Silent Recruiters: UNC2970's Trojanized Infiltration

MistPenMalwareTrojanizedPDFJobSeekerAttacksUNC2970TEMP.Hermit

UNC2970, a North Korean-backed hacking group, has launched a sophisticated cyber campaign targeting job seekers and major industries like energy and aerospace. Using trojanized PDF readers and luring victims with fake job applications, the group infiltrates critical sectors, deploying the MistPen malware to compromise sensitive data and networks. This campaign highlights the dangerous combination of social engineering and advanced malware tactics, aiming at individuals and organizations alike.

Indicators of Compromise

Domains (6)

cmasedu.comdstvdtt.co.zawww.clinicabaru.cobmtpakistan.comheropersonas.comverisoftsystems.com

Hashes (18)

8c2302c2d43ebe5dda18b8d943436580eca8eb8871c7d8f0c6b9c3ce581416ed1565161807718ced42e482c4ddfd5423c0249c5f110fcb5289954b19f9790ffcf3baee9c48a2f744a16af30220de5066b707f8e3be12694b4470255e2ee58c8128a75771ebdb96d9b49c9369918ca581006cbff5d248ab4a1d756bce989830b991841e006225ac500de7630740a21d91cb1d73323d3d80004ada185844b0d461abd9ded736d5dc690607f935b4f2b58acd6dbf51da042c34c6e7ff7b1641837d2505610c490d24a98da730100175f26268875ce8177794df6bf125b2bb8b8ecc3b84517b57e2c60b09ef02cb127ead9735d2a92bae7b462b57e8a7ef21e7586d008d4116d70062a60b77dcee18660bdccaf67550d2e00b00cefc7b6e95f5a985b7319021441ae4e7d928f2e2d3092a816937057bfbcc9116d6c9b87e2e9f97ade5573d037c7b1286a129e5b5b2e9acc7723e5732879c5211d57249fd

APT Groups

TEMP.Hermit

Korea, Democratic People's Republic of

Notes

<span style="font-size: 13pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CONCLUSION<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">The UNC2970 campaign exemplifies the evolving nature of cyber threats, particularly those orchestrated by state-sponsored actors like North Korea. By targeting job seekers and infiltrating critical sectors such as energy and aerospace, this advanced persistent threat poses significant risks to both individuals and organizations. The use of trojanized PDF readers and sophisticated malware like MistPen highlights the increasing complexity of cyber espionage tactics. It is imperative for organizations to adopt proactive security measures, such as maintaining up-to-date systems, implementing robust monitoring and incident response strategies, and fostering awareness of social engineering threats. Vigilance and comprehensive cybersecurity frameworks are essential to mitigating the impact of such malicious campaigns and securing critical infrastructure from future attacks.<div><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>

Mitigation

<div><span style="font-size: 13pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1134 - Access Token Manipulation<div style="margin-left:2.25pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:109pt;"><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. <a href="https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[26]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.<a href="https://docs.microsoft.com/windows/device-security/security-policy-settings/replace-a-process-level-token"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[27]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command <span style="font-size: 8.5pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">runas<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">.<a href="https://technet.microsoft.com/en-us/library/bb490994.aspx"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[28]</a></td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.</td></tr></tbody></table></div> <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1059 - Command and Scripting Interpreter <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:43pt;"><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can be used to automatically quarantine suspicious files.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent <a href="https://attack.mitre.org/techniques/T1059/005"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Visual Basic</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> and <a href="https://attack.mitre.org/techniques/T1059/007"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">JavaScript</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> scripts from executing potentially malicious downloaded content <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[48]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">.</td></tr><tr style="height:42.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1045</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Code Signing</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Where possible, only permit execution of signed scripts.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1042</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or Remove Feature or Program</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or remove any unnecessary or unused shells or interpreters.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Add-Type<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[49]</a></td></tr><tr style="height:94.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.<a href="https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[50]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.<a href="https://learn.microsoft.com/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[51]</a></td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1021</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Web-Based Content</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.</td></tr></tbody></table></div> <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1036 - Masquerading <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:43pt;"><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can be used to automatically quarantine suspicious files.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).</td></tr><tr style="height:42.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1045</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Code Signing</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Require signed binaries.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1022</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict File and Directory Permissions</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use file system access controls to protect folders such as C:\Windows\System32.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.</td></tr></tbody></table></div> <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1566 - Phishing <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:43pt;"><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can automatically quarantine suspicious files.</td></tr><tr style="height:42.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1021</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Web-Based Content</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.</td></tr><tr style="height:69.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1054"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1054</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1054"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Software Configuration</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.<a href="https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[14]</a><a href="https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[15]</a></td></tr><tr style="height:42.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Users can be trained to identify social engineering techniques and phishing emails.</td></tr></tbody></table></div> <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1055 - Process Injection <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><thead><tr style="height:37.75pt;"><th style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</th><th style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</th><th style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</th></tr><tr style="height:56.5pt;"><th style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-weight: 400; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></th><th style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-weight: 400; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></th><th style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 400; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection. <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-weight: 400; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[85]</a></th></tr></thead><tbody><tr style="height:69.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.</td></tr></tbody></table></div> <span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1574 - Hijack Execution Flow <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:70pt;"><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1013"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1013</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1013"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application Developer Guidance</a></td><td style="border-width: 1.5pt 0.75pt 0.75pt; border-style: solid; border-color: rgb(222, 226, 230) rgb(223, 223, 223) rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.<a href="https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[7]</a></td></tr><tr style="height:186.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use auditing tools capable of detecting hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for hijacking weaknesses.<a href="https://github.com/mattifestation/PowerSploit"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[8]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Find and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them. Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate.<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries. Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations.<a href="http://msdn.microsoft.com/en-us/library/ms682425"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[9]</a><a href="https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security?redirectedfrom=MSDN"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[10]</a><a href="https://skanthak.homepage.t-online.de/sentinel.html"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[11]</a></td></tr><tr style="height:69.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).</td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.</td></tr><tr style="height:69.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1022</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict File and Directory Permissions</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Install software in write-protected locations. Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard library folders.</td></tr><tr style="height:133.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1044"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1044</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1044"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Library Loading</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions (e.g. <span style="font-size: 8.5pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">%SYSTEMROOT%<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">)to be used before local directory DLLs (e.g. a user's home directory)<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">The Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode. The associated Windows Registry key for this is located at <span style="font-size: 8.5pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode<a href="https://msrc-blog.microsoft.com/2010/08/23/more-information-about-the-dll-preloading-remote-attack-vector/"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[12]</a><a href="https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[13]</a></td></tr><tr style="height:55.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1024"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1024</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1024"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Registry Permissions</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.</td></tr><tr style="height:42.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1051</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Update Software</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Update software regularly to include patches that fix DLL side-loading vulnerabilities.</td></tr><tr style="height:96.25pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1052"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1052</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1052"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Control</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Turn off UAC's privilege elevation for standard users <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> to automatically deny elevation requests, add: <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">"ConsentPromptBehaviorUser"=dword:00000000<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. Consider enabling installer detection for all users by adding: <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">"EnableInstallerDetection"=dword:00000001<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. This will prompt for a password for installation and also log the attempt. To disable installer detection, instead add: <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">"EnableInstallerDetection"=dword:00000000<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. This may prevent potential elevation of privileges through exploitation during the process of UAC detecting the installer, but will allow the installation process to continue without being logged. <a href="https://seclists.org/fulldisclosure/2015/Dec/34"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[14]</a></td></tr><tr style="height:94.75pt;"><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-width: 0.75pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">C:<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> and system directories, such as <span style="font-size: 10pt; font-family: " color: rgb(28, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">C:\Windows\<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, to reduce places where malicious files could be placed for execution.</td></tr></tbody></table></div></div>