NIST SP 800-53 rev5 · Configuration Management
CM-6 Configuration Settings
Mitigates 344 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-11911 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-12011 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-12111 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-12211 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-779 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-789 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-1258 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-4168 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-7878 techniquesOut-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
- CWE-207 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
Techniques it mitigates
The 30 most used of 344, by how many ATT&CK groups and malware use them.
- T1105Ingress Tool Transfer501 users
- T1071.001Application Layer Protocol: Web Protocols410 users
- T1059.003Command and Scripting Interpreter: Windows Command Shell371 users
- T1106Native API231 users
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1036.005Masquerading: Match Legitimate Resource Name or Location211 users
- T1204.002User Execution: Malicious File185 users
- T1053.005Scheduled Task/Job: Scheduled Task181 users
- T1573.001Encrypted Channel: Symmetric Cryptography181 users
- T1027Obfuscated Files or Information161 users
- T1566.001Phishing: Spearphishing Attachment141 users
- T1047Windows Management Instrumentation137 users
- T1132.001Data Encoding: Standard Encoding130 users
- T1574.001Hijack Execution Flow: DLL118 users
- T1059.005Command and Scripting Interpreter: Visual Basic115 users
- T1095Non-Application Layer Protocol101 users
- T1573.002Encrypted Channel: Asymmetric Cryptography94 users
- T1055Process Injection81 users
- T1204.001User Execution: Malicious Link81 users
- T1566.002Phishing: Spearphishing Link80 users
- T1135Network Share Discovery75 users
- T1059.007Command and Scripting Interpreter: JavaScript73 users
- T1119Automated Collection71 users
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1046Network Service Discovery69 users
- T1569.002System Services: Service Execution69 users
- T1090Proxy68 users
- T1027.010Obfuscated Files or Information: Command Obfuscation67 users
- T1087.001Account Discovery: Local Account64 users
- T1059.004Command and Scripting Interpreter: Unix Shell63 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.