NIST SP 800-53 rev5 · System and Information Integrity
SI-16 Memory Protection
Mitigates 36 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1192 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1212 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1222 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-4162 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-772 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-782 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-201 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-3061 techniquesMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
Techniques it mitigates
The 30 most used of 36, by how many ATT&CK groups and malware use them.
- T1059.003Command and Scripting Interpreter: Windows Command Shell371 users
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1047Windows Management Instrumentation137 users
- T1059.005Command and Scripting Interpreter: Visual Basic115 users
- T1059.007Command and Scripting Interpreter: JavaScript73 users
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1059.004Command and Scripting Interpreter: Unix Shell63 users
- T1059.006Command and Scripting Interpreter: Python61 users
- T1059Command and Scripting Interpreter40 users
- T1218.005System Binary Proxy Execution: Mshta28 users
- T1543.002Create or Modify System Process: Systemd Service15 users
- T1547.004Boot or Logon Autostart Execution: Winlogon Helper DLL13 users
- T1543Create or Modify System Process9 users
- T1059.002Command and Scripting Interpreter: AppleScript7 users
- T1218.001System Binary Proxy Execution: Compiled HTML File6 users
- T1218.004System Binary Proxy Execution: InstallUtil6 users
- T1059.011Command and Scripting Interpreter: Lua5 users
- T1611Escape to Host5 users
- T1059.008Command and Scripting Interpreter: Network Device CLI4 users
- T1218.003System Binary Proxy Execution: CMSTP4 users
- T1218.008System Binary Proxy Execution: Odbcconf3 users
- T1505.004Server Software Component: IIS Components3 users
- T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensions3 users
- T1565.001Data Manipulation: Stored Data Manipulation3 users
- T1218System Binary Proxy Execution2 users
- T1218.002System Binary Proxy Execution: Control Panel2 users
- T1548Abuse Elevation Control Mechanism2 users
- T1565Data Manipulation2 users
- T1218.009System Binary Proxy Execution: Regsvcs/Regasm1 users
- T1218.012System Binary Proxy Execution: Verclsid1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.