NIST SP 800-53 rev5 · System and Information Integrity
SI-14 Non-persistence
Mitigates 7 ATT&CK techniques, used by 1 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-771 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-781 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Techniques it mitigates
- T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription23 users
- T1547.004Boot or Logon Autostart Execution: Winlogon Helper DLL13 users
- T1505.004Server Software Component: IIS Components3 users
- T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensions3 users
- T1505.001Server Software Component: SQL Stored Procedures1 users
- T1505.002Server Software Component: Transport Agent1 users
- T1505Server Software Component0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.