries from using compromised standard accounts for cross-process execution."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separating security tool administration from operational roles ensures that adversaries who compromise standard accounts cannot disable or modify defensive tools, requiring a separate security administration account to impair defenses."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts remote session management to designated administrative roles, preventing adversaries from hijacking existing sessions when the compromised account lacks session management privileges."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting service execution privileges to designated roles prevents adversaries with standard accounts from launching processes via service control mechanisms, limiting their execution options for privilege escalation."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits write access to executable directories and service configurations, preventing adversaries from hijacking execution flow without first compromising a role with specific file system modification privileges."},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud infrastructure modification to designated cloud engineering roles prevents adversaries with standard cloud accounts from creating, modifying, or deleting compute instances to evade forensic investigation."},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits cloud infrastructure discovery by restricting resource enumeration permissions to designated cloud administration roles, preventing compromised standard accounts from mapping the cloud environment."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts network device configuration to dedicated network engineering roles, preventing adversaries with general access from bridging network boundaries by modifying routing or NAT configurations."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separating network device firmware management from general administration prevents adversaries with standard network access from modifying system images, requiring dedicated engineering credentials for firmware operations."},{"id":"T1606","name":"Forge Web Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts access to web credential signing infrastructure—including SAML certificates and JWT signing keys—preventing adversaries from forging web credentials without compromising the dedicated identity management role."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting container administration commands to designated container platform roles prevents adversaries with general infrastructure access from executing arbitrary commands within containers for privilege escalation."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation between container workloads and host management limits the impact of container escape, as even if adversaries break out of the container, the host privileges available are restricted by role separation."},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits cloud storage enumeration to designated data management roles, preventing adversaries with standard accounts from discovering and cataloguing cloud storage objects across the organisation."},{"id":"T1657","name":"Financial Theft","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Duty separation between financial system access, transaction approval, and audit functions prevents a single compromised account from executing financial theft, as adversaries must compromise multiple independently controlled roles."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting debug and memory access privileges to dedicated security roles prevents adversaries from dumping LSASS memory with standard administrative credentials, as the required SeDebugPrivilege is separated from general administration."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits access to the Security Account Manager database by restricting local admin and backup operator roles, preventing adversaries with standard accounts from extracting local credential hashes."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts NTDS.dit access to dedicated domain controller administrators, preventing adversaries with general Active Directory privileges from directly accessing the domain credential database."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to LSA secrets through role separation ensures that only dedicated security administrators can interact with the Local Security Authority, limiting adversary credential extraction from compromised service accounts."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits local administrator access needed to extract cached domain credentials, requiring adversaries to compromise specifically privileged accounts rather than using broadly distributed administrative access."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting directory replication privileges to dedicated domain controller roles prevents adversaries from performing DCSync attacks with general domain admin accounts, as the replication ACL requires a separately controlled permission."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits access to /proc filesystem entries containing credentials by restricting privileged process access to designated system administration roles, preventing standard accounts from reading sensitive process memory."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts read access to /etc/shadow through role-based access controls, preventing adversaries with standard user or application accounts from accessing hashed password files on Linux systems."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting RDP access to designated remote administration roles prevents adversaries from using compromised standard credentials for lateral movement via Remote Desktop Protocol connections to other systems."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits SMB and administrative share access to designated administration roles, preventing adversaries with standard domain accounts from accessing admin shares (C$, ADMIN$) for lateral movement."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting DCOM activation permissions to designated roles prevents adversaries from leveraging compromised standard accounts for lateral movement via Distributed Component Object Model remote instantiation."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits SSH access to designated administration roles and specific hosts, preventing adversaries from using compromised credentials for broad SSH-based lateral movement across the environment."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting WinRM access to designated management roles prevents adversaries from leveraging compromised standard credentials for remote command execution via Windows Remote Management."},{"id":"T1021.007","name":"Cloud Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Duty separation in cloud environments restricts service access by role, preventing adversaries with compromised cloud credentials from moving laterally across cloud services beyond the account's designated function."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting 'at' command usage to dedicated scheduling roles prevents adversaries with standard access from creating automated tasks for persistence or privilege escalation through the legacy scheduling mechanism."},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits cron job creation to designated automation roles, preventing adversaries from establishing cron-based persistence with standard user accounts on Linux systems."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting scheduled task creation to designated administrative roles prevents adversaries from using compromised standard accounts to establish persistence through Windows Task Scheduler."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits systemd timer creation to designated service management roles, preventing adversaries from establishing timer-based persistence on Linux systems with standard user access."},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting container orchestration job creation to dedicated platform roles prevents adversaries from scheduling malicious workloads through Kubernetes cron jobs or similar orchestration mechanisms."},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts ptrace capabilities to designated debugging roles, preventing adversaries with standard accounts from using ptrace system calls for process injection and privilege escalation."},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits administrative access to web portals, ensuring that adversaries cannot modify login pages to capture credentials without compromising a role specifically authorised for portal administration."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting PowerShell execution to designated administrative roles through constrained language mode and execution policy enforcement prevents adversaries with standard accounts from leveraging PowerShell for attacks."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts network device CLI access to dedicated network engineering roles, preventing adversaries with general infrastructure credentials from executing commands on routers and switches."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation between operational and audit roles prevents users from clearing their own Windows event logs, requiring adversaries to compromise a separate audit administration account to eliminate evidence."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separating log management from operational roles on Linux and macOS prevents adversaries from clearing system logs with the same credentials used for the initial compromise, preserving forensic evidence."},{"id":"T1070.003","name":"Clear Command History","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation ensures that command history protections are managed by designated security roles, preventing adversaries from clearing bash or PowerShell history when the compromised account lacks the necessary privileges."},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network configuration management to designated roles prevents adversaries from clearing network connection history and configurations to hide lateral movement evidence without compromising a network admin account."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts mailbox administration from standard user roles, preventing adversaries from clearing mailbox data to destroy email-based evidence without compromising a dedicated Exchange administrator account."},{"id":"T1070.009","name":"Clear Persistence","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation between persistence mechanism management and standard operations prevents adversaries from clearing persistence artifacts using the same account that established them, preserving forensic evidence."},{"id":"T1078.001","name":"Default Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties mandates that default accounts are either disabled or restricted to narrow functions, limiting the damage from default credential exploitation by ensuring these accounts lack cross-functional privileges."},{"id":"T1078.002","name":"Domain Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation ensures that domain accounts are scoped to specific functions, so compromised domain credentials provide limited access rather than the broad privileges needed for widespread lateral movement."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting local account privileges through separation of duties ensures that local accounts provide only the minimum access needed for their specific function, limiting the impact of local credential compromise."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties in cloud environments restricts cloud account permissions to designated functions, preventing a single compromised cloud account from providing broad access across cloud services and resources."},{"id":"T1087.004","name":"Cloud Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts cloud account enumeration to designated identity management roles, preventing adversaries from discovering and cataloguing cloud accounts using compromised standard cloud credentials."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud credential management to dedicated identity roles prevents adversaries from adding alternative authentication credentials to cloud accounts using compromised standard administrative access."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts email delegation management to designated mail administrators, preventing adversaries from granting additional mailbox access permissions using compromised standard accounts."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud role assignment to dedicated identity governance roles prevents adversaries from escalating privileges by granting themselves additional cloud roles through compromised standard admin accounts."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts SSH key management to designated administration roles, preventing adversaries from adding authorized SSH keys for persistence using compromised accounts that lack key management privileges."},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separating device registration from standard user capabilities prevents adversaries from registering rogue devices for persistent access using compromised end-user credentials."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting group membership management to designated identity administration roles prevents adversaries from adding compromised accounts to privileged groups for escalation without compromising the identity management function."},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits the value of password guessing success by ensuring that each account provides access only to its designated function, containing the impact of individual credential compromise."},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation ensures that even if adversaries successfully crack passwords offline, the compromised credentials provide only narrowly scoped access aligned with the account's specific organisational role."},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties mitigates password spraying by ensuring that accounts across different roles have distinct access scopes, preventing a single sprayed credential from yielding broad cross-functional access."},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits the impact of credential stuffing attacks by ensuring that reused credentials—even if valid—provide access only to the specific function assigned to each compromised account."},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts token impersonation capabilities to designated service accounts, preventing adversaries from stealing and impersonating tokens when operating under standard user roles."},{"id":"T1134.002","name":"Create Process with Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting the ability to create processes with alternate tokens to designated service roles prevents adversaries from spawning processes under different security contexts using compromised standard accounts."},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits token creation and impersonation to specific service accounts, preventing adversaries from forging and using impersonation tokens when the compromised account lacks these privileges."},{"id":"T1134.005","name":"SID-History Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting SID-History modification to dedicated domain administration roles prevents adversaries from injecting SID-History entries for privilege escalation using compromised standard Active Directory accounts."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts local account creation to designated identity management processes, preventing adversaries from establishing persistent local backdoor accounts using compromised administrative credentials."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting domain account creation to dedicated identity provisioning roles prevents adversaries from creating persistent domain accounts when they compromise general Active Directory administrative access."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Duty separation in cloud environments restricts account provisioning to designated identity management roles, preventing adversaries from creating cloud backdoor accounts using compromised standard admin credentials."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts Confluence access by role, ensuring that compromised accounts can only access wiki spaces relevant to their designated function rather than providing broad knowledge base collection."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Duty separation enforces role-based access on SharePoint sites, limiting the document libraries accessible through any single compromised account to those aligned with the account's specific organisational role."},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting code repository access by role through separation of duties prevents compromised developer accounts from accessing repositories outside their project scope, limiting source code collection opportunities."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts CRM data access by role, ensuring that compromised accounts can only access customer records relevant to their designated function rather than the full customer database."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting Msiexec execution privileges to designated deployment roles prevents adversaries from using compromised standard accounts to install malicious MSI packages for defense evasion."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts Windows ACL modification to designated security administrator roles, preventing adversaries from altering file and directory permissions with standard administrative accounts."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts chmod/chown operations on critical files to designated system administration roles, preventing adversaries from weakening Linux/macOS file permissions with standard accounts."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting mail transport agent configuration to dedicated mail administration roles prevents adversaries from installing persistent transport agents using compromised accounts with general server access."},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Duty separation between web server management and content deployment prevents adversaries from installing web shells when the compromised account lacks both file write access and web server configuration privileges."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting Terminal Services DLL registration to designated RDS administration roles prevents adversaries from installing persistent DLL-based backdoors using compromised standard server administration accounts."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts firmware update privileges to dedicated hardware management roles, preventing adversaries with standard administrative access from modifying system firmware for persistent defense evasion."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting boot configuration modification to dedicated roles prevents adversaries from installing bootkits, as the necessary firmware management privileges are separated from general system administration."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts TFTP boot configuration to dedicated network engineering roles, preventing adversaries from redirecting network device boot processes to malicious images using standard administrative access."},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Launch Agent creation to designated management roles on macOS prevents adversaries from establishing persistent launch agents using compromised standard user accounts."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits systemd service creation to designated service management roles, preventing adversaries from creating persistent systemd services with standard Linux user accounts."},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting Windows service creation and modification to designated roles prevents adversaries from establishing persistent services using compromised standard administrative credentials."},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts Launch Daemon installation to designated macOS administration roles, preventing adversaries from establishing root-level persistent daemons with standard administrative access."},{"id":"T1543.005","name":"Container Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting container service management to designated platform roles prevents adversaries from creating persistent container services using compromised standard infrastructure credentials."},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits WMI event subscription creation to designated administrative roles, preventing adversaries from establishing WMI-based persistence when the compromised account lacks WMI management privileges."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting registry modification of Winlogon Helper DLL entries to designated roles prevents adversaries from establishing persistence through login-triggered DLL loading using standard administrative accounts."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts kernel module loading to designated system engineering roles, preventing adversaries from loading malicious kernel modules or extensions without specifically privileged access."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits shortcut file modification in startup locations to designated management roles, preventing adversaries from establishing persistence through modified shortcuts using standard user access."},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting print processor registration to designated print management roles prevents adversaries from installing persistent DLLs through the print subsystem using compromised standard administrative accounts."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts XDG autostart entry creation to designated administration roles, preventing adversaries from establishing desktop login persistence on Linux systems with standard user access."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits UAC configuration and bypass capabilities, ensuring that adversaries must compromise roles with specific UAC management privileges rather than relying on standard administrative access."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting sudoers file modification to designated security roles prevents adversaries from adding sudo caching exceptions or escalating privileges through sudo configuration changes with standard admin accounts."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts TCC database modification to designated security roles, preventing adversaries from granting themselves macOS privacy permissions using compromised standard administrative access."},{"id":"T1550.002","name":"Pass the Hash","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits the lateral movement value of pass-the-hash attacks by ensuring that compromised NTLM hashes provide access only to the specific role's designated systems and resources."},{"id":"T1550.003","name":"Pass the Ticket","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting Kerberos service access by role ensures that pass-the-ticket attacks provide limited value, as forged or stolen tickets grant access only to the services assigned to the original account's role."},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation reduces the incidence of credentials in files by ensuring that each role accesses only its designated systems, limiting the propagation of stored credentials across the file system."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits registry access by role, reducing the number of accounts that can access registry locations containing credentials and ensuring that credential storage is restricted to authorised service accounts."},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting Group Policy Preferences management to dedicated domain administration roles limits the exposure of credentials stored in GPP by ensuring that only authorised administrators can create or access these policy objects."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts container API access to designated orchestration roles, preventing adversaries with standard container access from querying API endpoints that expose service account credentials."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Separating domain controller authentication management from general domain administration prevents adversaries from modifying the DC authentication process to install credential-harvesting hooks without compromising dedicated security infrastructure roles."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts PAM configuration to dedicated security roles, preventing adversaries from inserting malicious pluggable authentication modules using compromised standard root or administrative accounts."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device authentication configuration to dedicated roles prevents adversaries from modifying AAA mechanisms on routers and switches using compromised general network management credentials."},{"id":"T1556.005","name":"Reversible Encryption","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts encryption policy management, preventing adversaries from enabling reversible encryption storage of passwords without compromising the dedicated security policy administration role."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting conditional access policy management to dedicated identity governance roles prevents adversaries from weakening authentication requirements through policy modification using compromised standard admin accounts."},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits access to the KRBTGT account and KDC infrastructure, ensuring that golden ticket creation requires compromising the dedicated domain controller management role rather than general domain admin access."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts service account credential management to dedicated roles, limiting adversary access to the keying material needed for silver ticket forgery."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting service account management to dedicated identity roles enables strong password policies and monitoring that reduce the effectiveness of Kerberoasting against accounts managed through the separated duty process."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits COM object registration and modification to designated roles, preventing adversaries from leveraging COM-based execution techniques when the compromised account lacks COM configuration privileges."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separating security tool management from operational roles ensures that adversaries cannot disable or modify endpoint protection tools without compromising a dedicated security administration account."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts event logging configuration to designated security roles, preventing adversaries from disabling Windows event logging using compromised standard administrative accounts."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting firewall management to dedicated network security roles prevents adversaries from modifying or disabling system firewalls to facilitate lateral movement using compromised standard accounts."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties ensures that indicator blocking requires compromising security tool administration accounts, preventing adversaries from suppressing security alerts using standard operational credentials."},{"id":"T1562.007","name":"Disable or Modify Cloud Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud firewall management to dedicated cloud security roles prevents adversaries from modifying cloud network security groups and firewall rules using compromised standard cloud accounts."},{"id":"T1562.008","name":"Disable or Modify Cloud Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts cloud logging configuration to dedicated security roles, preventing adversaries from disabling or redirecting cloud audit logs using compromised standard cloud administrative accounts."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits boot configuration modification to designated roles, preventing adversaries from forcing safe mode boot to disable security tools using compromised standard administrative access."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting SSH session management to designated roles prevents adversaries from hijacking existing SSH sessions when the compromised account lacks the process control privileges needed for session attachment."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Duty separation restricts remote desktop session management, preventing adversaries from hijacking disconnected RDP sessions without compromising an account with specific session administration privileges."},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Restricting launchctl usage to designated macOS administration roles prevents adversaries from loading or unloading services using compromised standard user credentials."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties limits service execution privileges to designated roles, preventing adversaries from launching processes via the Service Control Manager using compromised standard administrative accounts."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting dylib installation and modification to designated roles prevents adversaries from hijacking macOS dynamic library loading when the compromised account lacks write access to library search paths."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits file permission management, preventing adversaries from exploiting weak installer permissions to plant malicious executables without compromising a role with specific file system privileges."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts PATH environment variable modification to designated roles, preventing adversaries from intercepting execution through PATH manipulation using compromised standard accounts."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting write access to DLL search order paths to designated roles prevents adversaries from planting malicious libraries for search order hijacking without specifically privileged file system access."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits service configuration management, preventing adversaries from exploiting unquoted service paths for privilege escalation without compromising a role with service configuration privileges."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting service file permissions management to designated roles prevents adversaries from exploiting weak service executable permissions to replace binaries for execution flow hijacking."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts COR_PROFILER environment variable modification to designated .NET management roles, preventing adversaries from loading profiler DLLs for persistence using standard accounts."},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud snapshot creation to designated roles prevents adversaries from creating snapshots of production volumes for offline data extraction or forensic evasion using compromised standard cloud accounts."},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation limits cloud instance creation to designated infrastructure roles, preventing adversaries from spinning up new compute instances in the environment using compromised standard cloud credentials."},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting cloud instance deletion to designated roles prevents adversaries from destroying evidence by deleting compromised cloud instances using standard cloud accounts that lack infrastructure management privileges."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Separation of duties restricts NAT and routing configuration to dedicated network engineering roles, preventing adversaries from traversing network boundaries through NAT manipulation using general network credentials."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting network device firmware operations to dedicated engineering roles prevents adversaries from patching system images using compromised general management credentials, requiring separately controlled access."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Duty separation ensures that firmware downgrade operations require dedicated engineering credentials, preventing adversaries from reverting network devices to vulnerable firmware versions using standard administrative access."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-004","SP-013","SP-028","SP-029","SP-034","SP-037","SP-044","SP-045","SP-047","SP-049","SP-051","SP-053","SP-054"]}}