M1033: Limit Software Installation
Prevent users or groups from installing unauthorized or unapproved software to reduce the risk of introducing malicious or vulnerable applications. This can be achieved through allowlists, software restriction policies, endpoint management tools, and least privilege access principles. This mitigation can be implemented through the following measures:
Application Whitelisting
- Implement Microsoft AppLocker or Windows Defender Application Control (WDAC) to create and enforce allowlists for approved software. - Whitelist applications based on file hash, path, or digital signatures.
Restrict User Permissions
- Remove local administrator rights for all non-IT users. - Use Role-Based Access Control (RBAC) to restrict installation permissions to privileged accounts only.
Software Restriction Policies (SRP)
- Use GPO to configure SRP to deny execution of binaries from directories such as `%AppData%`, `%Temp%`, and external drives. - Restrict specific file types (`.exe`, `.bat`, `.msi`, `.js`, `.vbs`) to trusted directories only.
Endpoint Management Solutions
- Deploy tools like Microsoft Intune, SCCM, or Jamf for centralized software management. - Maintain a list of approved software, versions, and updates across the enterprise.
Monitor Software Installation Events
- Enable logging of software installation events and monitor Windows Event ID 4688 and Event ID 11707 for software installs. - Use SIEM or EDR tools to alert on attempts to install unapproved software.
Implement Software Inventory Management
- Use tools like OSQuery or Wazuh to scan for unauthorized software on endpoints and servers. - Conduct regular audits to detect and remove unapproved software.
*Tools for Implementation*
Application Whitelisting:
- Microsoft AppLocker - Windows Defender Application Control (WDAC)
Endpoint Management:
- Microsoft Intune - SCCM (System Center Configuration Manager) - Jamf Pro (macOS) - Puppet or Ansible for automation
Software Restriction Policies:
- Group Policy Object (GPO) - Microsoft Software Restriction Policies (SRP)
Monitoring and Logging:
- Splunk - OSQuery - Wazuh (open-source SIEM and XDR) - EDRs
Inventory Management and Auditing:
- OSQuery - Wazuh
Security context for executives and security teams
M1033: Limit Software Installation describes Prevent users or groups from installing unauthorized or unapproved software to reduce the risk of introducing malicious or vulnerable applications. This can be achieved through allowlists, software restriction policies, endpoint management tools, and least privilege access principles. This mitigation can be implemented through the following measures: Application Whitelisting - Implement Microsoft AppLocker or Windows Defender Application Control (WDAC) to create and enforce allowlists for approved software. - White...
Executive priority
M1033: Limit Software Installation is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M1033: Limit Software Installation by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M1033: Limit Software Installation appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Limit Software Installation
Prevent users or groups from installing unauthorized or unapproved software to reduce the risk of introducing malicious or vulnerable applications. This can be achieved through allowlists, software restriction policies, endpoint management tools, and least privilege access principles. This mitigation can be implemented through the following measures:
Application Whitelisting
- Implement Microsoft AppLocker or Windows Defender Application Control (WDAC) to create and enforce allowlists for approved software. - Whitelist applications based on file hash, path, or digital signatures.
Restrict User Permissions
- Remove local administrator rights for all non-IT users. - Use Role-Based Access Control (RBAC) to restrict installation permissions to privileged accounts only.
Software Restriction Policies (SRP)
- Use GPO to configure SRP to deny execution of binaries from directories such as `%AppData%`, `%Temp%`, and external drives. - Restrict specific file types (`.exe`, `.bat`, `.msi`, `.js`, `.vbs`) to trusted directories only.
Endpoint Management Solutions
- Deploy tools like Microsoft Intune, SCCM, or Jamf for centralized software management. - Maintain a list of approved software, versions, and updates across the enterprise.
Monitor Software Installation Events
- Enable logging of software installation events and monitor Windows Event ID 4688 and Event ID 11707 for software installs. - Use SIEM or EDR tools to alert on attempts to install unapproved software.
Implement Software Inventory Management
- Use tools like OSQuery or Wazuh to scan for unauthorized software on endpoints and servers. - Conduct regular audits to detect and remove unapproved software.
*Tools for Implementation*
Application Whitelisting:
- Microsoft AppLocker - Windows Defender Application Control (WDAC)
Endpoint Management:
- Microsoft Intune - SCCM (System Center Configuration Manager) - Jamf Pro (macOS) - Puppet or Ansible for automation
Software Restriction Policies:
- Group Policy Object (GPO) - Microsoft Software Restriction Policies (SRP)
Monitoring and Logging:
- Splunk - OSQuery - Wazuh (open-source SIEM and XDR) - EDRs
Inventory Management and Auditing:
- OSQuery - Wazuh
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1176.001 | Browser ExtensionsSub-technique | Only install browser extensions from trusted sources that can be verified. Browser extensions for some browsers can be controlled through Group Policy. Change settings to prevent the browser from installing extensions without sufficient permissions. |
| Enterprise | T1204.005 | Malicious LibrarySub-technique | Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones. |
| Enterprise | T1195.001 | Compromise Software Dependencies and Development ToolsSub-technique | Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.CitationCider Security Top 10 CICD Security Risks |
| Enterprise | T1059 | Command and Scripting Interpreter | Prevent user installation of unrequired command and scripting interpreters. |
| Enterprise | T1564 | Hide Artifacts | Restrict the installation of software that may be abused to create hidden desktops, such as hVNC, to user groups that require it. |
| Enterprise | T1059.011 | LuaSub-technique | Prevent users from installing Lua where not required. |
| Enterprise | T1176 | Software Extensions | Only install extensions from trusted sources that can be verified. |
| Enterprise | T1543 | Create or Modify System Process | Restrict software installation to trusted repositories only and be cautious of orphaned software packages. |
| Enterprise | T1564.003 | Hidden WindowSub-technique | Restrict the installation of software that may be abused to create hidden desktops, such as hVNC, to user groups that require it. |
| Enterprise | T1072 | Software Deployment Tools | Restrict the use of third-party software suites installed within an enterprise network. |
| Enterprise | T1547.013 | XDG Autostart EntriesSub-technique | Restrict software installation to trusted repositories only and be cautious of orphaned software packages. |
| Enterprise | T1176.002 | IDE ExtensionsSub-technique | Only install IDE extensions from trusted sources that can be verified. |
| Enterprise | T1059.006 | PythonSub-technique | Prevent users from installing Python where not required. |
| Enterprise | T1204 | User Execution | Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones. |
| Enterprise | T1195 | Supply Chain Compromise | Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.CitationCider Security Top 10 CICD Security Risks |
| Enterprise | T1543.002 | Systemd ServiceSub-technique | Restrict software installation to trusted repositories only and be cautious of orphaned software packages. |
| Enterprise | T1021.005 | VNCSub-technique | Restrict software installation to user groups that require it. A VNC server must be manually installed by the user or adversary. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | 2659a7de3094… | ||
| 19.1 | 1.1 | Older bundle | 2659a7de3094… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackM1033Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.