NIST SP 800-53 rev5 · System and Information Integrity
SI-15 Information Output Filtering
Mitigates 42 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
Techniques it mitigates
The 30 most used of 42, by how many ATT&CK groups and malware use them.
- T1095Non-Application Layer Protocol101 users
- T1090Proxy68 users
- T1021.002Remote Services: SMB/Windows Admin Shares59 users
- T1071.004Application Layer Protocol: DNS55 users
- T1570Lateral Tool Transfer46 users
- T1572Protocol Tunneling37 users
- T1090.003Proxy: Multi-hop Proxy36 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1622Debugger Evasion26 users
- T1205Traffic Signaling21 users
- T1219Remote Access Tools20 users
- T1197BITS Jobs13 users
- T1021.005Remote Services: VNC11 users
- T1530Data from Cloud Storage10 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1557Adversary-in-the-Middle8 users
- T1552.005Unsecured Credentials: Cloud Instance Metadata API7 users
- T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay7 users
- T1205.001Traffic Signaling: Port Knocking6 users
- T1552Unsecured Credentials6 users
- T1187Forced Authentication3 users
- T1498Network Denial of Service3 users
- T1499Endpoint Denial of Service3 users
- T1537Transfer Data to Cloud Account3 users
- T1557.002Adversary-in-the-Middle: ARP Cache Poisoning2 users
- T1564.009Hide Artifacts: Resource Forking2 users
- T1599Network Boundary Bridging2 users
- T1602.002Data from Configuration Repository: Network Device Configuration Dump2 users
- T1218.012System Binary Proxy Execution: Verclsid1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.