Execution Prevention
Block execution of code on a system through application control, and/or script blocking.
Techniques Addressed by Mitigation
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1548 | Abuse Elevation Control Mechanism |
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk. |
|
.004 | Elevated Execution with Prompt |
System settings can prevent applications from running that haven't been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk. |
||
Enterprise | T1547 | .004 | Boot or Logon Autostart Execution: Winlogon Helper DLL |
Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control [1] tools like AppLocker [2] [3] that are capable of auditing and/or blocking unknown DLLs. |
.006 | Boot or Logon Autostart Execution: Kernel Modules and Extensions |
Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.[4][5][6][7][8] Since macOS High Sierra 10.13, Secure Kernel Extension Loading (SKEL) can also be used to restrict the loading of kernel modules.[9] |
||
Enterprise | T1176 | Browser Extensions |
Set a browser extension allow or deny list as appropriate for your security policy. [10] |
|
Enterprise | T1059 | Command and Scripting Interpreter |
Use application control where appropriate. |
|
.002 | AppleScript |
Use application control where appropriate. |
||
.003 | Windows Command Shell |
Use application control where appropriate. |
||
.004 | Unix Shell |
Use application control where appropriate. |
||
.005 | Visual Basic |
Use application control where appropriate. |
||
.006 | Python |
Denylist Python where not required. |
||
.007 | JavaScript/JScript |
Denylist scripting where appropriate. |
||
.008 | Network Device CLI |
TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization. [11] |
||
Enterprise | T1546 | .002 | Event Triggered Execution: Screensaver |
Block .scr files from being executed from non-standard locations. |
.006 | Event Triggered Execution: LC_LOAD_DYLIB Addition |
Allow applications via known hashes. |
||
.008 | Event Triggered Execution: Accessibility Features |
Adversaries can replace accessibility features binaries with alternate binaries to execute this technique. Identify and block potentially malicious software executed through accessibility features functionality by using application control [1] tools, like Windows Defender Application Control[12], AppLocker, [2] [3] or Software Restriction Policies [13] where appropriate. [14] |
||
.009 | Event Triggered Execution: AppCert DLLs |
Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control [1] tools, like Windows Defender Application Control[12], AppLocker, [2] [3] or Software Restriction Policies [13] where appropriate. [14] |
||
.010 | Event Triggered Execution: AppInit DLLs |
Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control [1] tools, like Windows Defender Application Control[12], AppLocker, [2] [3] or Software Restriction Policies [13] where appropriate. [14] |
||
Enterprise | T1564 | .003 | Hide Artifacts: Hidden Window |
Limit or restrict program execution using anti-virus software. On MacOS, allowlist programs that are allowed to have the plist tag. All other programs should be considered suspicious. |
.006 | Hide Artifacts: Run Virtual Instance |
Use application control to mitigate installation and use of unapproved virtualization software. |
||
Enterprise | T1574 | Hijack Execution Flow |
Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software. |
|
.009 | Path Interception by Unquoted Path |
Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.[15][12][2][3][16][17] |
||
.007 | Path Interception by PATH Environment Variable |
Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.[15][12][2][3][16][17] |
||
.008 | Path Interception by Search Order Hijacking |
Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.[15][12][2][3][16][17] |
||
.001 | DLL Search Order Hijacking |
Adversaries may use new DLLs to execute this technique. Identify and block potentially malicious software executed through search order hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software. |
||
.006 | LD_PRELOAD |
Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software. |
||
.012 | COR_PROFILER |
Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.[1][2][3] |
||
Enterprise | T1036 | Masquerading |
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed. |
|
.005 | Match Legitimate Name or Location |
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed. |
||
Enterprise | T1106 | Native API |
Identify and block potentially malicious software executed that may be executed through this technique by using application control [1] tools, like Windows Defender Application Control[12], AppLocker, [2] [3] or Software Restriction Policies [13] where appropriate. [14] |
|
Enterprise | T1219 | Remote Access Software |
Use application control to mitigate installation and use of unapproved software that can be used for remote access. |
|
Enterprise | T1129 | Shared Modules |
Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown DLLs from being loaded. |
|
Enterprise | T1218 | Signed Binary Proxy Execution |
Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network. |
|
.003 | CMSTP |
Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
||
.001 | Compiled HTML File |
Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
||
.004 | InstallUtil |
Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
||
.005 | Mshta |
Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
||
.009 | Regsvcs/Regasm |
Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries. |
||
.002 | Control Panel |
Identify and block potentially malicious and unknown .cpl files by using application control [1] tools, like Windows Defender Application Control[12], AppLocker, [2] [3] or Software Restriction Policies [13] where appropriate. [14] |
||
.008 | Odbcconf |
Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
||
.012 | Verclsid |
Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries. |
||
Enterprise | T1216 | Signed Script Proxy Execution |
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries. |
|
.001 | PubPrn |
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries. |
||
Enterprise | T1553 | Subvert Trust Controls |
System settings can prevent applications from running that haven't been downloaded through the Apple Store (or other legitimate repositories) which can help mitigate some of these issues. Also enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious content. |
|
.001 | Gatekeeper Bypass |
System settings can prevent applications from running that haven't been downloaded through the Apple Store which can help mitigate some of these issues. |
||
.003 | SIP and Trust Provider Hijacking |
Enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs. |
||
Enterprise | T1080 | Taint Shared Content |
Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control [1] tools, like AppLocker, [2] [3] or Software Restriction Policies [13] where appropriate. [14] |
|
Enterprise | T1127 | Trusted Developer Utilities Proxy Execution |
Certain developer utilities should be blocked or restricted if not required. |
|
Enterprise | T1204 | User Execution |
Application control may be able to prevent the running of executables masquerading as other files. |
|
.002 | Malicious File |
Application control may be able to prevent the running of executables masquerading as other files. |
||
Enterprise | T1220 | XSL Script Processing |
If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries. |
References
- Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
- Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
- NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
- Vander Stoep, J. (2016, April 5). [v3] selinux: restrict kernel module loadinglogin register. Retrieved April 9, 2018.
- Wikibooks. (2018, August 19). Grsecurity/The RBAC System. Retrieved June 4, 2020.
- Kernel.org. (2020, February 6). Kernel Self-Protection. Retrieved June 4, 2020.
- Boelen, M. (2015, October 7). Increase kernel integrity with disabled Linux kernel modules loading. Retrieved June 4, 2020.
- Pingios, A.. (2018, February 7). LKM loading kernel restrictions. Retrieved June 4, 2020.
- Apple. (2018, April 19). Technical Note TN2459: User-Approved Kernel Extension Loading. Retrieved June 30, 2020.
- Mohta, A. (n.d.). Block Chrome Extensions using Google Chrome Group Policy Settings. Retrieved January 10, 2018.
- Cisco. (n.d.). Cisco IOS Software Integrity Assurance - TACACS. Retrieved October 19, 2020.
- Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.
- Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
- Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.
- Beechey, J.. (2014, November 18). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
- Corio, C., & Sayana, D. P.. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
- Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.