NIST SP 800-53 rev5 · Supply Chain Risk Management
SR-4 Provenance
Mitigates 22 ATT&CK techniques, used by 9 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-771 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-781 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
Techniques it mitigates
- T1041Exfiltration Over C2 Channel201 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1554Compromise Host Software Binary21 users
- T1567Exfiltration Over Web Service14 users
- T1195.002Supply Chain Compromise: Compromise Software Supply Chain12 users
- T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools10 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1052.001Exfiltration Over Physical Medium: Exfiltration over USB7 users
- T1059.002Command and Scripting Interpreter: AppleScript7 users
- T1195Supply Chain Compromise5 users
- T1505.004Server Software Component: IIS Components3 users
- T1204.003User Execution: Malicious Image1 users
- T1505.001Server Software Component: SQL Stored Procedures1 users
- T1505.002Server Software Component: Transport Agent1 users
- T1601Modify System Image1 users
- T1601.001Modify System Image: Patch System Image1 users
- T1052Exfiltration Over Physical Medium0 users
- T1195.003Supply Chain Compromise: Compromise Hardware Supply Chain0 users
- T1505Server Software Component0 users
- T1546.006Event Triggered Execution: LC_LOAD_DYLIB Addition0 users
- T1601.002Modify System Image: Downgrade System Image0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.