SideWinder's Stealthy Strikes: Unveiling the New Threat to Mediterranean Maritime Security

SideWinderMaritimeCampaignSideWinderCyberAttackMediterraneanPortsSecurityPortSecurityBreach

SideWinder, a cyber espionage group, is conducting a campaign targeting Mediterranean ports and maritime facilities with advanced techniques and new infrastructure, highlighting the growing threat to critical maritime infrastructure from state-sponsored cyber actors.

Indicators of Compromise

Domains (7)

www.sitennews.comtiz-diş-b557.vgfjuic.workers.devwww.cdn7854.workers.devicy-bar-c375.microsoft-updates.workers.devupdate-chrome.realgodad.workers.devwww.mircoupdate.https443.netparça.cdn78544.ru

Hashes (48)

f0953ed4a679b987a2da955788737602e4360c0aa995e6e896b22bb7725a6c9b189be8606e7cbbc8b6e80c606358649d28072e4a3bc3376aba096045824f4c34bcac2cbda36019776d7861f12d9b59c47586e58a569c2a07d0b3a710616f48833a040bf3fc57628bbdec7fcb462d565af42867e74bbc41767bffacc0de7bfa5e5b46b63e31f307757cedf305005ce9990a07cbf4ee7faba27a2c5f7acb5b06e94aa318e0073b35ecbd1833575fbfb1307654fc532fd938482e09426cfb0541ad87a04f7566fb63e6e49c2c201a0b6204e1d0269812a4b662144550355b3dfb67a0ef65dc7f69470b4faf4ca17e63c6b9ab3b32beffbc1eb23d6ca7cc59616b0722f0dd4f0d893c0a1724f5d78405d742405d3a6d3bda6bc49630dd5f3604a3d6ae27cbd533e425f8abbaafdc3872c38625ca62de3bcbe29740c1a0b8921fcf48a50f85c71b69563ba42bf04c937e1063244ca4957231d3adac76f1c96ab42d3c0faddbe1713455e3fc9777ec45adf07b28e24f4c3ddca37586c2aa6b539898c02fce25afb8a29fcd526f61ba30f14dcc7ecfad3ee9625ce47b87085b66e0ee6e17ecb333cdcbd9c25e06ac6da5497fa19459d0007449ec1a3e6bc591334db6fb3598aecb7f24bc080281d250ec88493e5803e488721a17c9382cd54ba8dfbcb785f23a88+28 more

IPv4 (3)

78.108.216.205.182.207.28212.87.212.115

APT Groups

SideWinder

Notes

<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CONCLUSION<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">The SideWinder threat actor persistently enhances its infrastructure, expanding its capacity to target victims in diverse regions. This continuous evolution in network infrastructure and delivery mechanisms indicates that SideWinder's activities will likely persist in the near future. <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">SideWinder consistently upgrades its operational infrastructure, broadening its reach to new regions. The ongoing refinement of their network capabilities and payload distribution methods suggests that their attacks will continue for the foreseeable future. <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">No samples of the JavaScript payloads from the final stage of the attack have been observed. However, considering the patterns in SideWinder's previous campaigns, it is inferred that the primary objective of this campaign is espionage and intelligence collection. <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">While we have yet to observe JavaScript payloads in the final attack phase, historical data on SideWinder’s operations strongly suggests their focus is on espionage and intelligence gathering. <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Our team at SOCRadar is actively tracking SideWinder's tools and malicious files. In this campaign, we have compiled detailed information on the identified files and network artifacts to support cybersecurity professionals and defenders in their efforts to mitigate these threats. <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">The SOCRadar <a href="https://socradar.io/labs/campaigns/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Campaigns</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> page features the SideWinder campaign, along with many others.<div><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>

Mitigation

<span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION<a href="https://attack.mitre.org/"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"> REF</a><a href="https://otx.alienvault.com/pulse/66a36b111ef3f39641ec764f"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Att&ck IDs:</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1027 - Obfuscated Files or Information, T1047 - Windows Management Instrumentation, T1059 - Command and Scripting Interpreter, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1105 - Ingress Tool Transfer, T1140 - Deobfuscate/Decode Files or Information, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1221 - Template Injection, T1480 - Execution Guardrails, T1518 - Software Discovery <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col></colgroup><tbody><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Attack Technic</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1027/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1027</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Obfuscated Files or Information</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1047/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1047</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Windows Management Instrumentation</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1059</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Command and Scripting Interpreter</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1071/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1071</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application Layer Protocol</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1082/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1082 </a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System Information Discovery</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1105/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1105</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ingress Tool Transfer</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1140/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1140</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deobfuscate/Decode Files or Information</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1203/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1203</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Exploitation for Client Executions</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1204</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Execution</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1221/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1221</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Template Injection</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1480/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1480</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Guardrails</td></tr><tr style="height:0pt;"><td style="border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1518/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1518</a></td><td style="border-left:solid #bdc1c6 1pt;border-right:solid #bdc1c6 1pt;border-bottom:solid #bdc1c6 1pt;border-top:solid #bdc1c6 1pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Software Discovery</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1027 - Obfuscated Files or Information <div style="margin-left:-0.75pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:70.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can be used to automatically detect and quarantine suspicious files. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted. <a href="https://cloudblogs.microsoft.com/microsoftsecure/2015/06/09/windows-10-to-offer-application-developers-new-malware-defenses/?source=mmpc"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[175]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads. <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[176]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> T1047 - Windows Management Instrumentation <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:70.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution. <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[157]</a></td></tr><tr style="height:85pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of <span style="font-size: 8.5pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">wmic.exe<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the <span style="font-size: 8.5pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">wmic.exe<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[158]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Prevent credential overlap across systems of administrator and privileged accounts. <a href="https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[159]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1059 - Command and Scripting Interpreter <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:43pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can be used to automatically quarantine suspicious files.</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent <a href="https://attack.mitre.org/techniques/T1059/005"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Visual Basic</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> and <a href="https://attack.mitre.org/techniques/T1059/007"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">JavaScript</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> scripts from executing potentially malicious downloaded content <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[48]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">.</td></tr><tr style="height:43pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1045</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Code Signing</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Where possible, only permit execution of signed scripts.</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1042</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or Remove Feature or Program</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or remove any unnecessary or unused shells or interpreters.</td></tr><tr style="height:70.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., <span style="font-size: 8.5pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Add-Type<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[49]</a></td></tr><tr style="height:110.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.<a href="https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[50]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.<a href="https://learn.microsoft.com/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[51]</a></td></tr><tr style="height:70.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1021</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Web-Based Content</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1071 - Application Layer Protocol <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:57.25pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1037</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Filter Network Traffic</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1082 - System Information Discovery<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features. <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1105 - Ingress Tool Transfer <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:112.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.<a href="https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[525]</a></td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1140 - Deobfuscate/Decode Files or Information<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features. <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1203 - Exploitation for Client Execution <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:97pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1048"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1048</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1048"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application Isolation and Sandboxing</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. <a href="https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[94]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[95]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist. <a href="https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[95]</a></td></tr><tr style="height:85pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1050"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1050</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1050"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Exploit Protection</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. <a href="https://blogs.technet.microsoft.com/srd/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[96]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. <a href="https://en.wikipedia.org/wiki/Control-flow_integrity"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[97]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Many of these protections depend on the architecture and target application binary for compatibility.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1204 - User Execution <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:85pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent executable files from running unless they meet a prevalence, age, or trusted list criteria and to prevent Office applications from creating potentially malicious executable content by blocking malicious code from being written to disk. Note: cloud-delivered protection must be enabled to use certain rules. <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[6]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control may be able to prevent the running of executables masquerading as other files.</td></tr><tr style="height:70.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.</td></tr><tr style="height:85pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1021</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Web-Based Content</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1221 - Template Injection <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:57.25pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.<a href="https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[7]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1042</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or Remove Feature or Program</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents <a href="https://support.office.com/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[26]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, though this setting may not mitigate the <a href="https://attack.mitre.org/techniques/T1187"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Forced Authentication</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> use for this technique.</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.<a href="https://forum.anomali.com/t/credential-harvesting-and-malicious-file-delivery-using-microsoft-office-template-injection/2104"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[7]</a></td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1480 - Execution Guardrails <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dee2e6 1.333335pt;border-top:solid #dfdfdf 0.6666667500000001pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:70.75pt;"><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1055"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1055</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1055"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Do Not Mitigate</a></td><td style="border-left:solid #dfdfdf 0.6666667500000001pt;border-right:solid #dfdfdf 0.6666667500000001pt;border-bottom:solid #dfdfdf 0.6666667500000001pt;border-top:solid #dee2e6 1.333335pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1480"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Guardrails</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised. If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.</td></tr></tbody></table></div> <span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1518 - Software Discovery<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.<div><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>