NIST SP 800-53 rev5 · Configuration Management
CM-3 Configuration Change Control
Mitigates 35 ATT&CK techniques, used by 8 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-3061 techniquesMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
- CWE-771 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-781 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Techniques it mitigates
The 30 most used of 35, by how many ATT&CK groups and malware use them.
- T1059.006Command and Scripting Interpreter: Python61 users
- T1555Credentials from Password Stores39 users
- T1543.002Create or Modify System Process: Systemd Service15 users
- T1021.005Remote Services: VNC11 users
- T1213.002Data from Information Repositories: Sharepoint10 users
- T1542.003Pre-OS Boot: Bootkit9 users
- T1543Create or Modify System Process9 users
- T1547.013Boot or Logon Autostart Execution: XDG Autostart Entries7 users
- T1213.005Data from Information Repositories: Messaging Applications6 users
- T1195Supply Chain Compromise5 users
- T1553.006Subvert Trust Controls: Code Signing Policy Modification5 users
- T1213Data from Information Repositories4 users
- T1546Event Triggered Execution4 users
- T1542.001Pre-OS Boot: System Firmware3 users
- T1564.008Hide Artifacts: Email Hiding Rules3 users
- T1213.001Data from Information Repositories: Confluence2 users
- T1495Firmware Corruption2 users
- T1548Abuse Elevation Control Mechanism2 users
- T1553Subvert Trust Controls2 users
- T1647Plist File Modification2 users
- T1653Power Settings2 users
- T1601Modify System Image1 users
- T1601.001Modify System Image: Patch System Image1 users
- T1176Software Extensions0 users
- T1195.003Supply Chain Compromise: Compromise Hardware Supply Chain0 users
- T1542Pre-OS Boot0 users
- T1542.004Pre-OS Boot: ROMMONkit0 users
- T1542.005Pre-OS Boot: TFTP Boot0 users
- T1547.007Boot or Logon Autostart Execution: Re-opened Applications0 users
- T1556.008Modify Authentication Process: Network Provider DLL0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.