{"data":{"id":"SI-15","name":"Information Output Filtering","family":"SI","family_name":"System and Information Integrity","withdrawn":false,"description":"Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: organization-defined software programs and/or applications].","supplemental_guidance":"Certain types of attacks, including SQL injections, produce output results that are unexpected or inconsistent with the output results that would be expected from software programs or applications. Information output filtering focuses on detecting extraneous content, preventing such extraneous content from being displayed, and then alerting monitoring tools that anomalous behavior has been discovered.","enhancements":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"SI-15","name":"Information Output Filtering","description":"Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: organization-defined software programs and/or applications].","discussion":"Certain types of attacks, including SQL injections, produce output results that are unexpected or inconsistent with the output results that would be expected from software programs or applications. Information output filtering focuses on detecting extraneous content, preventing such extraneous content from being displayed, and then alerting monitoring tools that anomalous behavior has been discovered.","related_controls":["SI-03","SI-04","SI-11"],"baseline_low":null,"baseline_moderate":null,"baseline_high":null,"baseline_privacy":null,"new_in_rev5":false,"changes_from_rev4":"No significant title changes from Rev 4."}},"compliance_mappings":{"iso_27001_2022":[],"iso_27002_2022":[],"cobit_2019":["DSS06"],"pci_dss_v4":[],"nist_csf_2":[],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":[],"rbi_csf":["Annex1.6"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":[],"dnb_good_practice":[],"cra":[],"swift_cscf":[],"cbuae":["CR-6"],"bog_cisd":["CISD-SDLC"],"cbe_csf":["CTO-4"],"sa_js2":["JS2-SA"],"bcbs_239":["Principle 3","Principle 7","Principle 9"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["10.b"],"iso_27799":[],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":[],"pra_ss1_23":["P3.2"],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":["SCO60.70","SCO60.72"],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Output filtering across alternative protocol channels (DNS, ICMP, SMTP) detects covert data exfiltration that adversaries route through non-standard protocols to bypass conventional monitoring."},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects and blocks proxy-relayed traffic that adversaries use to obscure the origin and destination of command-and-control and exfiltration communications."},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Filtering non-application-layer protocol traffic at network boundaries detects adversary use of raw TCP/UDP, ICMP, and other low-level protocols for covert data transfer and C2 communication."},{"id":"T1187","name":"Forced Authentication","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering of authentication traffic detects forced authentication attempts where adversaries trigger NTLM or Kerberos responses to capture credential hashes through controlled response interception."},{"id":"T1197","name":"BITS Jobs","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on BITS transfer traffic detects adversary abuse of the Background Intelligent Transfer Service for stealthy file download, upload, and data exfiltration."},{"id":"T1205","name":"Traffic Signaling","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects traffic signaling patterns (magic packets, specific byte sequences) that adversaries use to trigger dormant backdoors or open covert communication channels."},{"id":"T1219","name":"Remote Access Software","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects and blocks unauthorized remote access tool traffic, identifying adversary-installed remote administration software communicating through non-standard or tunneled channels."},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering at network boundaries helps identify and drop volumetric DDoS attack traffic, mitigating network-layer denial of service by filtering flood patterns."},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects and blocks malformed or excessive request patterns characteristic of endpoint denial-of-service attacks targeting application and OS resource exhaustion."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on cloud storage API responses prevents unauthorized data retrieval from cloud buckets and blobs by validating access patterns against data governance policies."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Filtering cloud-to-cloud data transfer outputs detects unauthorized cross-account data movement that adversaries use to exfiltrate data to attacker-controlled cloud environments."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering prevents unsecured credentials from being transmitted across network boundaries, detecting when plaintext passwords, keys, or tokens appear in outbound data flows."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects data manipulation artifacts in network traffic that indicate adversary-in-the-middle interception, where response content deviates from expected integrity baselines."},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects lateral tool transfer activity by identifying executable files, scripts, and attack toolkits being moved between internal systems outside approved channels."},{"id":"T1572","name":"Protocol Tunneling","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on encapsulated protocol traffic detects adversary use of protocol tunneling (DNS tunneling, SSH tunnels, HTTP encapsulation) to bypass network security controls."},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Output filtering at network boundaries detects traffic that should not cross network segments, identifying adversary attempts to bridge isolated network zones through routing manipulation."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Output filtering prevents network device configuration data from being exfiltrated, detecting unauthorized extraction of routing tables, credentials, and topology information."},{"id":"T1622","name":"Debugger Evasion","tactics":["defense-evasion","discovery"],"mapping_type":"mitigates","mapping_rationale":"Output filtering of debugging and analysis tool outputs limits the information adversaries can gather about security tool configurations and detection capabilities during debugger evasion activities."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on SMB/Windows Admin Share traffic detects unauthorized file transfers and command execution through administrative shares that adversaries use for lateral movement."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on VNC traffic detects unauthorized remote desktop sessions that adversaries establish for persistent access and lateral movement through VNC protocol connections."},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Filtering outbound traffic over symmetric encrypted protocols detects adversary use of encrypted non-C2 channels for data exfiltration that bypasses standard content inspection."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on asymmetric encrypted non-C2 protocol channels detects adversary exfiltration through SSL/TLS connections to unauthorized external endpoints."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Filtering unencrypted outbound protocol traffic detects adversary data exfiltration through plaintext protocols (FTP, HTTP, DNS) where content inspection can identify sensitive data in transit."},{"id":"T1071.004","name":"DNS","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on DNS traffic detects adversary use of DNS queries and responses as covert data exfiltration channels, identifying encoded payloads in DNS request patterns."},{"id":"T1090.003","name":"Multi-hop Proxy","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects multi-hop proxy traffic patterns where adversaries chain multiple intermediary systems to obscure command-and-control and exfiltration communication paths."},{"id":"T1205.001","name":"Port Knocking","tactics":["command-and-control","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects port knocking sequences where adversaries send specific packet patterns to trigger firewall rule changes or activate dormant services on compromised systems."},{"id":"T1218.012","name":"Verclsid","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on Verclsid execution detects adversary abuse of COM object verification to proxy-execute malicious code through the trusted system verification utility."},{"id":"T1218.015","name":"Electron Applications","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on Electron application network traffic detects adversary abuse of Electron's Node.js integration for signed-binary proxy execution and unauthorized data exfiltration."},{"id":"T1498.001","name":"Direct Network Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering identifies and drops direct network flood traffic (SYN floods, UDP floods, ICMP floods) that adversaries use for volumetric denial-of-service attacks."},{"id":"T1498.002","name":"Reflection Amplification","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects and blocks reflection amplification attack traffic by identifying spoofed source addresses in outbound requests to amplification services (DNS, NTP, memcached)."},{"id":"T1499.001","name":"OS Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects OS exhaustion flood patterns targeting system resources (connection tables, memory, file handles) that adversaries exploit for endpoint denial of service."},{"id":"T1499.002","name":"Service Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering identifies service exhaustion patterns where adversaries generate excessive legitimate-appearing requests to consume web server, database, or API processing capacity."},{"id":"T1499.003","name":"Application Exhaustion Flood","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects application-layer exhaustion attacks that craft expensive requests (complex queries, large uploads, computational triggers) to exhaust application processing resources."},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects exploit-based denial-of-service traffic that triggers application crashes or resource leaks through malformed inputs targeting specific software vulnerabilities."},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on cloud instance metadata API responses prevents adversaries from extracting IAM credentials, tokens, and configuration data from the cloud metadata service endpoint."},{"id":"T1557.001","name":"LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects LLMNR and NBT-NS poisoning responses that adversaries inject to redirect name resolution queries for credential capture through SMB relay attacks."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects ARP cache poisoning by monitoring for anomalous ARP responses that adversaries use to redirect traffic through attacker-controlled systems for credential interception."},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects rogue DHCP responses that adversaries inject to redirect client DNS and gateway settings, establishing man-in-the-middle positions through DHCP spoofing."},{"id":"T1564.009","name":"Resource Forking","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects exfiltration of data concealed in macOS resource forks, identifying hidden data streams that adversaries embed within legitimate file resource fork attributes."},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Output filtering at network boundaries detects unauthorized NAT traversal traffic that adversaries route through manipulated address translation rules to bridge segmented network zones."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Output filtering on SNMP traffic detects unauthorized MIB dump operations that adversaries use to extract device configuration data containing network topology and credential information."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Output filtering detects unauthorized network device configuration dumps by monitoring for bulk configuration export traffic that adversaries initiate to extract network infrastructure details."}],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-028","SP-030","SP-041"]}}