The MCPwn Campaign: Unauthorized Nginx Server Takeovers

Nginx UICVE-2026-33032vulnerability exploitation

The Nginx UI campaign involves exploitation of CVE-2026-33032. Threat actors are leveraging this vulnerability to potentially gain unauthorized access or control over Nginx UI instances.

Indicators of Compromise

Hashes (2)

6c8efbcef3af80a574cb2aa2224c145bb2e37c2f3d3f091571708288ceb22d5f12d399e6966db58f6d189d606ac34cc8

IPv4 (1)

37.27.244.222

Notes

<div class="content-body">CONCLUSIONWhile the provided article is extremely limited, it suggests a potential vulnerability (CVE-2026-33032) in Nginx UI is being actively investigated. The lack of detailed information makes assessing the full scope and impact challenging. Organizations using Nginx UI should prioritize investigating CVE-2026-33032 and applying any available patches or workarounds. SOCRadar's IOC Radar can be used to investigate the CVE and any related indicators. Furthermore, SOCRadar's <a href="https://socradar.io/products/attack-surface-management/">Attack Surface Management </a>can help identify vulnerable Nginx UI instances within an organization's infrastructure. Monitoring the dark web for discussions related to Nginx UI exploits using SOCRadar's <a href="https://socradar.io/products/dark-web-monitoring/">Dark Web Monitoring</a> can provide early warnings of potential attacks. SOCRadar's <a href="https://socradar.io/products/cyber-threat-intelligence/">Cyber Threat Intelligence</a> can provide updates on threat actor TTPs.</div>

Mitigation

<div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#1f3864;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Technique ID</th><th style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#1f3864;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Technique Name</th><th style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#1f3864;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Mitigation ID</th><th style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#1f3864;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Mitigation Name</th><th style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#1f3864;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Description</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1033/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1033</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">System Owner/User Discovery</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">–</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">No specific mitigation</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">No MITRE-specific mitigation recommended for this discovery technique.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1028/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1028</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Operating System Configuration</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Restrict access to unnecessary system commands to reduce discovery surface.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1003/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1003</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">OS Credential Dumping</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1041/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1041</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Encrypt Sensitive Information</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Store credentials encrypted at rest.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1043/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1043</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Credential Access Protection</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enable Windows Credential Guard and Protected Users security group.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Restrict access to LSASS and apply least privilege principles.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1027/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1027</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Password Policies</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enforce complex, lengthy passwords to slow hash cracking.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1028</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Operating System Configuration</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Disable WDigest authentication to prevent plaintext credential caching.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1015/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1015</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Active Directory Configuration</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Restrict Domain Replication rights to prevent DCSync attacks.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1017</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">User Training</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Educate users about credential phishing and theft risks.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1059/007/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1059.007</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Command and Scripting Interpreter: JavaScript</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1040</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Behavior Prevention on Endpoint</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Use EDR solutions to block suspicious JavaScript behavior.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1038/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1038</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Execution Prevention</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Enforce application allowlisting (AppLocker, WDAC).</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1042</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Disable or Remove Feature or Program</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Disable WScript/CScript on systems where scripting is not required.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Privileged Account Management</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Restrict script engine execution rights to authorized users.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1082/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1082</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">System Information Discovery</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">–</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">No specific mitigation</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">No MITRE-specific mitigation recommended for this discovery technique.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Minimize access to commands revealing sensitive system configuration details.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1190/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1190</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Exploit Public-Facing Application</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1048/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1048</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Application Isolation and Sandboxing</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Run web applications in isolated environments to contain exploitation impact.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1030/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1030</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Network Segmentation</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Isolate internet-facing systems from the internal corporate network.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1016/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1016</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Vulnerability Scanning</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Conduct regular vulnerability scans and apply patches promptly.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Privileged Account Management</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Configure web service accounts with least privilege.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1050/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1050</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Exploit Protection</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Deploy WAF, IPS, and OS-level exploit mitigation technologies.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1051/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1051</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Update Software</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Keep all public-facing software patched and up to date.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1055/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1055</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Process Injection</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1040</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Use EDR to detect and block anomalous in-memory code execution.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Restrict access to sensitive system processes.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1505/003/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1505.003</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Server Software Component: Web Shell</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1042/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1042</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Disable or Remove Feature or Program</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Remove unused web frameworks and script interpreters from servers.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1018/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1018</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">User Account Management</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Restrict write permissions for web server service accounts.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1045/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1045</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Code Signing</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Verify integrity of files deployed to the server through signing.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1548/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1548</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Abuse Elevation Control Mechanism</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1047</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Audit</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Regularly audit UAC settings and privilege escalation events.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1052/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1052</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">User Account Control</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Configure UAC to the highest enforcement level.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Manage admin accounts with minimal required privileges.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1028</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Operating System Configuration</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Harden sudo rules; audit SUID/SGID binaries on Linux systems.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1090/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1090</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Proxy</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1037</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Filter Network Traffic</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Block connections to untrusted proxy servers at network perimeter.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1031</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Network Intrusion Prevention</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Deploy IPS rules to detect and block C2 traffic patterns through proxies.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1020/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1020</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">SSL/TLS Inspection</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Decrypt and inspect encrypted traffic to identify proxy-based C2 tunneling.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1059</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Command and Scripting Interpreter</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1045</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Code Signing</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Require digitally signed scripts (enforce PowerShell execution policy).</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1042</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Disable or Remove Feature or Program</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Disable unused scripting engines and interpreters.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1038</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enforce application allowlisting with AppLocker or WDAC.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Restrict script execution permissions to authorized roles.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1040</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Use EDR to detect and block malicious script execution behavior.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1083/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1083</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">File and Directory Discovery</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">–</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">No specific mitigation</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">No MITRE-specific mitigation recommended for this discovery technique.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Privileged Account Management</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Minimize read permissions on critical files and directories.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1078/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1078</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Valid Accounts</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1036/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1036</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Account Use Policies</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enforce multi-factor authentication (MFA) for all accounts.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Strictly control and monitor privileged account usage.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1027/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1027</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Password Policies</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enforce strong passwords and periodic mandatory rotation.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1015/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1015</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Active Directory Configuration</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Disable stale, unused, and dormant accounts promptly.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1017</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">User Training</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Train users to recognize phishing and credential theft attempts.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1027/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1027</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Obfuscated Files or Information</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1049/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1049</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Antivirus/Antimalware</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Deploy AV/EDR solutions capable of detecting obfuscated files and scripts.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1040/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1040</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Behavior Prevention on Endpoint</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Use behavioral analysis engines to detect and block obfuscated code execution.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1486/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1486</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Data Encrypted for Impact</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1053/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1053</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Data Backup</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Maintain offline, immutable backups and regularly test restoration procedures.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1040</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Use EDR to detect and block ransomware-like mass file encryption behavior.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Restrict broad file access permissions to limit encryption blast radius.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1573/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1573</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Encrypted Channel</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1031</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Network Intrusion Prevention</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Deploy IPS rules detecting abnormal C2 communication patterns over encrypted channels.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1037</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Filter Network Traffic</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Block connections to known malicious certificates and C2 IP addresses.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1020/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1020</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">SSL/TLS Inspection</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Decrypt and inspect TLS traffic to identify C2 communications hiding in encryption.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1203/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1203</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Exploitation for Client Execution</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1048/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1048</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Application Isolation and Sandboxing</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Run browsers and office applications in sandboxed environments.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1050/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1050</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Exploit Protection</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enable DEP, ASLR, CFG, and other OS-level exploit mitigation mechanisms.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1040</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Use EDR to detect post-exploitation behaviors following successful exploits.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1051</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Update Software</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Keep all client-side applications fully patched to remediate exploited vulnerabilities.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1071/001/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1071.001</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Application Layer Protocol: Web Protocols</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1031</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Network Intrusion Prevention</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Deploy IPS signatures detecting HTTP/HTTPS-based C2 communication patterns.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1037</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Filter Network Traffic</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Block known malicious domains and IP addresses at the network perimeter.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1018/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1018</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Remote System Discovery</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">–</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">No specific mitigation</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">No MITRE-specific mitigation recommended for this discovery technique.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1030/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1030</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Network Segmentation</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Limit network scanning blast radius through proper network segmentation.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/techniques/T1105/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1105</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Ingress Tool Transfer</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1031/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1031</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Network Intrusion Prevention</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Apply IPS signatures to detect and block malicious file downloads from external sources.</td></tr><tr style="height:0pt;"><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: top; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"> </td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;"><a href="https://attack.mitre.org/mitigations/M1037/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1037</a></td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Filter Network Traffic</td><td style="border-width: 0.5pt; border-style: solid; border-color: rgb(170, 170, 170); vertical-align: middle; padding: 5pt 7pt; overflow: hidden; overflow-wrap: break-word;">Restrict file downloads from untrusted or unknown external domains and IP addresses.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1021/001/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">T1021.001</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Remote Services: Remote Desktop Protocol</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1035/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1035</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Limit Access to Resource Over Network</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Restrict RDP access to authorized source IPs only; require VPN for remote access.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1030/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1030</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Network Segmentation</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Confine RDP traffic within trusted network zones and block from internet.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1028</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Operating System Configuration</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Disable RDP on all systems that do not explicitly require it.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1027/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1027</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Password Policies</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Enforce strong passwords and MFA for all RDP-enabled accounts.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1026</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Manage RDP accounts with least privilege; avoid RDP with domain admin accounts.</td></tr><tr style="height:0pt;"><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:top;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"> </td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant: normal; text-decoration: underline; vertical-align: baseline; white-space: pre-wrap;">M1047</a></td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Audit</td><td style="border-left:solid #aaaaaa 0.5pt;border-right:solid #aaaaaa 0.5pt;border-bottom:solid #aaaaaa 0.5pt;border-top:solid #aaaaaa 0.5pt;vertical-align:middle;background-color:#ebf0fa;padding:5pt 7pt 5pt 7pt;overflow:hidden;overflow-wrap:break-word;">Regularly audit active RDP sessions and logon activity for anomalies.</td></tr></tbody></table></div>