NIST SP 800-53 rev5 · Access Control
AC-17 Remote Access
Mitigates 81 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1193 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1203 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1213 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1223 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-3062 techniquesMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
- CWE-4162 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-772 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-782 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-11881 techniquesInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
Techniques it mitigates
The 30 most used of 81, by how many ATT&CK groups and malware use them.
- T1059.003Command and Scripting Interpreter: Windows Command Shell371 users
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1047Windows Management Instrumentation137 users
- T1059.005Command and Scripting Interpreter: Visual Basic115 users
- T1059.007Command and Scripting Interpreter: JavaScript73 users
- T1119Automated Collection71 users
- T1059.004Command and Scripting Interpreter: Unix Shell63 users
- T1059.006Command and Scripting Interpreter: Python61 users
- T1021.002Remote Services: SMB/Windows Admin Shares59 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1059Command and Scripting Interpreter40 users
- T1133External Remote Services33 users
- T1070Indicator Removal31 users
- T1547.009Boot or Logon Autostart Execution: Shortcut Modification29 users
- T1040Network Sniffing25 users
- T1021.004Remote Services: SSH24 users
- T1552.004Unsecured Credentials: Private Keys22 users
- T1114.001Email Collection: Local Email Collection20 users
- T1219Remote Access Tools20 users
- T1114.002Email Collection: Remote Email Collection17 users
- T1547.004Boot or Logon Autostart Execution: Winlogon Helper DLL13 users
- T1021.005Remote Services: VNC11 users
- T1213.002Data from Information Repositories: Sharepoint10 users
- T1530Data from Cloud Storage10 users
- T1550.001Use Alternate Authentication Material: Application Access Token10 users
- T1552.002Unsecured Credentials: Credentials in Registry10 users
- T1558.003Steal or Forge Kerberos Tickets: Kerberoasting10 users
- T1543Create or Modify System Process9 users
- T1609Container Administration Command9 users
- T1021.006Remote Services: Windows Remote Management8 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.