Coordinated Credential Abuse Against Enterprise VPN and Email Security Gateways 2

Credential sprayingVPN edge pressureCisco SSL VPN targetingChina-nexus APT (UAT-9686)

A large-scale, automated campaign focused on abusing login credentials to access enterprise VPN authentication systems, specifically Cisco SSL VPN and Palo Alto Networks GlobalProtect. The operation relied on scripted authentication attempts instead of exploiting technical flaws in the platforms.

Notes

<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CONCLUSION<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This campaign highlights a dual challenge for defenders. Attackers combine large-scale credential abuse on VPN gateways with focused attacks on email security appliances, gaining access through weak credentials and then hiding activity using tunnels and log manipulation, which makes detection harder.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">SOCRadar can support SOC teams by bringing these signals together in one place. Its <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/">Threat Intelligence</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> and <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/solutions/ioc-enrichment-soar-integration/">IOC enrichment</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> integrations help teams quickly assess malicious IPs and indicators, while <a href="https://socradar.io/products/attack-surface-management/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Attack Surface Management<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">and <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/category/digital-risk-protection/">Digital Risk Protection</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> help identify exposed VPN and gateway assets that match the attacker’s focus. The <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/incident-response/">Incident Response</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> capabilities allow analysts to link abnormal login activity with follow-up behaviors such as tunneling or missing logs, enabling faster<div><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>

Mitigation

<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1133 - External Remote Services <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1042</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or Remove Feature or Program</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or block remotely available services that may be unnecessary.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1035"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1035</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1035"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit Access to Resource Over Network</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1032"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1032</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1032"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Multi-factor Authentication</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of <a href="https://attack.mitre.org/techniques/T1111"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Multi-Factor Authentication Interception</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> techniques for some two-factor authentication implementations.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1030"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1030</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1030"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Segmentation</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1021</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Web-Based Content</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict all traffic to and from public Tor nodes. <a href="https://www.cisa.gov/sites/default/files/publications/AA20-183A_Defending_Against_Malicious_Cyber_Activity_Originating_from_Tor_S508C.pdf"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[61]</a></td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1190 - Exploit Public-Facing Application <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1048"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1048</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1048"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application Isolation and Sandboxing</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application isolation will limit what other processes and system features the exploited target can access.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1050"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1050</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1050"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Exploit Protection</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.</td></tr><tr style="height: 68.5pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1037</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Filter Network Traffic</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1035"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1035</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1035"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit Access to Resource Over Network</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1030"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1030</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1030"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Segmentation</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1051</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Update Software</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Update software regularly by employing patch management for externally exposed applications.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1016"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1016</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1016"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Vulnerability Scanning</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.<a href="https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[10]</a></td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1562.002 - Disable Windows Event Logging <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider periodic review of <span style="font-size: 8.5pt; font-family: " color: rgb(29, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">auditpol<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> settings for Administrator accounts and perform dynamic baselining on SIEM(s) to investigate potential malicious activity. Also ensure that the EventLog service and its threads are properly running.</td></tr><tr style="height: 68.5pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1022</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict File and Directory Permissions</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files. Ensure .evtx files, which are located at <span style="font-size: 8.5pt; font-family: " color: rgb(29, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">C:\Windows\system32\Winevt\Logs<a href="https://forensicswiki.xyz/wiki/index.php?title=Windows_XML_Event_Log_(EVTX)"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[17]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, have the proper file permissions for limited, legitimate access and audit policies for detection.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1024"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1024</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1024"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Registry Permissions</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.<a href="https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[18]</a></td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1572 - Protocol Tunneling <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1037</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Filter Network Traffic</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider filtering network traffic to untrusted or known bad domains and resources.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1505.003 - Web Shell <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1042</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Disable or Remove Feature or Program</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider disabling functions from web technologies such as PHP’s <span style="font-size: 10pt; font-family: " color: rgb(29, 34, 38); background-color: rgb(230, 230, 230); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">evaI()<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> that may be abused for web shells.<a href="https://itsyndicate.org/blog/disabling-dangerous-php-functions/"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[78]</a></td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.<a href="https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[79]</a></td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1090.002 - External Proxy <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 82pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.<a href="https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[33]</a></td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1059.006 - Python <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can be used to automatically quarantine suspicious files.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Inventory systems for unauthorized Python installations.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist Python where not required.</td></tr><tr style="height: 42.25pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1033"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1033</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1033"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit Software Installation</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Prevent users from installing Python where not required.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1071.001 - Web Protocols <div align="left" style="margin-left: 0pt;"><table style="border: none; border-collapse: collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height: 37.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: bottom; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height: 68.5pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1037</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Filter Network Traffic</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict and monitor outbound web traffic (HTTP/HTTPS) from critical servers to only approved destinations. Limiting the ability to initiate outbound HTTP/HTTPS connections, especially from public-facing servers, can prevent attackers from using tools like curl or wget to communicate with external C2 servers or download malicious payloads.</td></tr><tr style="height: 55.75pt;"><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-width: 0.833333pt; border-style: solid; border-color: rgb(223, 223, 223); vertical-align: top; background-color: rgb(242, 242, 242); padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.</td></tr></tbody></table></div>