NIST SP 800-53 rev5 · Access Control
AC-6 Least Privilege
Mitigates 270 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-7710 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-7810 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-1199 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1209 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1219 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1229 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1258 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-7878 techniquesOut-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
- CWE-2847 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2857 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
Techniques it mitigates
The 30 most used of 270, by how many ATT&CK groups and malware use them.
- T1059.003Command and Scripting Interpreter: Windows Command Shell371 users
- T1106Native API231 users
- T1005Data from Local System221 users
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1036.005Masquerading: Match Legitimate Resource Name or Location211 users
- T1041Exfiltration Over C2 Channel201 users
- T1053.005Scheduled Task/Job: Scheduled Task181 users
- T1112Modify Registry170 users
- T1047Windows Management Instrumentation137 users
- T1543.003Create or Modify System Process: Windows Service136 users
- T1059.005Command and Scripting Interpreter: Visual Basic115 users
- T1486Data Encrypted for Impact83 users
- T1055Process Injection81 users
- T1059.007Command and Scripting Interpreter: JavaScript73 users
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1569.002System Services: Service Execution69 users
- T1055.001Process Injection: Dynamic-link Library Injection66 users
- T1059.004Command and Scripting Interpreter: Unix Shell63 users
- T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control63 users
- T1059.006Command and Scripting Interpreter: Python61 users
- T1021.002Remote Services: SMB/Windows Admin Shares59 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1489Service Stop57 users
- T1078Valid Accounts56 users
- T1203Exploitation for Client Execution56 users
- T1490Inhibit System Recovery56 users
- T1190Exploit Public-Facing Application55 users
- T1036Masquerading54 users
- T1505.003Server Software Component: Web Shell53 users
- T1055.012Process Injection: Process Hollowing44 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.