Crescentharvets Campaign Targets Iranian Protest Supporters

CRESCENTHARVESTRATremote access trojaninformation stealersocial engineeringLNK filesDLL side-loadingcredential harvestingservicelog-information[.]comRedKittenSloppyMIO

The CRESCENTHARVEST campaign targets supporters of Iranian protests using a remote access trojan (RAT) and information stealer to steal information and conduct espionage. The campaign uses social engineering techniques with Farsi-language content related to the protests to lure victims.

Notes

<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">NOTES <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CONCLUSION<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CRESCENTHARVEST is a deliberate espionage campaign orchestrated by an Iran-aligned threat actor, specifically designed to target individuals supporting Iranian protests. What makes this operation particularly dangerous is how the attackers weaponize current events—using Farsi-language materials about the protests as bait to deliver Remote Access Trojans and information-stealing malware. Their goal is clear: steal credentials and maintain persistent access for long-term surveillance. We've now seen two significant campaigns emerge in the wake of Iran's 2025 nationwide protests, with CRESCENTHARVEST following the earlier RedKitten operation.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Defending Against Nation-State Campaigns with SOCRadar<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If your organization is worried about sophisticated, state-sponsored threats like CRESCENTHARVEST, SOCRadar's Extended Threat Intelligence platform offers several layers of protection that work together to keep you secure:<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Stay ahead of emerging threats with<a href="https://socradar.io/products/cyber-threat-intelligence/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/products/cyber-threat-intelligence/">Cyber Threat Intelligence</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. This module doesn't just wait for attacks to happen—it actively hunts for signs of Iran-aligned APT activity before they reach your doorstep. You'll get real-time alerts whenever new campaigns targeting your sector appear, and our behavioral analytics help you track how CRESCENTHARVEST and similar threats are evolving their tactics.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Catch breaches early through<a href="https://socradar.io/products/dark-web-monitoring/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/products/dark-web-monitoring/">Dark Web Monitoring</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. Here's the reality: if CRESCENTHARVEST manages to steal credentials from your employees, those stolen details will likely end up for sale on underground forums. Our continuous surveillance of these hidden marketplaces means you'll know immediately if your organization's data has been compromised, giving your security team precious time to respond before attackers can do serious damage.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Block social engineering at the source with<a href="https://socradar.io/products/brand-protection/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/products/brand-protection/">Brand Protection</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. CRESCENTHARVEST relies heavily on tricking victims through fake domains and impersonation. This module identifies phishing sites, fraudulent content, and impersonation attempts targeting your brand or industry—and our automated takedown service helps remove these threats before your employees or partners fall victim.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">See your vulnerabilities through attackers' eyes using<a href="https://socradar.io/products/attack-surface-management/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/products/attack-surface-management/">Attack Surface Management</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">. This tool maps out every external-facing asset in your digital environment, showing you exactly what threat actors like the CRESCENTHARVEST operators can see and potentially exploit. Regular vulnerability assessments help you patch weaknesses before they become entry points.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">You can also use<a href="https://socradar.io/labs/ioc-radar/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/labs/ioc-radar/">SOCRadar's IOC Radar</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> to quickly investigate any suspicious indicators—domains, IP addresses, or file hashes—that might be connected to CRESCENTHARVEST malware. The tool's built-in MITRE ATT&CK mapping helps your team understand which techniques the attackers are using, making it easier to strengthen your defenses in the right places.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Don't forget about your supply chain either.<a href="https://socradar.io/products/supply-chain-intelligence/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/products/supply-chain-intelligence/">Supply Chain Intelligence</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> monitors whether your partners, vendors, or suppliers have been compromised by campaigns like this, helping you prevent attackers from using trusted relationships as a backdoor into your organization.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ready to strengthen your defenses? Don't wait for a breach to happen.<a href="https://socradar.io/request-demo/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/request-demo/">Request a personalized demo</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> to see how SOCRadar works for your specific environment, or get started immediately with a<a href="https://socradar.io/labs/app/dark-web-report/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"><a href="https://socradar.io/labs/app/dark-web-report/">free Dark Web Report</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> to discover what threats already exist against your organization.<div><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>

Mitigation

<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1036 - Masquerading <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can be used to automatically quarantine suspicious files.</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit user accounts to ensure that each one has a defined purpose.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1045</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Code Signing</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Require signed binaries.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1022</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict File and Directory Permissions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use file system access controls to protect folders such as C:\Windows\System32.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1176 - Browser Extensions <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure extensions that are installed are the intended ones, as many malicious extensions will masquerade as legitimate ones.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set a browser extension allow or deny list as appropriate for your security policy.<a href="http://www.technospot.net/blogs/block-chrome-extensions-using-google-chrome-group-policy-settings/"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[23]</a></td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1033"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1033</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1033"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit Software Installation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Only install browser extensions from trusted sources that can be verified. Browser extensions for some browsers can be controlled through Group Policy. Change settings to prevent the browser from installing extensions without sufficient permissions.</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1051</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Update Software</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure operating systems and browsers are using the most current version.</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Close out all browser sessions when finished using them to prevent any potentially malicious extensions from continuing to run.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1083 - File and Directory Discovery<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1560 - Archive Collected Data <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System scans can be performed to identify unauthorized archival utilities.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1090 - Proxy <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:56.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1037</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Filter Network Traffic</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like <a href="https://attack.mitre.org/techniques/T1090/004"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Domain Fronting</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">.</td></tr><tr style="height:83.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. <a href="https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[88]</a></td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1020"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1020</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1020"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">SSL/TLS Inspection</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1566 - Phishing <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1049</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Antivirus/Antimalware</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Anti-virus can automatically quarantine suspicious files.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1047</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Audit</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1031</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network Intrusion Prevention</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1021</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Web-Based Content</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.</td></tr><tr style="height:70pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1054"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1054</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1054"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Software Configuration</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.<a href="https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[21]</a><a href="https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[22]</a></td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1017</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Training</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Users can be trained to identify social engineering techniques and phishing emails.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1140 - Deobfuscate/Decode Files or Information<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features. <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1546 - Event Triggered Execution <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1051</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Update Software</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Perform regular software updates to mitigate exploitation risk.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1056 - Input Capture<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1547 - Boot or Logon Autostart Execution<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.