DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage

Cyber EspionageBackdoorMicrosoft EdgeUkraine

The DRILLAPP backdoor campaign targets Ukrainian entities, leveraging Microsoft Edge debugging features for stealth espionage. It is linked to Russian threat actors and shares similarities with previous campaigns by the Laundry Bear group.

APT Groups

Void Blizzard

Notes

<div>CONCLUSION</div><div>The DRILLAPP backdoor campaign represents a sophisticated cyber espionage effort targeting Ukrainian entities. By exploiting Microsoft Edge's debugging features, the attackers achieve stealth and persistence, making detection challenging. The campaign's evolution and use of legitimate services like Pastefy for C2 communications highlight the need for robust detection and mitigation strategies.</div><div> </div>

Mitigation

<h2 style="line-height:1.38;margin-top:18pt;margin-bottom:6pt;"><span style="font-size: 16pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION</h2><h2 style="line-height:1.38;margin-top:18pt;margin-bottom:6pt;"><span style="font-size: 16pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITRE ATT&CK TECHNIQUES</h2><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Techniques Addressed by Mitigation <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1051-Execution Prevention <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Domain</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Name</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1548</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Abuse Elevation Control Mechanism</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Elevated Execution with Prompt</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1547</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Boot or Logon Autostart Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1547/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Winlogon Helper DLL</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools like AppLocker <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> that are capable of auditing and/or blocking unknown DLLs.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Boot or Logon Autostart Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1547/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Kernel Modules and Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.<a href="https://patchwork.kernel.org/patch/8754821/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[4]</a><a href="https://en.wikibooks.org/wiki/Grsecurity/The_RBAC_System"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[5]</a><a href="https://www.kernel.org/doc/html/latest/security/self-protection.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[6]</a><a href="https://linux-audit.com/increase-kernel-integrity-with-disabled-linux-kernel-modules-loading/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[7]</a><a href="https://xorl.wordpress.com/2018/02/17/lkm-loading-kernel-restrictions/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[8]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Boot or Logon Autostart Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1547/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Shortcut Modification</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Prevents malicious shortcuts or LNK files from executing unwanted code by ensuring only authorized applications and scripts are allowed to run.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1059</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Command and Scripting Interpreter</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">PowerShell</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AppleScript</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Windows Command Shell</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Unix Shell</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. On ESXi hosts, the execInstalledOnly feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).<a href="https://cloud.google.com/blog/topics/threat-intelligence/vmware-detection-containment-hardening"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[10]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Visual Basic</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.<a href="https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[11]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Python</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist Python where not required.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.007</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">JavaScript</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist scripting where appropriate.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Network Device CLI</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization. <a href="https://tools.cisco.com/security/center/resources/integrity_assurance.html#39"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[12]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Cloud API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate to block use of PowerShell CmdLets or other host based resources to access cloud API resources.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.010</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AutoHotKey & AutoIT</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to prevent execution of AutoIt3.exe, AutoHotkey.exe, and other related features that may not be required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.011</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Lua</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist Lua interpreters where appropriate.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.013</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Container CLI/API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny scripting where appropriate. Tools such as Python or Go can utilize Kubernetes and Docker within a client library and execute commands within their application.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1609"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1609</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1609"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Container Administration Command</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use read-only containers, read-only file systems, and minimal images when possible to prevent the execution of commands.<a href="https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[13]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[14]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1611"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1611</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1611"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Escape to Host</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use read-only containers, read-only file systems, and minimal images when possible to prevent the running of commands.<a href="https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[13]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[14]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1546</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Screensaver</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Block .scr files from being executed from non-standard locations.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">LC_LOAD_DYLIB Addition</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Allow applications via known hashes.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Accessibility Features</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries can replace accessibility features binaries with alternate binaries to execute this technique. Identify and block potentially malicious software executed through accessibility features functionality by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AppCert DLLs</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.010</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AppInit DLLs</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1068"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1068</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1068"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exploitation for Privilege Escalation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[18]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1564</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hide Artifacts</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1564/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hidden Window</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit or restrict program execution using anti-virus software. On MacOS, allowlist programs that are allowed to have the plist tag. All other programs should be considered suspicious.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hide Artifacts</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1564/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Run Virtual Instance</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to mitigate installation and use of unapproved virtualization software.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1574</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hijack Execution Flow</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">DLL</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software executed through DLL hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.<a href="https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[19]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Dynamic Linker Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.007</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Path Interception by PATH Environment Variable</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.<a href="https://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[20]</a><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><a href="https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[21]</a><a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791851(v=ws.11)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[22]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Path Interception by Search Order Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.<a href="https://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[20]</a><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><a href="https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[21]</a><a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791851(v=ws.11)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[22]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Path Interception by Unquoted Path</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.<a href="https://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[20]</a><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><a href="https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[21]</a><a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791851(v=ws.11)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[22]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.012</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">COR_PROFILER</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.<a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1562</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Impair Defenses</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Disable or Modify Tools</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.011</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Spoof Security Alerting</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application controls to mitigate installation and use of payloads that may be utilized to spoof security alerting.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1490"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1490</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1490"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Inhibit System Recovery</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control configured to block execution of utilities such as diskshadow.exe that may not be required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1674"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1674</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1674"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Input Injection</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist scripting and use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1036</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Masquerading</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Match Legitimate Resource Name or Location</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Masquerade File Type</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure that input sanitization is performed and that files are validated properly before execution; furthermore, implement a strict allow list to ensure that only authorized file types are processed.<a href="https://blog.yeswehack.com/yeswerhackers/file-upload-attacks-part-2/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[23]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Restrict and/or block execution of files where headers and extensions do not match.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1106"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1106</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1106"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Native API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software executed that may be executed through this technique by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1219</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Access Tools</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to mitigate installation and use of unapproved software that can be used for remote access.</td></tr><tr style="height:84pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">IDE Tunneling</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use Group Policies to require user authentication by disabling anonymous tunnel access, preventing any unauthenticated tunnel creation or usage. Disable the Visual Studio Dev Tunnels feature to block tunnel-related commands, allowing only minimal exceptions for utility functions (unset, echo, ping, and user). Restrict tunnel access to approved Microsoft Entra tenant IDs by specifying allowed tenants; all other users are denied access by default.<a href="https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/policies"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[24]</a><a href="https://techcommunity.microsoft.com/blog/azuredevcommunityblog/manage-dev-tunnels-with-group-policies/4149472"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[25]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Desktop Software</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to mitigate installation and use of unapproved software that can be used for remote access.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1505"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1505</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1505/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1505"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Server Software Component</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1505/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">IIS Components</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict unallowed ISAPI extensions and filters from running by specifying a list of ISAPI extensions and filters that can run on IIS.<a href="https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/isapicgirestriction/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[26]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1129"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1129</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1129"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Shared Modules</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown modules from being loaded.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1176</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Software Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set an extension allow or deny list as appropriate for your security policy.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Browser Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set a browser extension allow or deny list as appropriate for your security policy.<a href="http://www.technospot.net/blogs/block-chrome-extensions-using-google-chrome-group-policy-settings/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[27]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">IDE Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set an IDE extension allow or deny list as appropriate for your security policy.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1553</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Subvert Trust Controls</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded through the Apple Store (or other legitimate repositories) which can help mitigate some of these issues. Also enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious content.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Gatekeeper Bypass</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded through the Apple Store which can help mitigate some of these issues.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">SIP and Trust Provider Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Mark-of-the-Web Bypass</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider blocking container file types at web and/or email gateways. Consider unregistering container file extensions in Windows File Explorer.<a href="https://insights.sei.cmu.edu/cert/2019/09/the-dangers-of-vhd-and-vhdx-files.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[28]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1218</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">System Binary Proxy Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Compiled HTML File</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Control Panel</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious and unknown .cpl files by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">CMSTP</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">InstallUtil</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Mshta</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[29]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Odbcconf</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Regsvcs/Regasm</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.012</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Verclsid</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.013</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Mavinject</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of mavinject.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/014"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.014</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/014"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">MMC</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of MMC if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:149.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/015"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.015</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/015"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Electron Applications</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Where possible, enforce binary and application integrity with digital signature verification to prevent untrusted code from executing. For example, do not use shell.openExternal with untrusted content.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Where possible, set nodeIntegration to false, which disables access to the Node.js function.<a href="https://medium.com/certik/vulnerability-in-electron-based-application-unintentionally-giving-malicious-code-room-to-run-e2e1447d01b8"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[30]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> By disabling access to the Node.js function, this may limit the ability to execute malicious commands by injecting JavaScript code.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Do not disable webSecurity, which may allow for users of the application to invoke malicious content from online sources.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1216</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">System Script Proxy Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">PubPrn</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">SyncAppvPublishingServer</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1080</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Taint Shared Content</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1127</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Trusted Developer Utilities Proxy Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain developer utilities should be blocked or restricted if not required.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">MSBuild</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[29]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">JamPlus</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider blocking or restricting JamPlus if not required.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1204</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">User Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control may be able to prevent the running of executables masquerading as other files.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Malicious File</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control may be able to prevent the running of executables masquerading as other files.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Malicious Copy and Paste</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1047"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1047</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1047"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Windows Management Instrumentation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[29]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1220"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1220</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1220"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">XSL Script Processing</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038 Execution Prevention <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Domai<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">n</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Name</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1548</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Abuse Elevation Control Mechanism</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Elevated Execution with Prompt</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1547</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Boot or Logon Autostart Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1547/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Winlogon Helper DLL</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools like AppLocker <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> that are capable of auditing and/or blocking unknown DLLs.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Boot or Logon Autostart Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1547/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Kernel Modules and Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.<a href="https://patchwork.kernel.org/patch/8754821/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[4]</a><a href="https://en.wikibooks.org/wiki/Grsecurity/The_RBAC_System"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[5]</a><a href="https://www.kernel.org/doc/html/latest/security/self-protection.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[6]</a><a href="https://linux-audit.com/increase-kernel-integrity-with-disabled-linux-kernel-modules-loading/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[7]</a><a href="https://xorl.wordpress.com/2018/02/17/lkm-loading-kernel-restrictions/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[8]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1547"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Boot or Logon Autostart Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1547/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Shortcut Modification</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Prevents malicious shortcuts or LNK files from executing unwanted code by ensuring only authorized applications and scripts are allowed to run.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1059</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Command and Scripting Interpreter</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">PowerShell</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AppleScript</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Windows Command Shell</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Unix Shell</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. On ESXi hosts, the execInstalledOnly feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).<a href="https://cloud.google.com/blog/topics/threat-intelligence/vmware-detection-containment-hardening"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[10]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Visual Basic</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.<a href="https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[11]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Python</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist Python where not required.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.007</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">JavaScript</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist scripting where appropriate.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Network Device CLI</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization. <a href="https://tools.cisco.com/security/center/resources/integrity_assurance.html#39"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[12]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Cloud API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate to block use of PowerShell CmdLets or other host based resources to access cloud API resources.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.010</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AutoHotKey & AutoIT</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to prevent execution of AutoIt3.exe, AutoHotkey.exe, and other related features that may not be required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.011</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Lua</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist Lua interpreters where appropriate.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.013</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Container CLI/API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny scripting where appropriate. Tools such as Python or Go can utilize Kubernetes and Docker within a client library and execute commands within their application.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1609"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1609</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1609"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Container Administration Command</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use read-only containers, read-only file systems, and minimal images when possible to prevent the execution of commands.<a href="https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[13]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[14]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1611"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1611</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1611"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Escape to Host</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use read-only containers, read-only file systems, and minimal images when possible to prevent the running of commands.<a href="https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[13]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.<a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[14]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1546</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Screensaver</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Block .scr files from being executed from non-standard locations.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">LC_LOAD_DYLIB Addition</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Allow applications via known hashes.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Accessibility Features</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries can replace accessibility features binaries with alternate binaries to execute this technique. Identify and block potentially malicious software executed through accessibility features functionality by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AppCert DLLs</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.010</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1546"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Event Triggered Execution</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1546/010"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">AppInit DLLs</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1068"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1068</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1068"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exploitation for Privilege Escalation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[18]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1564</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hide Artifacts</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1564/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hidden Window</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Limit or restrict program execution using anti-virus software. On MacOS, allowlist programs that are allowed to have the plist tag. All other programs should be considered suspicious.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1564"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hide Artifacts</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1564/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Run Virtual Instance</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to mitigate installation and use of unapproved virtualization software.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1574</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Hijack Execution Flow</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">DLL</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software executed through DLL hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.<a href="https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[19]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Dynamic Linker Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.007</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Path Interception by PATH Environment Variable</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.<a href="https://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[20]</a><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><a href="https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[21]</a><a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791851(v=ws.11)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[22]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Path Interception by Search Order Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.<a href="https://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[20]</a><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><a href="https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[21]</a><a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791851(v=ws.11)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[22]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Path Interception by Unquoted Path</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.<a href="https://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[20]</a><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><a href="https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[21]</a><a href="https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791851(v=ws.11)?redirectedfrom=MSDN"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[22]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.012</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1574/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">COR_PROFILER</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.<a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1562</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Impair Defenses</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Disable or Modify Tools</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.011</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1562/011"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Spoof Security Alerting</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application controls to mitigate installation and use of payloads that may be utilized to spoof security alerting.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1490"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1490</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1490"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Inhibit System Recovery</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control configured to block execution of utilities such as diskshadow.exe that may not be required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1674"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1674</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1674"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Input Injection</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Denylist scripting and use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1036</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Masquerading</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Match Legitimate Resource Name or Location</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1036/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Masquerade File Type</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure that input sanitization is performed and that files are validated properly before execution; furthermore, implement a strict allow list to ensure that only authorized file types are processed.<a href="https://blog.yeswehack.com/yeswerhackers/file-upload-attacks-part-2/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[23]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Restrict and/or block execution of files where headers and extensions do not match.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1106"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1106</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1106"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Native API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software executed that may be executed through this technique by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1219</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Access Tools</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to mitigate installation and use of unapproved software that can be used for remote access.</td></tr><tr style="height:84pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">IDE Tunneling</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use Group Policies to require user authentication by disabling anonymous tunnel access, preventing any unauthenticated tunnel creation or usage. Disable the Visual Studio Dev Tunnels feature to block tunnel-related commands, allowing only minimal exceptions for utility functions (unset, echo, ping, and user). Restrict tunnel access to approved Microsoft Entra tenant IDs by specifying allowed tenants; all other users are denied access by default.<a href="https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/policies"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[24]</a><a href="https://techcommunity.microsoft.com/blog/azuredevcommunityblog/manage-dev-tunnels-with-group-policies/4149472"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[25]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1219/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Desktop Software</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control to mitigate installation and use of unapproved software that can be used for remote access.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1505"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1505</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1505/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1505"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Server Software Component</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1505/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">IIS Components</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict unallowed ISAPI extensions and filters from running by specifying a list of ISAPI extensions and filters that can run on IIS.<a href="https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/isapicgirestriction/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[26]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1129"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1129</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1129"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Shared Modules</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown modules from being loaded.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1176</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Software Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set an extension allow or deny list as appropriate for your security policy.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Browser Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set a browser extension allow or deny list as appropriate for your security policy.<a href="http://www.technospot.net/blogs/block-chrome-extensions-using-google-chrome-group-policy-settings/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[27]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1176/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">IDE Extensions</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Set an IDE extension allow or deny list as appropriate for your security policy.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1553</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Subvert Trust Controls</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded through the Apple Store (or other legitimate repositories) which can help mitigate some of these issues. Also enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious content.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Gatekeeper Bypass</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">System settings can prevent applications from running that haven't been downloaded through the Apple Store which can help mitigate some of these issues.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">SIP and Trust Provider Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1553/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Mark-of-the-Web Bypass</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider blocking container file types at web and/or email gateways. Consider unregistering container file extensions in Windows File Explorer.<a href="https://insights.sei.cmu.edu/cert/2019/09/the-dangers-of-vhd-and-vhdx-files.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[28]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1218</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">System Binary Proxy Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Compiled HTML File</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Control Panel</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify and block potentially malicious and unknown .cpl files by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like Windows Defender Application Control<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[15]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">CMSTP</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">InstallUtil</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.005</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/005"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Mshta</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[29]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.008</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/008"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Odbcconf</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.009</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/009"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Regsvcs/Regasm</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.012</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/012"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Verclsid</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.013</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/013"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Mavinject</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of mavinject.exe if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/014"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.014</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/014"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">MMC</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of MMC if it is not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:149.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/015"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.015</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1218/015"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Electron Applications</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Where possible, enforce binary and application integrity with digital signature verification to prevent untrusted code from executing. For example, do not use shell.openExternal with untrusted content.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Where possible, set nodeIntegration to false, which disables access to the Node.js function.<a href="https://medium.com/certik/vulnerability-in-electron-based-application-unintentionally-giving-malicious-code-room-to-run-e2e1447d01b8"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[30]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> By disabling access to the Node.js function, this may limit the ability to execute malicious commands by injecting JavaScript code.<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Do not disable webSecurity, which may allow for users of the application to invoke malicious content from online sources.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1216</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">System Script Proxy Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">PubPrn</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1216/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">SyncAppvPublishingServer</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1080</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Taint Shared Content</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control <a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> tools, like AppLocker, <a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> <a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> or Software Restriction Policies <a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[16]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> where appropriate. <a href="https://technet.microsoft.com/en-us/library/ee791851.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[17]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1127</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Trusted Developer Utilities Proxy Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Certain developer utilities should be blocked or restricted if not required.</td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">MSBuild</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[29]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1127/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">JamPlus</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Consider blocking or restricting JamPlus if not required.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1204</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">User Execution</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control may be able to prevent the running of executables masquerading as other files.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Malicious File</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Application control may be able to prevent the running of executables masquerading as other files.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.004</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/004"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Malicious Copy and Paste</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).<a href="https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[9]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1047"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1047</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1047"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Windows Management Instrumentation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.<a href="https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[29]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1220"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1220</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1220"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">XSL Script Processing</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1030 Network Segmentation <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Domain</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Name</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dee2e6 1.2500025000000001pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:bottom;background-color:#efefef;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1098"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1098</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1098"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Account Manipulation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dee2e6 1.2500025000000001pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1098/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1098/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Additional Cloud Credentials</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1557"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1557</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1557"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Adversary-in-the-Middle</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1557/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1557/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">LLMNR/NBT-NS Poisoning and SMB Relay</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1612"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1612</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1612"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Build Image on Host</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1613"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1613</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1613"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Container and Resource Discovery</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1136"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1136</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1136"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Create Account</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1136/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1136/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Domain Account</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1136/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1136/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Cloud Account</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1602"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1602</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1602"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Data from Configuration Repository</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Segregate SNMP traffic on a separate management network.<a href="https://us-cert.cisa.gov/ncas/alerts/TA17-156A"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1602/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1602/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">SNMP (MIB Dump)</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Segregate SNMP traffic on a separate management network.<a href="https://us-cert.cisa.gov/ncas/alerts/TA17-156A"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1602/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1602/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Network Device Configuration Dump</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Segregate SNMP traffic on a separate management network.<a href="https://us-cert.cisa.gov/ncas/alerts/TA17-156A"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[1]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1565"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1565</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1565"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Data Manipulation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1565/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1565/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Runtime Data Manipulation</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1610"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1610</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1610"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Deploy Container</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1482"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1482</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1482"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Domain Trust Discovery</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Employ network segmentation for sensitive domains.<a href="https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[2]</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1048</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exfiltration Over Alternative Protocol</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.<a href="https://technet.microsoft.com/en-us/library/cc700828.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exfiltration Over Symmetric Encrypted Non-C2 Protocol</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.<a href="https://technet.microsoft.com/en-us/library/cc700828.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exfiltration Over Asymmetric Encrypted Non-C2 Protocol</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.<a href="https://technet.microsoft.com/en-us/library/cc700828.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1048/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exfiltration Over Unencrypted Non-C2 Protocol</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.<a href="https://technet.microsoft.com/en-us/library/cc700828.aspx"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[3]</a></td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1190"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1190</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1190"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exploit Public-Facing Application</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1210"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1210</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1210"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Exploitation of Remote Services</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1133"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1133</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1133"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">External Remote Services</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1046"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1046</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1046"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Network Service Discovery</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper network segmentation is followed to protect critical servers and devices.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1040"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1040</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1040"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Network Sniffing</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as <a href="https://attack.mitre.org/techniques/T1557/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">LLMNR/NBT-NS Poisoning and SMB Relay</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1095"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1095</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1095"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Non-Application Layer Protocol</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1571"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1571</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1571"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Non-Standard Port</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1563"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1563</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1563"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Service Session Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enable firewall rules to block unnecessary traffic between network security zones within a network.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1563/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.002</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1563/002"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">RDP Hijacking</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enable firewall rules to block RDP traffic between network security zones within a network.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1021</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.001</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Services</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1021/001"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Desktop Protocol</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Do not leave RDP accessible from the internet. Enable firewall rules to block RDP traffic between network security zones within a network.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.003</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Services</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1021/003"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Distributed Component Object Model</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enable Windows firewall, which prevents DCOM instantiation by default.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.006</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Remote Services</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1021/006"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Windows Remote Management</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices.<a href="https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">[4]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1489"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1489</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1489"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Service Stop</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.</td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1072"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1072</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1072"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Software Deployment Tools</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper system isolation for critical network systems through use of firewalls.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1199"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1199</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1199"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Trusted Relationship</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network segmentation can be used to isolate infrastructure components that do not require broad network access.</td></tr><tr style="height:42.75pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1552"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1552</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1552/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">.007</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1552"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Unsecured Credentials</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">: <a href="https://attack.mitre.org/techniques/T1552/007"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Container API</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.</td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Enterprise</td><td colspan="2" style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1669"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">T1669</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1669"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Wi-Fi Networks</a></td><td style="border-left:solid #dfdfdf 0.416667pt;border-right:solid #dfdfdf 0.416667pt;border-bottom:solid #dfdfdf 0.416667pt;border-top:solid #dfdfdf 0.416667pt;vertical-align:top;background-color:#efefef;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Network segmentation can be used to isolate infrastructure components that do not require broad network access. Separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resour</td></tr></tbody></table></div>