NIST SP 800-53 rev5 · System and Communications Protection
SC-18 Mobile Code
Mitigates 38 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1196 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1206 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1216 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1226 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1256 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-4166 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-776 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-786 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-7876 techniquesOut-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
- CWE-205 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
Techniques it mitigates
The 30 most used of 38, by how many ATT&CK groups and malware use them.
- T1059.005Command and Scripting Interpreter: Visual Basic115 users
- T1055Process Injection81 users
- T1059.007Command and Scripting Interpreter: JavaScript73 users
- T1055.001Process Injection: Dynamic-link Library Injection66 users
- T1203Exploitation for Client Execution56 users
- T1190Exploit Public-Facing Application55 users
- T1055.012Process Injection: Process Hollowing44 users
- T1068Exploitation for Privilege Escalation42 users
- T1189Drive-by Compromise42 users
- T1059Command and Scripting Interpreter40 users
- T1210Exploitation of Remote Services25 users
- T1559.001Inter-Process Communication: Component Object Model22 users
- T1559.002Inter-Process Communication: Dynamic Data Exchange19 users
- T1559Inter-Process Communication17 users
- T1055.002Process Injection: Portable Executable Injection14 users
- T1055.004Process Injection: Asynchronous Procedure Call13 users
- T1218.001System Binary Proxy Execution: Compiled HTML File6 users
- T1055.003Process Injection: Thread Execution Hijacking5 users
- T1137.001Office Application Startup: Office Template Macros4 users
- T1137.006Office Application Startup: Add-ins4 users
- T1021.003Remote Services: Distributed Component Object Model3 users
- T1055.013Process Injection: Process Doppelgänging3 users
- T1055.005Process Injection: Thread Local Storage2 users
- T1055.011Process Injection: Extra Window Memory Injection2 users
- T1137Office Application Startup2 users
- T1137.004Office Application Startup: Outlook Home Page2 users
- T1211Exploitation for Stealth2 users
- T1548Abuse Elevation Control Mechanism2 users
- T1055.008Process Injection: Ptrace System Calls1 users
- T1137.002Office Application Startup: Office Test1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.