auren-research/cyber-sec huggingface dataset:
type: course-of-action
spec_version: 2.1
id: course-of-action--b52f41b9-ccf6-4da7-a6c0-167eeb71fbd8
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1176
external_id: T1176
source_name: Technospot Chrome Extensions GP
description: Mohta, A. (n.d.). Block Chrome Extensions using Google Chrome Group Policy Settings. Retrieved January 10, 2018.
url: http://www.technospot.net/blogs/block-chrome-extensions-using-google-chrome-group-policy-settings/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:10.304Z
name: Browser Extensions Mitigation
description: Only install browser extensions from trusted sources that can be verified. Ensure extensions that are installed are the intended ones as many malicious extensions will masquerade as legitimate ones.

Browser extensions for some browsers can be controlled through Group Policy. Set a browser extension white or black list as appropriate for your security policy. (Citation: Technospot Chrome Extensions GP)

Change settings to prevent the browser from installing extensions without sufficient permissions.

Close out all browser sessions when finished using them.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-12-24T14:02:11.579Z
name: Software Configuration
description: Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:

Conduct a Security Review of Application Settings:

- Review the software documentation to identify recommended security configurations.
- Compare default settings against organizational policies and compliance requirements.

Implement Access Controls and Permissions:

- Restrict access to sensitive features or data within the software.
- Enforce least privilege principles for all roles and accounts interacting with the software.

Enable Logging and Monitoring:

- Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity.
- Integrate logs with a centralized monitoring solution, such as a SIEM.

Update and Patch Software Regularly:

- Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities.
- Use automated patch management tools to streamline the update process.

Disable Unnecessary Features or Services:

- Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.

Test Configuration Changes:

- Perform configuration changes in a staging environment before applying them in production.
- Conduct regular audits to ensure that settings remain aligned with security policies.

*Tools for Implementation*

Configuration Management Tools:

- Ansible: Automates configuration changes across multiple applications and environments.
- Chef: Ensures consistent application settings through code-based configuration management.
- Puppet: Automates software configurations and audits changes for compliance.

Security Benchmarking Tools:

- CIS-CAT: Provides benchmarks and audits for secure software configurations.
- Aqua Security Trivy: Scans containerized applications for configuration issues.

Vulnerability Management Solutions:

- Nessus: Identifies misconfigurations and suggests corrective actions.

Logging and Monitoring Tools:

- Splunk: Aggregates and analyzes application logs to detect suspicious activity.
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
type: course-of-action
spec_version: 2.1
id: course-of-action--b5dbb4c5-b0b1-40b1-80b6-e9e84ab90067
created: 2019-07-19T14:40:23.529Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M1054
external_id: M1054
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: course-of-action
spec_version: 2.1
id: course-of-action--b70627f7-3b43-4c6f-8fc0-c918c41f8f72
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1207
external_id: T1207
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:10.518Z
name: DCShadow Mitigation
description: This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of AD design features. For example, mitigating specific AD API calls will likely have unintended side effects, such as preventing DC replication from operating properly. Efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identification of subsequent malicious behavior.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--b7b2c89c-09c1-4b71-ae7c-000ec2893aab
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1050
external_id: T1050
source_name: Beechey 2010
description: Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
url: http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599
source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
url: http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
source_name: NSA MS AppLocker
description: NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
url: https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm
source_name: Corio 2008
description: Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
url: http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx
source_name: TechNet Applocker vs SRP
description: Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
url: https://technet.microsoft.com/en-us/library/ee791851.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:10.695Z
name: New Service Mitigation
description: Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new services.

Identify and block unnecessary system utilities or potentially malicious software that may be used to create services by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--b8d57b16-d8e2-428c-a645-1083795b3445
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1092
external_id: T1092
source_name: Microsoft Disable Autorun
description: Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
url: https://support.microsoft.com/en-us/kb/967715
source_name: TechNet Removable Media Control
description: Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.
url: https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:10.874Z
name: Communication Through Removable Media Mitigation
description: Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--b9f0c069-abbe-4a07-a245-2481219a1463
created: 2019-06-11T17:06:56.230Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M1048
external_id: M1048
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-05-09T16:23:40.086Z
name: Application Isolation and Sandboxing
description: Application Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code from affecting the rest of the system or network by limiting access to sensitive resources and critical operations. The goal is to contain threats and minimize their impact. This mitigation can be implemented through the following measures:

Browser Sandboxing:

- Use Case: Implement browser sandboxing to isolate untrusted web content and prevent malicious web pages or scripts from accessing sensitive system resources or initiating unauthorized downloads.
- Implementation: Use browsers with built-in sandboxing features (e.g., Google Chrome, Microsoft Edge) or deploy enhanced browser security frameworks that limit the execution scope of active content. Consider controls that monitor or restrict script-based file generation and downloads commonly abused in evasion techniques like HTML smuggling.

Application Virtualization:

- Use Case: Deploy critical or high-risk applications in a virtualized environment to ensure any compromise does not affect the host system.
- Implementation: Use application virtualization platforms to run applications in isolated environments.

Email Attachment Sandboxing:

- Use Case: Route email attachments to a sandbox environment to detect and block malware before delivering emails to end-users.
- Implementation: Integrate security solutions with sandbox capabilities to analyze email attachments.

Endpoint Sandboxing:

- Use Case: Run all downloaded files and applications in a restricted environment to monitor their behavior for malicious activity.
- Implementation: Use endpoint protection tools for sandboxing at the endpoint level.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--ba06d68a-4891-4eb5-b634-152e05ec60ee
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1030
external_id: T1030
source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:11.263Z
name: Data Transfer Size Limits Mitigation
description: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--bb25b897-bfc7-4128-839d-52e9764dbfa6
created: 2019-04-22T13:54:51.385Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1490
external_id: T1490
source_name: Ready.gov IT DRP
description: Ready.gov. (n.d.). IT Disaster Recovery Plan. Retrieved March 15, 2019.
url: https://www.ready.gov/business/implementation/IT
source_name: Beechey 2010
description: Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
url: http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599
source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
url: http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html
source_name: NSA MS AppLocker
description: NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
url: https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm
source_name: Corio 2008
description: Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
url: http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx
source_name: TechNet Applocker vs SRP
description: Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
url: https://technet.microsoft.com/en-us/library/ee791851.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:11.436Z
name: Inhibit System Recovery Mitigation
description: Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery. 

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Identify potentially malicious software and audit and/or block it by using whitelisting(Citation: Beechey 2010) tools, like AppLocker,(Citation: Windows Commands JPCERT)(Citation: NSA MS AppLocker) or Software Restriction Policies(Citation: Corio 2008) where appropriate.(Citation: TechNet Applocker vs SRP)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--bcc91b8c-f104-4710-964e-1d5409666736
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1100
external_id: T1100
source_name: US-CERT Alert TA15-314A Web Shells
description: US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.
url: https://www.us-cert.gov/ncas/alerts/TA15-314A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:11.635Z
name: Web Shell Mitigation
description: Ensure that externally facing Web servers are patched regularly to prevent adversary access through [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) to gain remote code access or through file inclusion weaknesses that may allow adversaries to upload files or scripts that are automatically served as Web pages. 

Audit account and group permissions to ensure that accounts used to manage servers do not overlap with accounts and permissions of users in the internal network that could be acquired through Credential Access and used to log into the Web server and plant a Web shell or pivot from the Web server into the internal network. (Citation: US-CERT Alert TA15-314A Web Shells)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--bcee7b05-89a6-41a5-b7aa-fce4da7ede9e
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1075
external_id: T1075
source_name: GitHub IAD Secure Host Baseline UAC Filtering
description: NSA IAD. (2017, January 24). MS Security Guide. Retrieved December 18, 2017.
url: https://github.com/iadgov/Secure-Host-Baseline/blob/master/Windows/Group%20Policy%20Templates/en-US/SecGuide.adml
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:11.805Z
name: Pass the Hash Mitigation
description: Monitor systems and domain logs for unusual credential logon activity. Prevent access to [Valid Accounts](https://attack.mitre.org/techniques/T1078). Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accounts in the local administrator group. 

Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon. The associated Registry key is located HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy Through GPO: Computer Configuration > [Policies] > Administrative Templates > SCM: Pass the Hash Mitigations: Apply UAC restrictions to local accounts on network logons. (Citation: GitHub IAD Secure Host Baseline UAC Filtering)

Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems. Ensure that built-in and created local administrator accounts have complex, unique passwords. Do not allow a domain user to be in the local administrator group on multiple systems.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--bd2554b8-634f-4434-a986-9b49c29da2ae
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1063
external_id: T1063
source_name: Beechey 2010
description: Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
url: http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599
source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
url: https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
source_name: NSA MS AppLocker
description: NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
url: https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm
source_name: Corio 2008
description: Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
url: http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx
source_name: TechNet Applocker vs SRP
description: Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
url: https://technet.microsoft.com/en-us/library/ee791851.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:12.015Z
name: Security Software Discovery Mitigation
description: Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about local security software, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--beb45abb-11e8-4aef-9778-1f9ac249784f
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/T1088
external_id: T1088
source_name: Github UACMe
description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
url: https://github.com/hfiref0x/UACME
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:12.190Z
name: Bypass User Account Control Mitigation
description: Remove users from the local administrator group on systems. Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038). 

Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate. (Citation: Github UACMe)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0