NIST SP 800-53 rev5 · System and Communications Protection
SC-44 Detonation Chambers
Mitigates 22 ATT&CK techniques, used by 10 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1194 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1204 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1214 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1224 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-204 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-4164 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-6934 techniquesProtection Mechanism FailureA security feature exists but can be bypassed or doesn't engage when it should.
- CWE-793 techniquesImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.
- CWE-8433 techniquesAccess of Resource Using Incompatible Type ('Type Confusion')An object is treated as the wrong type; a favourite in browser and JavaScript-engine exploits.
- CWE-1252 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
Techniques it mitigates
- T1204.002User Execution: Malicious File185 users
- T1566.001Phishing: Spearphishing Attachment141 users
- T1204.001User Execution: Malicious Link81 users
- T1566.002Phishing: Spearphishing Link80 users
- T1203Exploitation for Client Execution56 users
- T1598.003Phishing for Information: Spearphishing Link19 users
- T1566.003Phishing: Spearphishing via Service16 users
- T1566Phishing11 users
- T1221Template Injection10 users
- T1598Phishing for Information6 users
- T1137.001Office Application Startup: Office Template Macros4 users
- T1137.006Office Application Startup: Add-ins4 users
- T1204User Execution4 users
- T1598.002Phishing for Information: Spearphishing Attachment4 users
- T1137Office Application Startup2 users
- T1137.004Office Application Startup: Outlook Home Page2 users
- T1564.009Hide Artifacts: Resource Forking2 users
- T1137.002Office Application Startup: Office Test1 users
- T1137.003Office Application Startup: Outlook Forms1 users
- T1137.005Office Application Startup: Outlook Rules1 users
- T1204.003User Execution: Malicious Image1 users
- T1598.001Phishing for Information: Spearphishing Service1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.