M1028: Operating System Configuration
Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures:
Disable Unused Features:
- Turn off SMBv1, LLMNR, and NetBIOS where not needed. - Disable remote registry and unnecessary services.
Enforce OS-level Protections:
- Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows. - Use AppArmor or SELinux on Linux for mandatory access controls.
Secure Access Settings:
- Enable User Account Control (UAC) for Windows. - Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.
File System Hardening:
- Implement least-privilege access for critical files and system directories. - Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).
Secure Remote Access:
- Restrict RDP, SSH, and VNC to authorized IPs using firewall rules. - Enable NLA for RDP and enforce strong password/lockout policies.
Harden Boot Configurations:
- Enable Secure Boot and enforce UEFI/BIOS password protection. - Use BitLocker or LUKS to encrypt boot drives.
Regular Audits:
- Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.
*Tools for Implementation*
Windows:
- Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings. - Windows Defender Exploit Guard: Built-in OS protection against exploits. - CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.
Linux/macOS:
- AppArmor/SELinux: Enforce mandatory access controls. - Lynis: Perform comprehensive security audits. - SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.
Cross-Platform:
- Ansible or Chef/Puppet: Automate configuration hardening at scale. - OpenSCAP: Perform compliance and configuration checks.
Security context for executives and security teams
Operating System Configuration is a broad hardening mitigation: reduce what the OS exposes by disabling unnecessary features, enforcing built-in protections, tightening access and file permissions, securing remote access, hardening boot settings, and auditing configuration drift. For leaders, its value is not a single control but a repeatable baseline that limits credential theft, lateral movement, persistence, discovery, exfiltration paths, and recovery inhibition across systems where those risks apply.
Executive priority
Treat this as a foundational resilience and audit-readiness control. The business decision is whether OS baselines are centrally defined, enforced, measured, and exception-managed across critical assets. Priority should be highest where ATT&CK relationships show material risk: credential access such as OS Credential Dumping and LSASS Memory, lateral movement over RDP, persistence through services or scheduled tasks, account manipulation or creation, and impact behaviors that inhibit system recovery.
Technical view
SOC, detection engineering, and IR teams should validate both preventive configuration and evidence of drift. ATT&CK provides no detection text for M1028, so coverage should be proven through configuration assessment and monitoring of changes to OS protections, remote access settings, service/task configuration, local and domain account controls, file permissions, boot security, encryption, and recovery-related settings. Relationship context should drive test cases: Windows credential dumping protections and LSASS exposure; SAM and cached credential settings; RDP restrictions and NLA; scheduled task and Windows service creation/modification; account creation/manipulation; network share and account discovery exposure; removable media, Bluetooth, and alternate network paths where relevant.
Likely telemetry
- Configuration baseline and compliance scan results, such as CIS Benchmark or SCAP-style assessments
- Central policy state and changes, such as Group Policy or equivalent configuration management records
- OS security protection status, including DEP, ASLR, CFG, AppArmor, SELinux, UAC, Secure Boot, and disk encryption where applicable
- Remote access configuration evidence for RDP, SSH, VNC, firewall restrictions, NLA, password, and lockout policies
- Service, scheduled task/job, BITS job, and startup configuration change logs
Detection direction
- Do not treat this mitigation as detected simply because a hardening standard exists; validate current endpoint and server state against approved baselines.
- Tune monitoring for configuration drift and high-risk changes: enabling legacy or unused services, weakening remote access controls, changing service or scheduled task definitions, modifying account privileges, and altering recovery or boot protections.
- Use relationship-driven validation: confirm controls and logs are sufficient for techniques such as OS Credential Dumping, RDP lateral movement, Scheduled Task/Job abuse, Create or Modify System Process, Account Manipulation, Create Account, and Inhibit System Recovery.
- Account for false positives from administrators, software deployment, patching, and approved automation by requiring change-management context and asset criticality.
- Identify blind spots where configuration tools do not cover unmanaged hosts, non-domain systems, Linux/macOS endpoints, cloud or container-hosted workloads, ESXi, network devices, or offline systems.
Mitigation priorities
- Define an approved OS configuration baseline for each relevant system class and map exceptions to business owners and compensating controls.
- Disable unused OS features and unnecessary services, including legacy name-resolution or file-sharing components where not needed.
- Enforce OS-level protections and mandatory access controls where supported by the operating system.
- Restrict privileged access, root/sudo usage, local administrator membership, and sensitive file or directory permissions.
- Harden remote access by limiting RDP, SSH, and VNC exposure to authorized sources and enforcing strong authentication-related settings described in policy.
Additional notes and limits
M1028 is a mitigation object, not a detection analytic. Its importance comes from its breadth: the supplied relationships connect OS hardening to credential access, discovery, persistence, privilege escalation, lateral movement, exfiltration, command and control, and impact techniques. Glexia would use this as a control-validation anchor for managed detection onboarding, IR readiness reviews, identity hardening, compliance evidence, and vulnerability-management prioritization.
The ATT&CK object does not specify platforms or tactics for the mitigation itself and provides no official detection guidance. Platform references in this take come from the official description and related techniques. Local asset inventory, configuration baselines, business criticality, and change records are required to determine actual coverage and risk reduction.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Operating System Configuration
Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures:
Disable Unused Features:
- Turn off SMBv1, LLMNR, and NetBIOS where not needed. - Disable remote registry and unnecessary services.
Enforce OS-level Protections:
- Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows. - Use AppArmor or SELinux on Linux for mandatory access controls.
Secure Access Settings:
- Enable User Account Control (UAC) for Windows. - Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.
File System Hardening:
- Implement least-privilege access for critical files and system directories. - Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).
Secure Remote Access:
- Restrict RDP, SSH, and VNC to authorized IPs using firewall rules. - Enable NLA for RDP and enforce strong password/lockout policies.
Harden Boot Configurations:
- Enable Secure Boot and enforce UEFI/BIOS password protection. - Use BitLocker or LUKS to encrypt boot drives.
Regular Audits:
- Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.
*Tools for Implementation*
Windows:
- Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings. - Windows Defender Exploit Guard: Built-in OS protection against exploits. - CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.
Linux/macOS:
- AppArmor/SELinux: Enforce mandatory access controls. - Lynis: Perform comprehensive security audits. - SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.
Cross-Platform:
- Ansible or Chef/Puppet: Automate configuration hardening at scale. - OpenSCAP: Perform compliance and configuration checks.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.