NIST SP 800-53 rev5 · Access Control
AC-5 Separation of Duties
Mitigates 167 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-776 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-786 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-4345 techniquesUnrestricted Upload of File with Dangerous TypeUploads aren't restricted, so an attacker uploads a script (a web shell) and then requests it.
- CWE-1194 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1204 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1214 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1224 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1254 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-224 techniquesImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-234 techniquesRelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
Techniques it mitigates
The 30 most used of 167, by how many ATT&CK groups and malware use them.
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1053.005Scheduled Task/Job: Scheduled Task181 users
- T1047Windows Management Instrumentation137 users
- T1543.003Create or Modify System Process: Windows Service136 users
- T1055Process Injection81 users
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1569.002System Services: Service Execution69 users
- T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control63 users
- T1021.002Remote Services: SMB/Windows Admin Shares59 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1489Service Stop57 users
- T1078Valid Accounts56 users
- T1190Exploit Public-Facing Application55 users
- T1505.003Server Software Component: Web Shell53 users
- T1552.001Unsecured Credentials: Credentials In Files41 users
- T1059Command and Scripting Interpreter40 users
- T1070Indicator Removal31 users
- T1136.001Create Account: Local Account31 users
- T1003.002OS Credential Dumping: Security Account Manager29 users
- T1218.007System Binary Proxy Execution: Msiexec29 users
- T1547.009Boot or Logon Autostart Execution: Shortcut Modification29 users
- T1657Financial Theft27 users
- T1078.002Valid Accounts: Domain Accounts26 users
- T1210Exploitation of Remote Services25 users
- T1021.004Remote Services: SSH24 users
- T1543.001Create or Modify System Process: Launch Agent24 users
- T1110Brute Force23 users
- T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription23 users
- T1003.003OS Credential Dumping: NTDS22 users
- T1134Access Token Manipulation22 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.