NIST SP 800-53 rev5 · Risk Assessment
RA-10 Threat Hunting
Mitigates 8 ATT&CK techniques, used by 9 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-223 techniquesImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-233 techniquesRelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
- CWE-2843 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2853 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-363 techniquesAbsolute Path TraversalAn absolute path in input points straight at a file outside the allowed directory.
- CWE-6393 techniquesAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
- CWE-8623 techniquesMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
- CWE-8633 techniquesIncorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
- CWE-1192 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
Techniques it mitigates
- T1190Exploit Public-Facing Application55 users
- T1068Exploitation for Privilege Escalation42 users
- T1210Exploitation of Remote Services25 users
- T1195.002Supply Chain Compromise: Compromise Software Supply Chain12 users
- T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools10 users
- T1195Supply Chain Compromise5 users
- T1211Exploitation for Stealth2 users
- T1212Exploitation for Credential Access1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.