{"data":{"id":"SI-07","name":"Software, Firmware, and Information Integrity","family":"SI","family_name":"System and Information Integrity","withdrawn":false,"description":"a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and\nb. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].","supplemental_guidance":"Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.","enhancements":[{"id":"SI-07(01)","name":"Integrity Checks","statement":"Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].","baselines":["moderate","high"]},{"id":"SI-07(02)","name":"Automated Notifications of Integrity Violations","statement":"Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.","baselines":["high"]},{"id":"SI-07(03)","name":"Centrally Managed Integrity Tools","statement":"Employ centrally managed integrity verification tools.","baselines":[]},{"id":"SI-07(04)","name":"Tamper-evident Packaging","withdrawn":true,"incorporated_into":["SR-09"]},{"id":"SI-07(05)","name":"Automated Response to Integrity Violations","statement":"Automatically [Selection (one or more): shut the system down; restart the system; implement [Assignment: organization-defined controls]] when integrity violations are discovered.","baselines":["high"]},{"id":"SI-07(06)","name":"Cryptographic Protection","statement":"Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.","baselines":[]},{"id":"SI-07(07)","name":"Integration of Detection and Response","statement":"Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].","baselines":["moderate","high"]},{"id":"SI-07(08)","name":"Auditing Capability for Significant Events","statement":"Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].","baselines":[]},{"id":"SI-07(09)","name":"Verify Boot Process","statement":"Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].","baselines":[]},{"id":"SI-07(10)","name":"Protection of Boot Firmware","statement":"Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].","baselines":[]},{"id":"SI-07(11)","name":"Confined Environments with Limited Privileges","withdrawn":true,"incorporated_into":["CM-07(06)"]},{"id":"SI-07(12)","name":"Integrity Verification","statement":"Require that the integrity of the following software be verified prior to execution: [Assignment: organization-defined software].","baselines":[]},{"id":"SI-07(13)","name":"Code Execution in Protected Environments","withdrawn":true,"incorporated_into":["CM-07(07)"]},{"id":"SI-07(14)","name":"Binary or Machine Executable Code","withdrawn":true,"incorporated_into":["CM-07(08)"]},{"id":"SI-07(15)","name":"Code Authentication","statement":"Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].","baselines":["high"]},{"id":"SI-07(16)","name":"Time Limit on Process Execution Without Supervision","statement":"Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].","baselines":[]},{"id":"SI-07(17)","name":"Runtime Application Self-protection","statement":"Implement [Assignment: organization-defined controls] for application self-protection at runtime.","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SI-07","name":"Software, Firmware, and Information Integrity","description":"a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information]; and\nb. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].","discussion":"Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.","related_controls":["AC-04","CM-03","CM-07","CM-08","MA-03","MA-04","RA-05","SA-08","SA-09","SA-10","SC-08","SC-12","SC-13","SC-28","SC-37","SI-03","SR-03","SR-04","SR-05","SR-06","SR-09","SR-10","SR-11"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Control text adds requirement to take actions when unauthorized changes are detected Parameter added for specifying organization-defined actions Discussion includes additional examples"}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":["11.5","11.6"],"nist_csf_2":["DE.CM-09","ID.RA-09","PR.DS-01","PR.DS-02","PR.DS-10","PR.PS-02","RC.RP-03","RC.RP-05"],"cis_controls_v8":["CIS 13.2","CIS 13.7"],"soc2_tsc":["CC6.6","CC6.6-POF2","CC6.8"],"finos_ccc":[],"iso_42001_2023":["A.6.2.4","A.6.2.6"],"iec_62443":["3-3 SR 3.1","3-3 SR 3.4"],"asd_e8":["E8-3 ML3"],"nis2":[],"apra_cps_234":["Para 22-23"],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.20","Hygiene.34","SecNumCloud.13.6"],"osfi_b13":["B-13.3.2","B-13.3.3"],"finma_circular":["IV.B.d(59)","IV.C(64)","IV.D(78)"],"gdpr":["Art.5(1)(d)","Art.5(1)(f)","Art.32(1)(b)"],"dora":["Art.9(4)(b)","Art.9(4)(e)"],"bio2":[],"rbi_csf":["Annex1.5","Annex1.13"],"fisc":["FISC.T7","FISC.T12","FISC.T14"],"lgpd_bcb":["BCB.Art.3","LGPD.Art.46"],"hkma_tme1":["TME1.4.3","TME1.7.3","TME1.10.2"],"mlps_2":["8.1.2.3","8.1.3.6","8.1.4.4","8.1.4.6","8.1.4.7"],"dnb_good_practice":[],"cra":["CRA.I.2b","CRA.I.2c","CRA.I.2f","CRA.II.7"],"swift_cscf":["SWIFT.6.2","SWIFT.6.3"],"cbuae":["CR-7"],"nca_ecc":["2-3","5-1"],"qatar_nia":["OS"],"sama_csf":["3.3"],"uae_ia":["T7"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.6"],"cbe_csf":["CTO-7"],"cbn_csf":["Part3.3"],"popia":["s16","s19"],"sa_js2":["JS2-7.2","JS2-8.4","JS2-8.5"],"bcbs_239":["Principle 3","Principle 7"],"bot_cyber":["Ch2.6","Ch9.1"],"cpmi_pfmi":["CG.DE","CG.PR","PFMI.P17"],"eba_ict":["3.4.4"],"ecb_croe":["CROE.2.3.3","CROE.2.4"],"ffiec_is":["II.C.12","III.B"],"hipaa_sr":["§164.312(c)(1)","§164.312(c)(2)","§164.312(e)(2)(i)"],"iosco_cyber":["PROT-3","PROT-6","RR-3","TEST-5"],"nydfs_500":["500.8"],"sebi_cscrf":["PR.ES","PR.IP"],"cmmc_2":["SI"],"nerc_cip":[],"nrc_73_54":["RG5.71-A-SI"],"tsa_psd":[],"ieee_1686":["5.3"],"ferc_cip":[],"doe_c2m2":[],"api_1164":["Sec 7"],"awia":[],"iaea_nss":["Sec 5.4"],"pci_pts":["B","F","L"],"fips_140":["FIPS 140-3 §7.5","FIPS 140-3 §7.10"],"cbest":[],"tiber_eu":[],"pci_hsm":["8"],"common_criteria":["CC Part 2 — FPT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.1","SYSC 13.7.4"],"fda_21_cfr_11":["§11.10(b)","§11.10(f)","§11.70"],"fda_cyber":["SA-3","ST-1"],"hitrust_csf":["09.c","11.c"],"iso_27799":[],"lloyds_ms":["MS8.4","MS8.10"],"naic_ds":["4B","5"],"nhs_dspt":[],"pra_ss1_23":["P3.2","P4.3"],"solvency_ii":["EIOPA-ICT-4.8","Pillar3-Reporting"],"owasp_masvs_v2":["MASVS-RESILIENCE-1","MASVS-RESILIENCE-2","MASVS-RESILIENCE-3","MASVS-RESILIENCE-4"],"csa_ccm_v4":["CCC-04","CCC-07"],"csa_aicm":["AIS-09","AIS-13","AIS-14","CCC-04","CCC-07","MDS-06","MDS-08"],"ccss_v9":["1.01.3","1.02.4"],"mica":["Art.88(1)"],"basel_sco60":["SCO60.11","SCO60.14","SCO60.21","SCO60.23","SCO60.51","SCO60.52","SCO60.65","SCO60.71"],"bssc":["NOS-02","TIS-05"],"sec_custody_digital":["SEC-CD-09","SEC-CD-13"],"dpdpa":["Act.8(5)","Rules.Sch1.B.7"]},"attack_techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of system files and authentication libraries detects unauthorized modifications to credential storage mechanisms, alerting when adversaries tamper with SAM, NTDS, or LSASS components."},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"File integrity monitoring and hash verification detect obfuscated or packed files that deviate from known-good software baselines, flagging potentially malicious payloads disguised through encoding or encryption."},{"id":"T1036","name":"Masquerading","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Software integrity checks comparing file hashes and digital signatures against approved baselines detect executables masquerading as legitimate system utilities through name or location spoofing."},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of boot and logon initialization scripts detects unauthorized modifications to login hooks, startup items, and network logon scripts used for persistent code execution."},{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network interface configurations detects unauthorized promiscuous mode activation and traffic capture tool installation used for credential sniffing on the network."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Monitoring WMI repository integrity and validating WMI provider registrations detects unauthorized modifications that adversaries use to establish persistent WMI-based command execution."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of scripting engine binaries and configuration files detects modifications to interpreters or policy settings that adversaries alter to enable unrestricted script execution."},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Maintaining verified integrity baselines for system software helps detect when adversaries exploit vulnerabilities that corrupt memory or modify system binaries to achieve privilege escalation."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of log files, event stores, and audit configurations detects unauthorized deletion or modification of forensic evidence, alerting when adversaries attempt to remove indicators of compromise."},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Verifying the integrity of software deployment tool packages and configurations detects when adversaries tamper with distribution platforms to push malicious payloads to managed endpoints."},{"id":"T1080","name":"Taint Shared Content","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of shared network directories and files detects unauthorized modifications to shared content that adversaries taint with malicious payloads for lateral movement."},{"id":"T1112","name":"Modify Registry","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Registry integrity monitoring detects unauthorized modifications to registry keys used for persistence, configuration changes, and defense evasion, alerting on changes outside approved baselines."},{"id":"T1114","name":"Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of email server configurations and transport rules detects unauthorized modifications that adversaries install for email collection, forwarding, and interception."},{"id":"T1119","name":"Automated Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Software integrity verification detects unauthorized installation of automated collection tools and scripts that adversaries deploy to systematically harvest data from compromised systems."},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of developer utilities (MSBuild, CSC) detects when adversaries leverage or modify trusted developer tools to proxy-execute malicious code while bypassing application controls."},{"id":"T1129","name":"Shared Modules","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Verifying loaded module integrity through hash comparison detects when adversaries inject or replace shared libraries to achieve execution within legitimate application contexts."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of VPN, remote access gateway, and authentication configurations detects unauthorized changes that adversaries make to external remote service settings for persistent access."},{"id":"T1136","name":"Create Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Information integrity controls on identity databases detect unauthorized account creation by verifying that new accounts align with approved provisioning workflows and authorized changes."},{"id":"T1176","name":"Browser Extensions","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of installed browser extensions against approved manifests detects unauthorized or modified extensions that adversaries deploy for persistent data collection and session interception."},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Monitoring browser binary and extension integrity detects modifications that adversaries use to inject session-hijacking code into browser processes for credential and data collection."},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Software integrity verification of web browser components and plugins detects when drive-by compromise exploits modify or corrupt client-side software to achieve initial code execution."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of public-facing application binaries, libraries, and configurations detects unauthorized modifications resulting from exploitation of web-facing vulnerabilities."},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Verifying software hashes and digital signatures against known-good values detects supply chain compromises where adversaries inject malicious code into legitimate software packages or updates."},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity checks on client application binaries detect post-exploitation modifications where adversaries alter application code or libraries after achieving initial execution through client-side exploits."},{"id":"T1204","name":"User Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of executable files and documents helps detect user-executed malicious files by flagging binaries and documents that fail hash or signature validation checks."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Monitoring the integrity of remote service binaries and configurations detects post-exploitation modifications where adversaries alter network services after exploiting vulnerabilities for lateral movement."},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of security tool binaries and configurations detects when adversaries exploit vulnerabilities to modify defensive components for evasion purposes."},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of authentication service binaries and credential stores detects exploitation-driven modifications that adversaries use to intercept or forge credentials."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of information repository access logs and content hashes detects unauthorized bulk data access or modification indicating adversary collection from knowledge bases."},{"id":"T1216","name":"System Script Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of system scripts (PubPrn, SyncAppvPublishingServer) detects when adversaries abuse or modify trusted scripts to proxy-execute malicious code."},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of signed system binaries detects modifications or misuse of trusted executables (rundll32, mshta, regsvr32) that adversaries leverage for proxy execution."},{"id":"T1219","name":"Remote Access Software","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Software integrity verification detects unauthorized installation or modification of remote access tools that adversaries deploy to establish persistent command-and-control channels."},{"id":"T1220","name":"XSL Script Processing","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of XSL files and XSLT processors detects when adversaries introduce malicious XSL stylesheets for script-based code execution that bypasses application controls."},{"id":"T1221","name":"Template Injection","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of document templates detects when adversaries modify or inject malicious remote template references into Office documents for payload delivery."},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of file system ACLs and permission configurations detects unauthorized permission changes that adversaries make to weaken access controls on protected resources."},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of critical data stores detects unauthorized bulk deletion or corruption, providing early warning of data destruction attacks before catastrophic data loss occurs."},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"File integrity monitoring detects the rapid, widespread file modification patterns characteristic of ransomware encryption, enabling early alerting before complete data encryption."},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of backup catalogs, Volume Shadow Copies, and recovery configurations detects adversary tampering designed to prevent system restoration after destructive attacks."},{"id":"T1491","name":"Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of web content files and internal portal pages detects unauthorized modifications used for internal or external website defacement attacks."},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Firmware integrity verification using cryptographic hash comparison detects unauthorized modifications to device firmware that adversaries corrupt to cause permanent hardware-level damage."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of web server modules, IIS components, and mail transport agents detects when adversaries install malicious server software components for persistent backdoor access."},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Container image integrity verification through signed image policies and hash validation detects when adversaries implant malicious code into container images stored in internal registries."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of cloud storage access logs and object versions detects unauthorized access to or modification of sensitive data stored in cloud storage services."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Boot integrity verification through Secure Boot, Measured Boot, and TPM attestation detects when adversaries modify pre-OS boot components to establish persistence below the operating system."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of service configurations, systemd units, and launch daemon plists detects unauthorized creation or modification of system processes used for persistence."},{"id":"T1546","name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of event-triggered execution mechanisms (WMI subscriptions, shell profiles, registry entries) detects adversary-installed persistence hooks activated by system events."},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of elevation control mechanisms (sudo configuration, UAC settings, setuid binaries) detects unauthorized modifications that adversaries use to bypass privilege boundaries."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of credential storage locations detects unauthorized access to or modification of files, registry keys, and configuration stores containing embedded credentials."},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of certificate stores, code signing policies, and trust provider configurations detects adversary modifications designed to subvert trust controls and execute unsigned code."},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"File integrity monitoring of host software binaries detects when adversaries replace or modify legitimate executables with backdoored versions that persist across system restarts."},{"id":"T1556","name":"Modify Authentication Process","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of authentication modules (LSASS, PAM, AD FS) detects unauthorized modifications to the authentication pipeline that adversaries use to capture credentials or bypass verification."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Network integrity verification detects adversary-in-the-middle techniques by monitoring for ARP poisoning, DNS spoofing, and LLMNR/NBT-NS response manipulation used to intercept network traffic."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Kerberos infrastructure and ticket-granting service configurations detects manipulation of the authentication protocol that enables ticket forging and credential theft."},{"id":"T1561","name":"Disk Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of disk partition tables and boot records provides early detection of disk wipe operations, alerting when adversaries attempt to destroy data through low-level disk modification."},{"id":"T1562","name":"Impair Defenses","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of security tool configurations, firewall rules, and logging settings detects when adversaries disable or modify defensive controls to evade detection."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification using cryptographic checksums and hash chains detects stored, transmitted, and runtime data manipulation, ensuring adversaries cannot silently alter information without detection."},{"id":"T1569","name":"System Services","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of service binaries and service control manager configurations detects when adversaries install or modify system services to execute malicious payloads."},{"id":"T1574","name":"Hijack Execution Flow","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of DLL search paths, library files, and executable directories detects when adversaries plant malicious files to hijack legitimate application execution flows."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device configurations detects unauthorized routing and bridging changes that adversaries use to bypass network segmentation boundaries."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device system images using cryptographic hashes detects when adversaries patch or downgrade firmware to implant backdoors or remove security features."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of configuration repository access and SNMP community strings detects unauthorized extraction of device configurations containing network topology and credential information."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of container runtime configurations and orchestrator settings detects unauthorized container administration commands that adversaries use for post-compromise execution."},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Container runtime integrity monitoring detects when adversaries modify container configurations or exploit vulnerabilities to escape container isolation and access the underlying host system."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of macOS plist files detects unauthorized modifications to property list configurations used for application settings, launch agents, and system preferences."},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of the NTDS.dit Active Directory database file detects unauthorized access or copying that indicates adversary attempts to extract domain credential hashes."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device port mirroring configurations detects unauthorized traffic duplication setups that adversaries use to intercept and exfiltrate network communications."},{"id":"T1027.002","name":"Software Packing","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Software integrity checks detect packed executables whose hash and structure differ from known-good baselines, flagging files that use software packing to evade static analysis."},{"id":"T1027.007","name":"Dynamic API Resolution","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of imported API tables detects dynamic API resolution patterns where adversaries resolve system functions at runtime to evade static import analysis."},{"id":"T1027.008","name":"Stripped Payloads","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Hash-based integrity checking detects stripped payloads that have had identifying information removed, since these files will not match known-good software baselines."},{"id":"T1027.009","name":"Embedded Payloads","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Software integrity analysis detects embedded payloads hidden within seemingly legitimate files, since the carrier file's hash will differ from the original clean version."},{"id":"T1036.001","name":"Invalid Code Signature","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Digital signature verification detects executables with invalid or forged code signatures that adversaries create to masquerade malicious files as legitimately-signed software."},{"id":"T1036.005","name":"Match Legitimate Name or Location","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"File integrity monitoring detects when adversaries place files that match legitimate names in trusted directories, since these files will fail hash comparison against approved baselines."},{"id":"T1037.002","name":"Login Hook","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of macOS login hook configurations detects unauthorized scripts registered to execute automatically during the user login process."},{"id":"T1037.003","name":"Network Logon Script","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network logon scripts in SYSVOL and NETLOGON shares detects unauthorized modifications that adversaries insert for domain-wide code execution at login."},{"id":"T1037.004","name":"RC Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of RC scripts and init.d configurations detects unauthorized modifications to Unix system initialization scripts used for persistent code execution at boot."},{"id":"T1037.005","name":"Startup Items","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of macOS startup items detects unauthorized addition of launch scripts that execute during the system boot sequence for persistent code execution."},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of systemd timer unit files detects unauthorized timer configurations that adversaries create for persistent, scheduled code execution on Linux systems."},{"id":"T1056.002","name":"GUI Input Capture","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of GUI components and authentication dialogs detects adversary-created fake input capture windows designed to harvest credentials by mimicking system prompts."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of PowerShell module paths and profile files detects unauthorized modifications that adversaries use to load malicious modules or scripts on every PowerShell session."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of AppleScript libraries and osascript configurations detects unauthorized modifications that adversaries exploit for persistent macOS scripting-based execution."},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of cmd.exe and associated batch processing components detects modifications that adversaries make to enable unrestricted Windows Command Shell execution."},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of shell binaries and configuration files detects unauthorized modifications to Unix shell environments that adversaries exploit for persistent command execution."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of VBScript engines and Office macro settings detects unauthorized modifications that adversaries leverage to enable Visual Basic script execution."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Python interpreter binaries and site-packages detects modifications that adversaries use to inject malicious code into the Python execution environment."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of JavaScript runtime engines (cscript, wscript, Node.js) detects unauthorized modifications that adversaries leverage for script-based code execution."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device CLI configuration and access controls detects unauthorized modifications to device management interfaces used for infrastructure command execution."},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of AutoHotKey and AutoIT installations detects unauthorized deployment or modification of these scripting frameworks that adversaries use for automated malicious actions."},{"id":"T1059.011","name":"Lua","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Lua interpreter binaries and embedded scripting environments detects unauthorized modifications that enable adversary code execution through Lua-enabled applications."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Windows Event Log files and the EventLog service configuration detects adversary attempts to clear security-relevant event logs that record malicious activity."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of syslog configurations and log rotation policies detects adversary attempts to clear or modify Linux and macOS system logs to remove evidence."},{"id":"T1070.003","name":"Clear Command History","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of shell history files detects unauthorized deletion or truncation of command history that adversaries perform to conceal executed commands."},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device logging configurations detects adversary modifications designed to clear connection histories and network configuration change logs."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of mailbox audit configurations and email retention policies detects unauthorized changes that adversaries make to purge mailbox forensic evidence."},{"id":"T1070.009","name":"Clear Persistence","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of persistence mechanism locations (registry, startup folders, scheduled tasks) detects when adversaries selectively remove their own persistence artifacts to evade detection."},{"id":"T1070.010","name":"Relocate Malware","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of file system paths and executable locations detects when adversaries relocate malware to new directories after initial detection or analysis."},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of cloud service principal credential stores detects unauthorized addition of secrets, certificates, or API keys that adversaries use for persistent cloud access."},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Exchange mailbox delegation settings detects unauthorized permission changes that adversaries configure for persistent email access."},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of cloud IAM role assignments detects unauthorized privilege escalation when adversaries add roles to compromised accounts."},{"id":"T1114.001","name":"Local Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of local email databases (.ost, .pst) detects unauthorized bulk access or export operations that adversaries perform for email collection."},{"id":"T1114.002","name":"Remote Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Exchange Web Services and remote email access configurations detects unauthorized changes that enable adversary email collection from remote endpoints."},{"id":"T1114.003","name":"Email Forwarding Rule","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of email transport rules and forwarding configurations detects unauthorized forwarding rules that adversaries create to silently copy email to external addresses."},{"id":"T1127.002","name":"ClickOnce","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of ClickOnce application manifests and deployment configurations detects when adversaries abuse ClickOnce for signed-binary proxy execution of malicious payloads."},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Information integrity monitoring of local account databases detects unauthorized creation of local accounts that were not provisioned through approved identity management workflows."},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Active Directory account provisioning detects unauthorized domain account creation that does not match approved HR-driven identity lifecycle processes."},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of cloud IAM user and service account registries detects unauthorized cloud account creation outside approved provisioning pipelines."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Software integrity verification through SBOM validation and dependency hash checking detects compromised software dependencies introduced through supply chain attacks on development tools."},{"id":"T1195.003","name":"Compromise Hardware Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Hardware integrity verification through trusted platform attestation and component validation detects unauthorized hardware modifications or substitutions in the supply chain."},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of executable files through hash comparison and digital signature validation detects malicious files that adversaries deliver for user execution."},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Container image integrity verification through signature validation and hash checking detects malicious container images that adversaries craft for deployment and execution."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Confluence content and access audit logs detects unauthorized bulk data access or modification indicating adversary collection from the wiki platform."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of SharePoint document libraries and access logs detects unauthorized data access patterns indicating adversary collection from the collaboration platform."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of CRM database access logs detects unusual query patterns indicating adversary collection of customer data from customer relationship management systems."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of messaging application configurations and export logs detects unauthorized bulk message extraction from internal communication platforms."},{"id":"T1216.001","name":"PubPrn","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of PubPrn.vbs and related system scripts detects when adversaries modify or abuse these trusted scripts for proxy execution of malicious code."},{"id":"T1216.002","name":"SyncAppvPublishingServer","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of SyncAppvPublishingServer and App-V infrastructure detects unauthorized modifications that adversaries exploit for signed-script proxy execution."},{"id":"T1218.001","name":"Compiled HTML File","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of compiled HTML (.chm) files detects adversary-crafted help files that contain embedded malicious scripts for system binary proxy execution."},{"id":"T1218.002","name":"Control Panel","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Control Panel (.cpl) files detects adversary-created control panel items that execute malicious code through the trusted control panel infrastructure."},{"id":"T1218.003","name":"CMSTP","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of CMSTP configuration files detects adversary-crafted .inf files that abuse the Connection Manager Profile Installer for proxy execution."},{"id":"T1218.004","name":"InstallUtil","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of InstallUtil configurations detects when adversaries abuse the .NET installation utility to proxy-execute malicious managed code assemblies."},{"id":"T1218.005","name":"Mshta","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of HTA (HTML Application) files detects adversary-crafted applications that abuse mshta.exe for proxy execution of embedded VBScript or JavaScript."},{"id":"T1218.008","name":"Odbcconf","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of ODBC configuration files detects adversary-crafted response files that abuse odbcconf.exe for proxy execution of malicious DLLs."},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of .NET assemblies passed to Regsvcs/Regasm detects adversary-crafted binaries that exploit COM registration for proxy execution of malicious code."},{"id":"T1218.010","name":"Regsvr32","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of DLLs loaded through Regsvr32 detects adversary-crafted libraries that abuse COM registration for scriptlet-based proxy execution."},{"id":"T1218.011","name":"Rundll32","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of DLLs loaded via Rundll32 detects adversary-supplied libraries that abuse the legitimate DLL loading utility for proxy execution of malicious code."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of COM objects invoked through Verclsid detects adversary-registered malicious COM components that execute during the class verification process."},{"id":"T1218.013","name":"Mavinject","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of DLLs injected through Mavinject detects adversary use of the Microsoft Application Virtualization Injector for code injection into running processes."},{"id":"T1218.014","name":"MMC","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of MMC snap-in configurations detects adversary-crafted management console files that abuse the Microsoft Management Console for proxy execution."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Electron application packages detects modifications that adversaries make to abuse Electron's Node.js integration for signed-binary proxy execution."},{"id":"T1222.001","name":"Windows File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Windows file system ACLs detects unauthorized permission modifications that adversaries use to weaken access controls on protected files and directories."},{"id":"T1222.002","name":"Linux and Mac File and Directory Permissions Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Linux and macOS file permissions detects unauthorized changes to ownership and access rights that adversaries use to access or modify protected resources."},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of cloud storage lifecycle policies detects adversary-configured automated deletion rules designed to destroy data through legitimate cloud retention mechanisms."},{"id":"T1491.001","name":"Internal Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of internal web application content detects unauthorized page modifications used for internal defacement or injection of malicious content."},{"id":"T1491.002","name":"External Defacement","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of public-facing web content detects unauthorized modifications used for external website defacement that damages organizational reputation."},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of database stored procedures detects unauthorized modifications or additions of SQL stored procedures that adversaries use for persistent database-level code execution."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Exchange transport agent registrations detects unauthorized mail agents that adversaries install for email interception and modification."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of IIS module registrations and web.config files detects unauthorized web server components that adversaries install for persistent web application backdoors."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Firmware integrity verification through UEFI Secure Boot and TPM measurements detects unauthorized system firmware modifications that adversaries use for pre-OS persistence."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Boot integrity verification through Measured Boot and Secure Boot detects bootkit installations that modify the Master Boot Record or Volume Boot Record for pre-OS persistence."},{"id":"T1542.004","name":"ROMMONkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of router ROMMON firmware detects unauthorized modifications to the ROM Monitor that adversaries use for persistent router-level implants."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of network device boot source configurations detects unauthorized TFTP boot settings that adversaries use to load compromised operating system images."},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of systemd unit files and service configurations detects unauthorized service creation or modification that adversaries use for persistent code execution on Linux."},{"id":"T1546.002","name":"Screensaver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of screensaver configuration files detects adversary-configured screensaver executables that provide persistent code execution when the screen locks."},{"id":"T1546.004","name":"Unix Shell Configuration Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of shell configuration files (.bashrc, .zshrc, .profile) detects adversary-injected commands that execute on every interactive shell session for persistence."},{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Mach-O binaries detects unauthorized LC_LOAD_DYLIB header additions that adversaries use to load malicious dylibs on macOS application startup."},{"id":"T1546.008","name":"Accessibility Features","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Windows accessibility feature binaries (sethc.exe, utilman.exe) detects replacements that adversaries use for pre-login backdoor access."},{"id":"T1546.009","name":"AppCert DLLs","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of AppCert DLL registry entries detects adversary-registered DLLs that load into every process calling the CreateProcess API for persistent code execution."},{"id":"T1546.010","name":"AppInit DLLs","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of AppInit DLLs registry entries detects adversary-configured DLLs that load into every process that imports user32.dll for widespread code injection."},{"id":"T1546.013","name":"PowerShell Profile","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of PowerShell profile files detects adversary-injected code that executes automatically on every PowerShell session startup for persistent script-based access."},{"id":"T1547.002","name":"Authentication Package","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of authentication package registry entries and DLLs detects adversary-installed authentication packages that intercept credentials during the Windows logon process."},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of time provider DLL registrations detects adversary-installed malicious time providers that load with the Windows Time service at system startup."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Winlogon Helper DLL registry entries detects adversary-configured DLLs that load during the Windows logon sequence for persistent code execution."},{"id":"T1547.005","name":"Security Support Provider","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Security Support Provider registry entries detects adversary-installed SSP DLLs that intercept authentication credentials during the Windows login process."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of loaded kernel modules and extensions detects unsigned or modified kernel-level code that adversaries install for rootkit-level persistent access."},{"id":"T1547.008","name":"LSASS Driver","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of LSASS driver registrations detects adversary-installed drivers that load into the Local Security Authority Subsystem for credential interception."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of XDG autostart desktop entry files detects unauthorized additions that adversaries use for persistent code execution on Linux desktop environments."},{"id":"T1548.004","name":"Elevated Execution with Prompt","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of macOS authorization dialogs and security prompts detects adversary-crafted fake elevation prompts designed to harvest user credentials."},{"id":"T1548.006","name":"TCC Manipulation","tactics":["defense-evasion","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of macOS TCC database files detects unauthorized modifications to Transparency, Consent, and Control settings that adversaries alter to grant malware access to protected resources."},{"id":"T1550.001","name":"Application Access Token","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of OAuth token stores and application access configurations detects unauthorized use of stolen or forged application access tokens for lateral movement."},{"id":"T1550.004","name":"Web Session Cookie","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of web session cookie stores detects unauthorized access to or modification of session cookies that adversaries use for authenticated access without credentials."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of private key files and certificate stores detects unauthorized access to or modification of cryptographic material that adversaries steal for authentication bypass."},{"id":"T1553.001","name":"Gatekeeper Bypass","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of macOS Gatekeeper quarantine attributes and XProtect signatures detects adversary techniques that bypass macOS trust controls to execute unsigned applications."},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of SIP (Subject Interface Package) and trust provider DLL registrations detects adversary modifications to Windows code signing verification infrastructure."},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Mark-of-the-Web metadata detects when adversaries remove or modify zone identifier data to bypass security warnings on downloaded files."},{"id":"T1553.006","name":"Code Signing Policy Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of code signing policy configurations detects unauthorized modifications that adversaries make to weaken signature verification requirements."},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of domain controller authentication libraries detects unauthorized modifications to LSASS or password filter DLLs that adversaries install for credential interception."},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of PAM configuration and module directories detects unauthorized Pluggable Authentication Module modifications that adversaries use to backdoor Linux authentication."},{"id":"T1556.004","name":"Network Device Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device authentication configurations detects unauthorized changes to TACACS+, RADIUS, or local authentication settings that adversaries modify for credential capture."},{"id":"T1556.008","name":"Network Provider DLL","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Network Provider DLL registrations detects adversary-installed DLLs in the Windows network authentication pipeline that intercept plaintext credentials."},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of conditional access policy configurations detects unauthorized modifications that adversaries make to weaken authentication requirements."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of ARP tables and network configurations detects ARP cache poisoning that adversaries use to redirect traffic through attacker-controlled systems for credential interception."},{"id":"T1557.004","name":"Evil Twin","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of wireless network configurations and BSSID associations detects evil twin access points that adversaries deploy to intercept wireless network traffic."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Kerberos service configuration and SPN registrations detects unauthorized changes that adversaries exploit to forge Silver Tickets for service authentication bypass."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of service account SPN configurations and password policies detects weaknesses that adversaries exploit for offline Kerberoasting attacks."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of Kerberos pre-authentication settings detects accounts configured without pre-auth that adversaries target for AS-REP roasting attacks."},{"id":"T1558.005","name":"Ccache Files","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Kerberos credential cache file permissions detects unauthorized access to ccache files containing cached tickets that adversaries steal for authentication."},{"id":"T1561.001","name":"Disk Content Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of disk content detects unauthorized bulk data overwrite operations that adversaries use to destroy stored data and impede forensic recovery."},{"id":"T1561.002","name":"Disk Structure Wipe","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of disk partition tables and boot structures detects adversary attempts to wipe disk structures that render systems unbootable."},{"id":"T1562.001","name":"Disable or Modify Tools","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of security tool installations and configurations detects when adversaries disable, modify, or uninstall defensive tools to evade detection."},{"id":"T1562.002","name":"Disable Windows Event Logging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Windows Event Logging service configuration detects unauthorized changes that adversaries make to disable security event collection."},{"id":"T1562.004","name":"Disable or Modify System Firewall","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of firewall configurations detects unauthorized rule modifications that adversaries make to disable host or network firewalls for lateral movement."},{"id":"T1562.006","name":"Indicator Blocking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of ETW provider configurations detects adversary modifications that block security indicators from reaching monitoring tools through indicator blocking."},{"id":"T1562.009","name":"Safe Mode Boot","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of boot configuration data detects adversary modifications that force Safe Mode boot to disable security software during system startup."},{"id":"T1562.010","name":"Downgrade Attack","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of protocol and security component configurations detects adversary-forced downgrades that weaken TLS, SMB, or authentication protocol security."},{"id":"T1562.011","name":"Spoof Security Alerting","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of security alerting configurations detects adversary modifications designed to spoof or suppress genuine security alerts."},{"id":"T1562.012","name":"Disable or Modify Linux Audit System","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of Linux audit daemon configuration and audit rules detects unauthorized modifications that adversaries make to disable system call and file access auditing."},{"id":"T1564.003","name":"Hidden Window","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of window creation parameters and process visibility flags detects adversary-configured hidden windows used to conceal active malicious processes from user view."},{"id":"T1564.004","name":"NTFS File Attributes","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of NTFS alternate data streams detects adversary use of hidden file attributes to conceal malicious payloads within legitimate files."},{"id":"T1564.006","name":"Run Virtual Instance","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of virtualization software and virtual machine configurations detects when adversaries run covert virtual instances to hide malicious activity from host-level security tools."},{"id":"T1564.008","name":"Email Hiding Rules","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of email rules and filtering configurations detects adversary-created hiding rules that suppress security notifications and alert emails."},{"id":"T1564.009","name":"Resource Forking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of macOS resource fork attributes detects adversary use of resource forking to conceal malicious data within legitimate files."},{"id":"T1564.010","name":"Process Argument Spoofing","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of process command-line arguments detects argument spoofing where adversaries modify process parameters after creation to evade command-line monitoring."},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification using cryptographic checksums on stored data detects unauthorized modifications that adversaries make to databases, files, and records for data integrity attacks."},{"id":"T1565.002","name":"Transmitted Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity checks on transmitted data through cryptographic message authentication detects adversary modification of data in transit for man-in-the-middle manipulation attacks."},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of runtime process memory and application state detects adversary manipulation of in-memory data used for real-time decision-making and transaction processing."},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of service executables and SCM configurations detects when adversaries install or modify Windows services to execute malicious binaries with elevated privileges."},{"id":"T1574.001","name":"DLL Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of DLL search directories detects adversary-planted malicious libraries that exploit DLL search order precedence for hijacking legitimate application execution."},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of dynamic library paths on macOS detects adversary-planted malicious dylibs that exploit application library search behavior for code execution."},{"id":"T1574.006","name":"Dynamic Linker Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of dynamic linker configurations (LD_PRELOAD, DYLD_INSERT_LIBRARIES) detects adversary-configured library injection that hijacks application execution."},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of PATH environment variables detects adversary modifications that insert malicious executable directories ahead of legitimate system command locations."},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of application directories detects adversary-planted executables that exploit search order precedence to intercept calls to legitimate programs."},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of service executable paths detects unquoted path vulnerabilities that adversaries exploit by placing executables at intermediate directory boundaries."},{"id":"T1574.012","name":"COR_PROFILER","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of COR_PROFILER environment variables and .NET profiler DLLs detects adversary-configured profilers that load malicious code into every CLR process."},{"id":"T1574.013","name":"KernelCallbackTable","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of KernelCallbackTable entries detects adversary modifications to kernel callback function pointers used for persistent code execution through process callbacks."},{"id":"T1574.014","name":"AppDomainManager","tactics":["defense-evasion","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of AppDomainManager configuration detects adversary-set environment variables or config files that load malicious .NET AppDomainManagers into target applications."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of NAT translation rules and routing configurations detects unauthorized address translation traversal rules that adversaries configure to bridge network boundaries."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device system images using vendor-published hashes detects unauthorized patches that adversaries apply to running firmware for persistent infrastructure backdoors."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of network device firmware versions detects adversary-initiated downgrades to older, vulnerable system images that lack current security protections."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity monitoring of SNMP configurations and MIB access controls detects unauthorized queries that adversaries use to dump device configurations containing sensitive network information."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Integrity verification of network device configuration access logs detects unauthorized configuration dump operations that adversaries perform to extract routing, credential, and topology data."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: nist_csf_2 ID.RA-09, PR.DS-01, PR.DS-02, PR.DS-10, PR.PS-02 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"detective","used_by_patterns":["SP-001","SP-002","SP-016","SP-023","SP-025","SP-026","SP-028","SP-029","SP-031","SP-033","SP-034","SP-036","SP-039","SP-040","SP-041","SP-050","SP-052","SP-053"]}}