{"data":{"id":"CM-05","name":"Access Restrictions for Change","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.","supplemental_guidance":"Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see AC-03 and PE-03), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).","enhancements":[{"id":"CM-05(01)","name":"Automated Access Enforcement and Audit Records","statement":"a. Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and\nb. Automatically generate audit records of the enforcement actions.","baselines":["high"]},{"id":"CM-05(02)","name":"Review System Changes","withdrawn":true,"incorporated_into":["CM-03(07)"]},{"id":"CM-05(03)","name":"Signed Components","withdrawn":true,"incorporated_into":["CM-14"]},{"id":"CM-05(04)","name":"Dual Authorization","statement":"Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].","baselines":[]},{"id":"CM-05(05)","name":"Privilege Limitation for Production and Operation","statement":"a. Limit privileges to change system components and system-related information within a production or operational environment; and\nb. Review and reevaluate privileges [Assignment: organization-defined frequency].","baselines":[]},{"id":"CM-05(06)","name":"Limit Library Privileges","statement":"Limit privileges to change software resident within software libraries.","baselines":[]},{"id":"CM-05(07)","name":"Automatic Implementation of Security Safeguards","withdrawn":true,"incorporated_into":["SI-07"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-05","name":"Access Restrictions for Change","description":"Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.","discussion":"Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see AC-03 and PE-03), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).","related_controls":["AC-03","AC-05","AC-06","CM-09","PE-03","SC-28","SC-34","SC-37","SI-02","SI-10"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.8.2","A.8.4","A.8.9","A.8.19","A.8.31","A.8.32"],"iso_27002_2022":["5.37","8.4","8.9","8.19","8.32"],"cobit_2019":["BAI06","BAI10"],"pci_dss_v4":["6.5"],"nist_csf_2":["PR.PS-01"],"cis_controls_v8":["CIS 4.6","CIS 12.3"],"soc2_tsc":[],"finos_ccc":["CCC-C07"],"iso_42001_2023":["A.6.2.5"],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.2"],"anssi":["Hygiene.15","Hygiene.16","Hygiene.17","Hygiene.34","SecNumCloud.13.2"],"osfi_b13":["B-13.2.3","B-13.3.2"],"finma_circular":["IV.A(36)","IV.A(37)","IV.B.d(59)"],"gdpr":["Art.32(1)(b)"],"dora":["Art.9(4)(c)","Art.9(4)(e)"],"bio2":["5.37","8.4","8.9","8.19","8.32"],"rbi_csf":["Annex1.7","ITGRCA.13"],"fisc":["FISC.O3"],"lgpd_bcb":[],"hkma_tme1":["TME1.3.3","TME1.4.1","TME1.4.2"],"mlps_2":["8.1.5.1","8.1.10.8"],"dnb_good_practice":["DNB.7.1","DNB.10.1","DNB.10.5"],"cra":[],"swift_cscf":["SWIFT.6.2"],"cbb_tm":["TM-5"],"cbuae":["CR-7"],"nca_ecc":["2-3"],"qatar_nia":["OS","SD"],"sama_csf":["3.5"],"uae_ia":["T7","T10"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.6"],"cbe_csf":["CTO-12"],"cbn_csf":["Part3.3"],"sa_js2":["JS2-7.2"],"bot_cyber":["Ch2.1"],"cpmi_pfmi":["CG.PR"],"eba_ict":["3.4.4","3.6.3"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.7(c)","II.C.10"],"iosco_cyber":["PROT-6"],"sebi_cscrf":["PR.IP"],"cmmc_2":["CM"],"nerc_cip":[],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":[],"ieee_1686":["5.4"],"ferc_cip":[],"doe_c2m2":["ASSET"],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":["B"],"fips_140":["FIPS 140-3 §7.11"],"cbest":[],"tiber_eu":[],"pci_hsm":["4"],"common_criteria":["CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.6.2","SYSC 13.7.4"],"fda_21_cfr_11":["§11.10(k)"],"fda_cyber":["SA-3"],"hitrust_csf":["09.a"],"iso_27799":[],"lloyds_ms":["MS5.1","MS8.4"],"naic_ds":["4-config"],"nhs_dspt":["NDG-4.4"],"pra_ss1_23":["P3.3","P3.4"],"solvency_ii":["EIOPA-ICT-4.8","EIOPA-ICT-4.11"],"owasp_masvs_v2":[],"csa_ccm_v4":["CCC-03","CCC-04"],"csa_aicm":["CCC-03","CCC-04","IAM-19","MDS-04","MDS-07"],"ccss_v9":["1.01.3"],"mica":[],"basel_sco60":["SCO60.52","SCO60.66"],"bssc":["GSP-14","TIS-08"],"sec_custody_digital":["SEC-CD-05"],"dpdpa":[]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to credential-storing components—domain controllers, authentication databases, and security hives—through physical and logical access controls prevents unauthorized modification or extraction of OS credential stores."},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on change operations limit which administrators can configure remote service endpoints, preventing adversaries from enabling or reconfiguring remote services (RDP, SSH, WinRM) for unauthorized lateral movement."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Enforcing change access restrictions on WMI namespaces and remote management configurations limits who can modify WMI settings, preventing adversaries from enabling or exploiting WMI for unauthorized remote code execution."},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on task scheduler configurations—requiring approval and audit trails for scheduled job creation—prevent adversaries from creating persistent scheduled tasks without authorized change management oversight."},{"id":"T1055","name":"Process Injection","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to process creation and debugging interfaces through change management controls limits adversaries' ability to modify system configurations that would enable process injection techniques."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Change access restrictions that control who can modify script execution policies, interpreter configurations, and application control rules prevent adversaries from weakening script execution controls to enable malicious command execution."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on software deployment tool configurations—limiting administrative access and requiring change approval for deployment package modifications—prevent adversaries from abusing enterprise deployment systems for lateral code distribution."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that restrict who can modify authentication policies, account settings, and access control configurations prevent adversaries from weakening security settings to facilitate use of compromised valid accounts."},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on identity management systems that require authorized approval for account privilege changes, role assignments, and credential modifications prevent adversaries from silently manipulating accounts to maintain persistent elevated access."},{"id":"T1134","name":"Access Token Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting access to security policy configurations that govern token creation, impersonation privileges, and UAC settings prevents adversaries from modifying these configurations to enable access token manipulation for privilege escalation."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict account provisioning to authorized personnel through formal approval workflows prevent adversaries from creating unauthorized local, domain, or cloud accounts for persistent access."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on browser configuration management—controlling who can install extensions and modify browser policies—prevent adversaries from installing malicious browser extensions through unauthorized changes to browser security settings."},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to browser configurations and web application components prevents adversaries from modifying browser settings or injecting scripts that enable session hijacking of authenticated web sessions."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on change operations for public-facing application configurations ensure that only authorized personnel can modify web application settings, reducing the risk of introducing exploitable vulnerabilities."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that enforce code review, integrity verification, and approval workflows for software acquisitions prevent compromised supply chain components from being introduced without proper validation."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions that limit BITS job configuration to authorized change processes prevent adversaries from abusing Background Intelligent Transfer Service for stealthy file downloads and persistence outside normal change windows."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to network service configurations ensures security patches and hardening settings are applied through authorized processes, reducing exploitable vulnerabilities in remote services."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on information repository configurations—controlling who can modify permissions, sharing settings, and access policies—prevent adversaries from weakening repository security to facilitate data collection."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict modification of application control policies prevent adversaries from whitelisting or enabling system binary proxy execution paths that bypass security controls."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on permission modification operations—requiring elevated privileges and audit trails for ACL changes—prevent adversaries from weakening file and directory permissions to access protected resources."},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to Group Policy Objects and cloud tenant policies through formal approval workflows and separation of duties prevents adversaries from modifying domain or tenant policies to weaken security controls."},{"id":"T1489","name":"Service Stop","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on service management operations prevent unauthorized users from stopping critical security services, ensuring adversaries cannot disable protective services without triggering change management alerts."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict firmware modification to authorized maintenance processes with integrity validation prevent adversaries from corrupting device firmware through unauthorized write operations."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on server software configuration changes—web server modules, database components, and middleware—prevent adversaries from installing persistent server software components without authorized approval."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that restrict container image registry modifications and require signed image promotion workflows prevent adversaries from implanting malicious code in internal container images."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on OAuth application registration and token management configurations prevent adversaries from modifying application permissions to enable unauthorized token theft or scope expansion."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on cloud storage configurations—bucket policies, access controls, and encryption settings—prevent adversaries from weakening cloud storage security to access sensitive data."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud data transfer and replication configurations prevent adversaries from modifying cross-account transfer policies to enable data exfiltration to attacker-controlled cloud accounts."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to boot configuration, firmware settings, and UEFI policies through physical and logical controls prevents adversaries from modifying pre-OS boot mechanisms for persistent access."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on system process creation and service management—requiring administrative approval for new service installations—prevent adversaries from creating or modifying system processes for persistence."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that restrict modification of elevation mechanisms (UAC, sudo, setuid configurations) prevent adversaries from weakening privilege escalation controls through unauthorized configuration changes."},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on authentication configuration changes—Kerberos settings, NTLM policies, token management—prevent adversaries from weakening authentication controls to facilitate use of alternate authentication material."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on credential storage locations—configuration files, registries, and key stores—prevent adversaries from accessing or modifying unsecured credential repositories through unauthorized system changes."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on certificate store management and code signing policy modifications prevent adversaries from subverting trust controls by installing unauthorized certificates or weakening signing requirements."},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that enforce integrity verification and access restrictions on software installation directories prevent adversaries from replacing legitimate binaries with compromised versions."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on authentication infrastructure components—PAM modules, password filters, authentication DLLs—prevent adversaries from modifying the authentication process through unauthorized changes to authentication libraries."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to Kerberos configuration settings—encryption types, ticket policies, delegation permissions—prevents adversaries from weakening Kerberos security to facilitate ticket theft or forgery."},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict COM object registration and IPC mechanism configurations prevent adversaries from modifying inter-process communication settings to enable unauthorized code execution."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions that prevent unauthorized modification of security tool configurations, audit policies, and firewall rules ensure adversaries cannot impair defensive capabilities through unauthorized change operations."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on remote service session configurations—timeout policies, reconnection settings, authentication requirements—prevent adversaries from modifying settings to facilitate session hijacking."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on service creation and management operations prevent adversaries from registering and executing malicious services without proper change management approval and audit trails."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict modification of DLL search paths, service binary paths, and library configurations prevent adversaries from altering execution flow settings to load malicious code."},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud infrastructure modifications—requiring IAM-controlled approval for instance creation, snapshot operations, and configuration changes—prevent adversaries from manipulating cloud compute resources for defense evasion."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to network device routing and NAT configurations through role-based access controls and configuration management prevents adversaries from bridging network boundaries through unauthorized device modifications."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on network device firmware and image management—requiring authenticated access and integrity verification for modifications—prevent adversaries from altering system images for persistent infrastructure compromise."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that restrict container runtime configuration modifications—privileged mode, capabilities, namespace settings—prevent adversaries from weakening container isolation to enable host escape."},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud storage enumeration APIs and resource discovery interfaces limit the information adversaries can gather about cloud storage object structures during reconnaissance."},{"id":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict modification of MFA policies, enrollment settings, and authentication challenge configurations prevent adversaries from weakening MFA enforcement to enable brute-force MFA prompt generation."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions that limit who can modify macOS plist files through change management controls prevent adversaries from altering system behavior or disabling security features through unauthorized property list modifications."},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on LSASS configuration changes—Credential Guard settings, PPL enforcement, debug privilege assignments—prevent adversaries from weakening LSASS protections to enable memory-based credential extraction."},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to SAM database configurations and local security policy settings prevents adversaries from modifying protections that guard the Security Account Manager credential store."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on domain controller management operations—NTDS maintenance tools, Volume Shadow Copy access, directory replication permissions—prevent unauthorized extraction of the Active Directory database."},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that restrict access to LSA configuration and service account credential storage prevent adversaries from modifying protections that guard LSA Secrets containing cached credentials."},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cached credential configuration policies—CachedLogonsCount settings and credential cache protection—prevent adversaries from increasing the number of extractable cached domain credentials."},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Restricting change access to Active Directory replication permissions and AdminSDHolder configurations prevents adversaries from granting themselves DCSync replication rights to extract domain credential databases."},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on /proc filesystem mount options and mandatory access control configurations prevent adversaries from modifying system settings to enable credential extraction from process memory on Linux."},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change management controls that restrict modification of password file permissions and authentication configuration on Linux systems prevent adversaries from weakening protections on /etc/shadow to access password hashes."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on network device SPAN and port mirroring configurations prevent adversaries from modifying switch settings to duplicate and exfiltrate network traffic without authorization."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on RDP configuration settings—NLA requirements, allowed user groups, session policies—prevent adversaries from enabling or weakening Remote Desktop Protocol settings for lateral movement."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on SMB share configuration and administrative share settings prevent adversaries from modifying share permissions or re-enabling default administrative shares for lateral movement."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on DCOM launch permissions and firewall rules prevent adversaries from modifying Distributed Component Object Model settings to enable remote COM-based lateral movement."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on SSH server configuration changes—authentication methods, key management, access control lists—prevent adversaries from weakening SSH settings to facilitate unauthorized remote access."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on VNC service configuration and authentication settings prevent adversaries from enabling or modifying Virtual Network Computing services for unauthorized graphical remote access."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on WinRM configuration changes—listener settings, authentication methods, trusted host lists—prevent adversaries from enabling or weakening Windows Remote Management for lateral movement."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on cloud VM access configurations—serial console settings, bastion host policies, IAM role assignments—prevent adversaries from enabling direct cloud VM connections bypassing security controls."},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on at scheduler configuration and the atd service prevent adversaries from creating at-based scheduled tasks without proper authorization, limiting persistent task scheduling through this utility."},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on cron configuration directories and crontab modification permissions prevent adversaries from creating unauthorized cron jobs for persistent execution on Unix/Linux systems."},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Windows Task Scheduler that limit who can create and modify scheduled tasks through schtasks.exe and the Task Scheduler UI prevent unauthorized persistent task creation for adversary execution."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls restricting systemd timer file creation and modification prevent adversaries from deploying unauthorized systemd timers for persistent scheduled code execution on Linux systems."},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on container orchestration job creation—Kubernetes CronJobs, batch jobs—prevent adversaries from scheduling persistent container workloads for unauthorized code execution within orchestrated environments."},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict ptrace capability assignments and kernel security parameter modifications prevent adversaries from enabling ptrace-based process injection on Linux systems."},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on web application configuration changes prevent adversaries from modifying web portal login pages to inject credential-capturing scripts or redirect authentication flows."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on PowerShell execution policy settings, constrained language mode configuration, and script signing requirements prevent adversaries from weakening PowerShell security controls."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Python runtime installation and environment configuration prevent adversaries from deploying or modifying Python interpreters to enable malicious script execution on managed systems."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on network device CLI configuration—role-based access, command authorization policies, and management interface settings—prevent adversaries from modifying device access controls to enable unauthorized command execution."},{"id":"T1078.002","name":"Domain Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on domain account policy modifications—password policies, authentication settings, MFA configurations—prevent adversaries from weakening domain-level security controls that protect domain account integrity."},{"id":"T1078.003","name":"Local Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on local account configurations—LAPS settings, default account policies, local password requirements—prevent adversaries from modifying local account security to leverage compromised credentials."},{"id":"T1078.004","name":"Cloud Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud IAM policy modifications—conditional access rules, MFA requirements, session policies—prevent adversaries from weakening cloud authentication controls to exploit compromised cloud accounts."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on cloud IAM credential management—API key creation, service principal configuration, access key rotation—prevent adversaries from adding unauthorized cloud credentials for persistent access."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Exchange mailbox delegation and permission management prevent adversaries from assigning unauthorized email delegate permissions for persistent access to sensitive communications."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on cloud role assignment operations—requiring multi-party approval and audit trails—prevent adversaries from escalating privileges through unauthorized cloud role modifications."},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on SSH key management—authorized_keys file modifications, SSH certificate authority changes—prevent adversaries from adding unauthorized public keys for persistent SSH access."},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on device enrollment and registration policies prevent adversaries from registering unauthorized devices that gain persistent access to organizational resources."},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on group membership management—local administrator groups, domain security groups—prevent adversaries from adding accounts to privileged groups without authorized approval."},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on security policies governing impersonation privileges and token manipulation rights prevent adversaries from modifying configurations that would enable token impersonation or theft."},{"id":"T1134.002","name":"Create Process with Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on security policy settings that govern process creation with alternate tokens prevent adversaries from modifying privilege assignments that enable creating processes under stolen token contexts."},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on LogonUser API access policies and impersonation privilege assignments prevent adversaries from modifying configurations that would enable unauthorized token creation and impersonation."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on local account creation—requiring administrative authorization and audit logging—prevent adversaries from creating unauthorized local accounts for persistent access to individual systems."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on Active Directory account provisioning—requiring delegated OU permissions and approval workflows—prevent adversaries from creating unauthorized domain accounts for persistent access."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud identity provisioning—IAM policies requiring approval for new accounts and service principals—prevent adversaries from creating unauthorized cloud accounts for persistent access."},{"id":"T1137.002","name":"Office Test","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict modification of Office registry keys and test paths prevent adversaries from configuring the Office Test persistence mechanism to execute arbitrary DLLs on application startup."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on development tool configurations, dependency management, and build pipeline changes ensure that software supply chain modifications undergo proper review and integrity verification."},{"id":"T1195.003","name":"Compromise Hardware Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on hardware procurement and provisioning processes—requiring integrity verification and chain-of-custody documentation—reduce the risk of compromised hardware entering the supply chain."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Confluence space administration and permission configurations prevent adversaries from modifying access controls to enable unauthorized data collection from Confluence knowledge bases."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on SharePoint site permissions, sharing configurations, and access policies prevent adversaries from weakening repository security to facilitate data harvesting from SharePoint."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on messaging application administration—channel permissions, integration configurations, data export settings—prevent adversaries from modifying access controls to collect sensitive messages."},{"id":"T1218.007","name":"Msiexec","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict MSI package installation sources and signing requirements prevent adversaries from using msiexec to execute unauthorized Windows Installer packages for defense evasion."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Electron application installation and update mechanisms prevent adversaries from deploying malicious Electron-based applications that leverage Node.js for defense evasion."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls that restrict who can modify Windows file and directory ACLs prevent adversaries from weakening NTFS permissions to access protected resources or plant malicious files."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Linux/Mac file permission modifications—requiring elevated privileges for chmod/chown on critical paths—prevent adversaries from weakening file system protections to access restricted resources."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on Exchange transport agent deployment prevent adversaries from installing unauthorized mail transport agents that intercept or manipulate email communications for persistence."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on firmware update processes—requiring physical access, signed updates, and administrative authorization—prevent adversaries from modifying UEFI/BIOS firmware for persistent pre-OS compromise."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on boot configuration and bootloader management prevent adversaries from modifying the boot process to install bootkits that execute before operating system security controls load."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on network device ROM Monitor configurations and firmware management prevent adversaries from modifying ROMMON to install persistent backdoors on network infrastructure equipment."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on TFTP boot configurations and boot image repositories prevent adversaries from replacing network device boot images with malicious versions through unauthorized TFTP modifications."},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on macOS Launch Agent configuration directories and plist files prevent adversaries from creating unauthorized launch agents for persistent code execution on macOS systems."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls restricting systemd service unit file creation and modification prevent adversaries from creating or altering systemd services for persistent execution and privilege escalation."},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Windows service creation and configuration—requiring administrative authorization for sc.exe and service registry modifications—prevent adversaries from installing malicious Windows services."},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on macOS Launch Daemon configuration directories prevent adversaries from creating unauthorized launch daemons that execute with root privileges for persistent access."},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on WMI event subscription management prevent adversaries from creating unauthorized permanent WMI event consumers that trigger malicious code execution in response to system events."},{"id":"T1546.016","name":"Installer Packages","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on software installation processes and package deployment prevent adversaries from embedding malicious actions in installer packages executed during authorized installation workflows."},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Windows Time service provider DLL registration prevent adversaries from modifying time provider configurations to load malicious DLLs through the W32Time service at boot."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on Winlogon registry keys prevent adversaries from modifying Winlogon Helper DLL entries to load malicious code during the Windows logon process for persistent execution."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on kernel module installation and signing policy management prevent adversaries from loading unauthorized kernel modules or extensions for rootkit-level persistence and privilege escalation."},{"id":"T1547.007","name":"Re-opened Applications","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on macOS LoginWindow configuration and application re-open settings prevent adversaries from configuring malicious applications to automatically restart after login."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on startup folder contents and shortcut file modification prevent adversaries from planting or modifying shortcuts that execute malicious payloads during user logon sequences."},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on print processor DLL registration and print spooler configuration prevent adversaries from installing malicious print processors that execute code with SYSTEM privileges."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on XDG autostart directories and .desktop file creation prevent adversaries from establishing unauthorized autostart entries on Linux desktop environments for persistent execution."},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on UAC configuration settings and auto-elevation policies prevent adversaries from weakening User Account Control protections to enable privilege escalation bypass."},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on sudoers file modification and sudo configuration prevent adversaries from altering sudo policies to enable unauthorized privilege escalation or cache credential reuse."},{"id":"T1548.005","name":"Temporary Elevated Cloud Access","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on cloud IAM policies governing temporary elevated access prevent adversaries from abusing just-in-time privilege mechanisms to obtain persistent elevated cloud permissions."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on TCC database modification and macOS privacy permission configurations prevent adversaries from manipulating Transparency, Consent, and Control settings to bypass privacy protections."},{"id":"T1550.002","name":"Pass the Hash","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on NTLM authentication policy settings and Credential Guard configurations prevent adversaries from weakening hash protection measures that guard against pass-the-hash attacks."},{"id":"T1550.003","name":"Pass the Ticket","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Kerberos configuration changes—ticket lifetime policies, delegation settings, encryption requirements—prevent adversaries from weakening Kerberos security to facilitate pass-the-ticket attacks."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on registry permissions for credential-storing keys prevent adversaries from accessing or modifying registry-stored credentials through unauthorized configuration changes."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on container orchestration API configurations and service account management prevent adversaries from modifying RBAC policies to enable credential extraction through container APIs."},{"id":"T1553.006","name":"Code Signing Policy Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on code signing policy configurations prevent adversaries from modifying signing requirements to allow execution of unsigned or maliciously signed code."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on domain controller authentication module management prevent adversaries from modifying authentication DLLs or installing skeleton key mechanisms through unauthorized changes to DC configurations."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on PAM configuration directories and module installations prevent adversaries from modifying Pluggable Authentication Module configurations to bypass authentication or capture credentials."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on network device authentication configuration changes—TACACS+, RADIUS, local databases—prevent adversaries from modifying network device authentication to establish backdoor access."},{"id":"T1556.008","name":"Network Provider DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on Network Provider DLL registration and authentication pipeline configurations prevent adversaries from installing malicious network providers that intercept credentials during logon."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on conditional access policy management in identity platforms prevent adversaries from modifying or disabling conditional access rules to weaken authentication enforcement."},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on KRBTGT account management and Kerberos policy configurations prevent adversaries from accessing the material needed to forge golden tickets for domain-wide authentication."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on service account management and Kerberos service ticket configurations prevent adversaries from obtaining the material required for silver ticket forgery against individual services."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on service account configurations—managed identities, SPN assignments, encryption type settings—prevent adversaries from weakening Kerberos encryption to facilitate Kerberoasting attacks."},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on COM object registration and DCOM permission configurations prevent adversaries from modifying Component Object Model settings to enable unauthorized inter-process code execution."},{"id":"T1559.003","name":"XPC Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on XPC service entitlements and inter-process communication policies prevent adversaries from modifying macOS IPC configurations to enable unauthorized service-to-service command execution."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions that prevent unauthorized modification or removal of security tools ensure adversaries cannot disable endpoint protection, antivirus, or EDR agents through unauthorized change operations."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on Windows event logging configuration—audit policies, EventLog service settings, log retention—prevent adversaries from disabling event logging through unauthorized configuration changes."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on firewall management operations prevent adversaries from disabling or modifying host-based or network firewall rules to enable unauthorized inbound or outbound traffic flows."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on ETW provider configurations and event tracing pipeline settings prevent adversaries from modifying telemetry sources to block indicator generation and evade security monitoring."},{"id":"T1562.007","name":"Disable or Modify Cloud Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud firewall and security group configurations—requiring IAM authorization and change approval—prevent adversaries from modifying cloud network security rules to bypass cloud-level filtering."},{"id":"T1562.008","name":"Disable or Modify Cloud Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on cloud logging configurations—CloudTrail, Azure Activity Log, GCP Audit Logs—prevent adversaries from disabling or modifying cloud audit logging to operate undetected."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on boot configuration settings prevent adversaries from modifying BCD to force safe mode boot, which would disable security tools that only load during normal boot sequences."},{"id":"T1562.011","name":"Spoof Security Alerting","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on SIEM alerting configurations, notification channels, and alert routing rules prevent adversaries from modifying security alerting to suppress or redirect incident notifications."},{"id":"T1562.012","name":"Disable or Modify Linux Audit System","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on Linux audit daemon configurations (auditd) and audit rule management prevent adversaries from disabling or modifying the audit system to evade detection of their activities."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on SSH session configuration—multiplexing, agent forwarding, session timeout settings—prevent adversaries from modifying SSH settings to facilitate session hijacking for lateral movement."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on RDP session policy configurations—reconnection settings, timeout policies, authentication requirements—prevent adversaries from weakening RDP security to enable session hijacking."},{"id":"T1564.008","name":"Email Hiding Rules","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on email rule management prevent adversaries from creating hidden mailbox rules that automatically move or delete messages to conceal evidence of compromise or data collection."},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on launchctl service management operations prevent adversaries from using launchctl to execute unauthorized services or daemons on macOS without proper administrative authorization."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on Windows service installation and execution—requiring administrative authorization for service creation via sc.exe—prevent adversaries from executing code through the service control mechanism."},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on installer file and directory permissions prevent adversaries from exploiting weak file permissions on executable installers to replace legitimate binaries with malicious versions."},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on service executable file permissions prevent adversaries from exploiting weak service file permissions to replace service binaries with malicious executables for persistent code execution."},{"id":"T1574.011","name":"Services Registry Permissions Weakness","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on service registry key permissions prevent adversaries from modifying service registry entries to point service image paths to malicious executables through registry permission weaknesses."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on .NET profiling environment variables and COR_PROFILER registry settings prevent adversaries from configuring malicious .NET profiler DLLs that execute within CLR-hosted processes."},{"id":"T1574.014","name":"AppDomainManager","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on .NET configuration file management and AppDomainManager settings prevent adversaries from modifying application domain configurations to load malicious assemblies during .NET application initialization."},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on cloud snapshot operations—requiring IAM authorization and audit logging—prevent adversaries from creating unauthorized VM snapshots to extract data or clone infrastructure for analysis."},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on cloud instance creation—requiring approval workflows and IAM policies—prevent adversaries from provisioning unauthorized cloud instances configured to bypass security controls."},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change management controls on cloud instance deletion operations—requiring authorization and audit trails—prevent adversaries from destroying evidence or disrupting operations by deleting cloud compute resources."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on network device NAT configuration changes prevent adversaries from modifying Network Address Translation rules to enable unauthorized network boundary traversal and traffic redirection."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Change access controls on network device firmware management—requiring authenticated access and integrity verification—prevent adversaries from patching system images to inject persistent backdoors."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Access restrictions on firmware version management and downgrade operations prevent adversaries from reverting network device firmware to older versions containing known exploitable vulnerabilities."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.8.2, A.8.31 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.PS-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-008","SP-011","SP-023","SP-025","SP-029","SP-037"]}}