NIST SP 800-53 rev5 · System and Information Integrity
SI-10 Information Input Validation
Mitigates 101 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1196 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1206 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1216 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1226 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-4164 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-1253 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-203 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-7873 techniquesOut-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
- CWE-13212 techniquesImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
- CWE-13362 techniquesImproper Neutralization of Special Elements Used in a Template EngineInput is rendered as a template, so template syntax in it runs on the server.
Techniques it mitigates
The 30 most used of 101, by how many ATT&CK groups and malware use them.
- T1059.003Command and Scripting Interpreter: Windows Command Shell371 users
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1036.005Masquerading: Match Legitimate Resource Name or Location211 users
- T1204.002User Execution: Malicious File185 users
- T1574.001Hijack Execution Flow: DLL118 users
- T1059.005Command and Scripting Interpreter: Visual Basic115 users
- T1095Non-Application Layer Protocol101 users
- T1218.011System Binary Proxy Execution: Rundll3295 users
- T1059.007Command and Scripting Interpreter: JavaScript73 users
- T1090Proxy68 users
- T1027.010Obfuscated Files or Information: Command Obfuscation67 users
- T1059.004Command and Scripting Interpreter: Unix Shell63 users
- T1564.003Hide Artifacts: Hidden Window62 users
- T1059.006Command and Scripting Interpreter: Python61 users
- T1021.002Remote Services: SMB/Windows Admin Shares59 users
- T1071.004Application Layer Protocol: DNS55 users
- T1190Exploit Public-Facing Application55 users
- T1036Masquerading54 users
- T1570Lateral Tool Transfer46 users
- T1059Command and Scripting Interpreter40 users
- T1572Protocol Tunneling37 users
- T1090.003Proxy: Multi-hop Proxy36 users
- T1218.010System Binary Proxy Execution: Regsvr3234 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1218.005System Binary Proxy Execution: Mshta28 users
- T1622Debugger Evasion26 users
- T1129Shared Modules23 users
- T1219Remote Access Tools20 users
- T1036.008Masquerading: Masquerade File Type18 users
- T1197BITS Jobs13 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.