M1028: Operating System Configuration
Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures:
Disable Unused Features:
- Turn off SMBv1, LLMNR, and NetBIOS where not needed. - Disable remote registry and unnecessary services.
Enforce OS-level Protections:
- Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows. - Use AppArmor or SELinux on Linux for mandatory access controls.
Secure Access Settings:
- Enable User Account Control (UAC) for Windows. - Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.
File System Hardening:
- Implement least-privilege access for critical files and system directories. - Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).
Secure Remote Access:
- Restrict RDP, SSH, and VNC to authorized IPs using firewall rules. - Enable NLA for RDP and enforce strong password/lockout policies.
Harden Boot Configurations:
- Enable Secure Boot and enforce UEFI/BIOS password protection. - Use BitLocker or LUKS to encrypt boot drives.
Regular Audits:
- Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.
*Tools for Implementation*
Windows:
- Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings. - Windows Defender Exploit Guard: Built-in OS protection against exploits. - CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.
Linux/macOS:
- AppArmor/SELinux: Enforce mandatory access controls. - Lynis: Perform comprehensive security audits. - SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.
Cross-Platform:
- Ansible or Chef/Puppet: Automate configuration hardening at scale. - OpenSCAP: Perform compliance and configuration checks.
Security context for executives and security teams
M1028: Operating System Configuration describes Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures: Disable Unused Features: - Turn off SMBv1, LLMNR, and NetBIOS where not needed. - Disable remote...
Executive priority
M1028: Operating System Configuration is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M1028: Operating System Configuration by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M1028: Operating System Configuration appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Operating System Configuration
Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures:
Disable Unused Features:
- Turn off SMBv1, LLMNR, and NetBIOS where not needed. - Disable remote registry and unnecessary services.
Enforce OS-level Protections:
- Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows. - Use AppArmor or SELinux on Linux for mandatory access controls.
Secure Access Settings:
- Enable User Account Control (UAC) for Windows. - Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.
File System Hardening:
- Implement least-privilege access for critical files and system directories. - Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).
Secure Remote Access:
- Restrict RDP, SSH, and VNC to authorized IPs using firewall rules. - Enable NLA for RDP and enforce strong password/lockout policies.
Harden Boot Configurations:
- Enable Secure Boot and enforce UEFI/BIOS password protection. - Use BitLocker or LUKS to encrypt boot drives.
Regular Audits:
- Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.
*Tools for Implementation*
Windows:
- Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings. - Windows Defender Exploit Guard: Built-in OS protection against exploits. - CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.
Linux/macOS:
- AppArmor/SELinux: Enforce mandatory access controls. - Lynis: Perform comprehensive security audits. - SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.
Cross-Platform:
- Ansible or Chef/Puppet: Automate configuration hardening at scale. - OpenSCAP: Perform compliance and configuration checks.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1574.006 | Dynamic Linker HijackingSub-technique | When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions.CitationApple Developer Doco Hardened Runtime Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary. |
| Enterprise | T1087.001 | Local AccountSub-technique | Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at |
| Enterprise | T1553 | Subvert Trust Controls | Windows Group Policy can be used to manage root certificates and the |
| Enterprise | T1053.002 | AtSub-technique | Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at |
| Enterprise | T1543.003 | Windows ServiceSub-technique | Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed. |
| Enterprise | T1548.001 | Setuid and SetgidSub-technique | Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. |
| Enterprise | T1542.005 | TFTP BootSub-technique | Follow vendor device hardening best practices to disable unnecessary and unused features and services, avoid using default configurations and passwords, and introduce logging and auditing for detection. |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.CitationWindows RDP Sessions |
| Enterprise | T1003.001 | LSASS MemorySub-technique | Consider disabling or restricting NTLM.CitationMicrosoft Disable NTLM Nov 2012 Consider disabling WDigest authentication.CitationMicrosoft WDigest Mit |
| Enterprise | T1552 | Unsecured Credentials | There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands: |
| Enterprise | T1548 | Abuse Elevation Control Mechanism | Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions. |
| Enterprise | T1197 | BITS Jobs | Consider reducing the default BITS job lifetime in Group Policy or by editing the |
| Enterprise | T1563.002 | RDP HijackingSub-technique | Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.CitationWindows RDP Sessions |
| Enterprise | T1543 | Create or Modify System Process | Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed. |
| Enterprise | T1087 | Account Discovery | Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located |
| Enterprise | T1053 | Scheduled Task/Job | Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at |
| Enterprise | T1136 | Create Account | Protect domain controllers by ensuring proper security configuration for critical servers. |
| Enterprise | T1011 | Exfiltration Over Other Network Medium | Prevent the creation of new network adapters where possible.CitationMicrosoft GPO Bluetooth FEB 2009CitationTechRepublic Wireless GPO FEB 2009 |
| Enterprise | T1556.002 | Password Filter DLLSub-technique | Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages. |
| Enterprise | T1087.002 | Domain AccountSub-technique | Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at |
| Enterprise | T1003.005 | Cached Domain CredentialsSub-technique | Consider limiting the number of cached credentials (HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon\cachedlogonscountvalue)CitationTilbury Windows Credentials |
| Enterprise | T1564.002 | Hidden UsersSub-technique | If the computer is domain joined, then group policy can help restrict the ability to create or hide users. Similarly, preventing the modification of the |
| Enterprise | T1552.003 | Shell HistorySub-technique | There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands: In Zsh, `fc -p` can be used to create a private history session. However, previous history will be unavailable to the user until the session ends. Using `unset HISTFILE` and writing commands to `/dev/null` can also be used, similarly to Bash. In PowerShell, users can utilize `Set-PSReadLineOption` to modify how commands are saved into history. Setting `-HistorySaveStyle SaveNothing` prevents command history from being saved onto the file. Note that setting it from `SaveNothing` to `SaveIncrementally` in the same session will cause all commands from that session to be saved. Alternatively, `-AddToHistoryHandler` can be used to filter certain commands from being saved into the history file. |
| Enterprise | T1135 | Network Share Discovery | Enable Windows Group Policy “Do Not Allow Anonymous Enumeration of SAM Accounts and Shares” security setting to limit users who can enumerate network shares.CitationWindows Anonymous Enumeration of SAM Accounts |
| Enterprise | T1553.004 | Install Root CertificateSub-technique | Windows Group Policy can be used to manage root certificates and the |
| Enterprise | T1003.002 | Security Account ManagerSub-technique | Consider disabling or restricting NTLM.CitationMicrosoft Disable NTLM Nov 2012 |
| Enterprise | T1548.003 | Sudo and Sudo CachingSub-technique | Ensuring that the |
| Enterprise | T1136.002 | Domain AccountSub-technique | Protect domain controllers by ensuring proper security configuration for critical servers. |
| Enterprise | T1092 | Communication Through Removable Media | Disallow or restrict removable media at an organizational policy level if they are not required for business operations.CitationTechNet Removable Media Control |
| Enterprise | T1490 | Inhibit System Recovery | Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery. Additionally, ensure that WinRE is enabled using the following command: |
| Enterprise | T1036.007 | Double File ExtensionSub-technique | Disable the default to “hide file extensions for known file types” in Windows OS.CitationSeqrite DoubleExtensionCitationHowToGeek ShowExtension |
| Enterprise | T1546.008 | Accessibility FeaturesSub-technique | To use this technique remotely, an adversary must use it in conjunction with RDP. Ensure that Network Level Authentication is enabled to force the remote desktop session to authenticate before the session is created and the login screen displayed. It is enabled by default on Windows Vista and later.CitationTechNet RDP NLA |
| Enterprise | T1690 | Prevent Command History Logging | Make sure that the |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled. CitationTechNet Server Operator Scheduled Task |
| Enterprise | T1556.008 | Network Provider DLLSub-technique | Starting in Windows 11 22H2, the `EnableMPRNotifications` policy can be disabled through Group Policy or through a configuration service provider to prevent Winlogon from sending credentials to network providers.CitationEnableMPRNotifications |
| Enterprise | T1556 | Modify Authentication Process | Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (`C:\Windows\System32\` by default) of a domain controller and/or local computer with a corresponding entry in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages`. Starting in Windows 11 22H2, the `EnableMPRNotifications` policy can be disabled through Group Policy or through a configuration service provider to prevent Winlogon from sending credentials to network providers.CitationEnableMPRNotifications |
| Enterprise | T1098 | Account Manipulation | Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing. |
| Enterprise | T1011.001 | Exfiltration Over BluetoothSub-technique | Prevent the creation of new network adapters where possible. |
| Enterprise | T1003 | OS Credential Dumping | Consider disabling or restricting NTLM.CitationMicrosoft Disable NTLM Nov 2012 Consider disabling WDigest authentication.CitationMicrosoft WDigest Mit |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.3 | Current bundle | fe9ac69df71b… | ||
| 19.1 | 1.3 | Older bundle | fe9ac69df71b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackM1028Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.