LiveActive security incident?Get immediate response
MITRE ATT&CK® Mitigation

M1040: Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

EnterpriseM1040MitigationObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Behavior Prevention on Endpoint is important because it shifts endpoint defense from “known bad file” matching to blocking suspicious actions as they happen, such as abnormal process launches, unauthorized sensitive file access, risky API use, process injection, and exploit-like memory behavior. For leaders, the decision value is whether endpoint controls can interrupt credential theft, stealth, execution, and privilege-escalation behaviors before they become lateral movement or broader incident response problems.

Executive priority

Treat this mitigation as a resilience and control-validation priority, not just a tool feature. The ATT&CK relationships show relevance to OS credential dumping, LSASS memory access, direct volume access, obfuscation, masquerading, WMI abuse, and many process injection variants. Executives should ask whether endpoint prevention policies are actually enabled, monitored, and tested against these behavior classes, especially where credential access or stealthy execution would materially affect business continuity, audit evidence, or incident containment timelines.

Technical view

SOC, detection engineering, and IR teams should validate endpoint behavior-prevention coverage around the behaviors named in the official description: suspicious parent-child process relationships, privilege-escalation attempts, unauthorized reads or modifications of sensitive files, abnormal API usage such as OpenProcess and WriteProcessMemory, process injection, and exploit-like memory writes. Relationship context makes credential dumping and process injection especially important validation areas. Because the mitigation object has no platform field and no official detection text, teams should map coverage locally to the platforms represented by related techniques, including Windows, Linux, macOS, ESXi, containers, network devices, and other listed environments where applicable.

Likely telemetry

  • Endpoint process creation and parent-child process relationship events
  • Endpoint prevention or EDR block/alert events
  • File access events for sensitive operating system credential or restricted locations, such as Windows SAM-related access or Linux /etc/shadow access where collected
  • API call or runtime behavior telemetry related to process access, memory writes, and injection patterns
  • Memory protection, exploit prevention, or abnormal memory operation events

Detection direction

  • Confirm that behavior-prevention policies are in prevention or blocking mode where risk justifies it, not only passive alerting.
  • Test whether endpoint controls detect and block abnormal process relationships, privilege-escalation behavior, process injection, and unauthorized sensitive file access without relying only on static signatures.
  • Prioritize validation against related ATT&CK areas: OS Credential Dumping, LSASS Memory, Direct Volume Access, Obfuscated Files or Information, Masquerading, WMI, and Process Injection sub-techniques.
  • Tune exceptions carefully for legitimate administration, debugging, security tooling, software deployment, and monitoring activity, since these may resemble API access, process manipulation, or sensitive file access.
  • Identify blind spots where endpoint telemetry is unavailable, unsupported, or not forwarded to the SOC, especially on non-Windows platforms and infrastructure types listed in related techniques.

Mitigation priorities

  • Start with high-risk credential and privilege behaviors: block suspicious access to credential stores, LSASS-like memory access where applicable, and abnormal privilege-escalation process chains.
  • Enable behavioral exploit prevention and runtime monitoring features where available, with staged rollout and exception governance to manage operational disruption.
  • Extend validation beyond malware signatures to include process behavior, file access behavior, API behavior, memory behavior, command obfuscation, and masquerading indicators.
  • Document prevention settings, test results, exceptions, and response procedures as compliance and incident readiness evidence.
  • Review coverage after endpoint platform changes, EDR policy updates, or newly prioritized ATT&CK techniques, because this mitigation depends heavily on local sensor capability and configuration.
Additional notes and limits

This is a broad endpoint mitigation, not a specific detection analytic. Its strongest value is in reducing dependence on known signatures and adding behavioral blocking for techniques that often support credential theft, stealth, execution, and privilege escalation. The relationship set is useful for prioritizing validation: credential dumping and process injection families should be prominent in control testing and tabletop discussions.

The official object does not specify platforms, tactics, or detection guidance. Platform references come only from related techniques, so local applicability must be confirmed against the organization’s endpoint estate and tooling. The source does not prove any specific product capability, detection coverage, adversary use, or active exploitation.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

51 rows
DomainIDNameRelationship / procedure
EnterpriseT1036.008Masquerade File TypeSub-technique

Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of files with mismatching file signatures.

EnterpriseT1543.003Windows ServiceSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system.[1] On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed service drivers.[2]

EnterpriseT1055.002Portable Executable InjectionSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1055.004Asynchronous Procedure CallSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1027.014Polymorphic CodeSub-technique

On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads

EnterpriseT1137.006Add-insSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1055.009Proc MemorySub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1027.010Command ObfuscationSub-technique

On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.[4]

EnterpriseT1055.012Process HollowingSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1047Windows Management Instrumentation

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution. [3]

EnterpriseT1059.007JavaScriptSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content [3].

EnterpriseT1204User Execution

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent executable files from running unless they meet a prevalence, age, or trusted list criteria and to prevent Office applications from creating potentially malicious executable content by blocking malicious code from being written to disk. Note: cloud-delivered protection must be enabled to use certain rules. [3]

EnterpriseT1543Create or Modify System Process

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system.[1] On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.[2]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[5][6]

EnterpriseT1574Hijack Execution Flow

Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).

EnterpriseT1569.002Service ExecutionSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running. [3]

EnterpriseT1055.014VDSO HijackingSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1055.013Process DoppelgängingSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1216.001PubPrnSub-technique

On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.[7]

EnterpriseT1036Masquerading

Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).

EnterpriseT1055.003Thread Execution HijackingSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1137.004Outlook Home PageSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1137Office Application Startup

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1091Replication Through Removable Media

On Windows 10, enable Attack Surface Reduction (ASR) rules to block unsigned/untrusted executable files (such as .exe, .dll, or .scr) from running from USB removable drives. [3]

EnterpriseT1003OS Credential Dumping

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. [3]

EnterpriseT1137.001Office Template MacrosSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1137.002Office TestSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1574.013KernelCallbackTableSub-technique

Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).

EnterpriseT1059.005Visual BasicSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content [3].

EnterpriseT1055.011Extra Window Memory InjectionSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1564.014Extended AttributesSub-technique

During artifact review, packaging, or deployment stages, scan extended attributes alongside file contents to detect hidden payloads, obfuscated data, or suspicious attribute keys that may indicate malicious behavior.

EnterpriseT1027.012LNK Icon SmugglingSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts or payloads.

EnterpriseT1486Data Encrypted for Impact

On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware.[3] In AWS environments, create an IAM policy to restrict or block the use of SSE-C on S3 buckets.[8]

EnterpriseT1137.005Outlook RulesSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1204.002Malicious FileSub-technique

On Windows 10, various Attack Surface Reduction (ASR) rules can be enabled to prevent the execution of potentially malicious executable files (such as those that have been downloaded and executed by Office applications/scripting interpreters/email clients or that do not meet specific prevalence, age, or trusted list criteria). Note: cloud-delivered protection must be enabled for certain rules. [3]

EnterpriseT1055.008Ptrace System CallsSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1106Native API

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office VBA macros from calling Win32 APIs. [3]

EnterpriseT1055Process Injection

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection. [3]

EnterpriseT1569System Services

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running. [3]

EnterpriseT1006Direct Volume Access

Some endpoint security solutions can be configured to block some types of behaviors related to efforts by an adversary to create backups, such as command execution or preventing API calls to backup related services.

EnterpriseT1559Inter-Process Communication

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[5][6]

EnterpriseT1027Obfuscated Files or Information

On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads. [3]

EnterpriseT1027.009Embedded PayloadsSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts.[3]

EnterpriseT1137.003Outlook FormsSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk. [3]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent malware from abusing WMI to attain persistence.[3]

EnterpriseT1003.001LSASS MemorySub-technique

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing. [3]

EnterpriseT1059Command and Scripting Interpreter

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic and JavaScript scripts from executing potentially malicious downloaded content [3].

EnterpriseT1055.005Thread Local StorageSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.[9]

Security tools should be configured to analyze the encoding properties of files and detect anomalies that deviate from standard encoding practices.

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

EnterpriseT1055.015ListPlantingSub-technique

Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

Relationship explorer

All related ATT&CK context

mitigates · TechniqueT1036.008: Masquerade File TypeEnterprisemitigates · TechniqueT1543.003: Windows ServiceEnterprisemitigates · TechniqueT1055.002: Portable Executable InjectionEnterprisemitigates · TechniqueT1055.004: Asynchronous Procedure CallEnterprisemitigates · TechniqueT1027.014: Polymorphic CodeEnterprisemitigates · TechniqueT1137.006: Add-insEnterprisemitigates · TechniqueT1055.009: Proc MemoryEnterprisemitigates · TechniqueT1027.010: Command ObfuscationEnterprisemitigates · TechniqueT1055.012: Process HollowingEnterprisemitigates · TechniqueT1047: Windows Management InstrumentationEnterprisemitigates · TechniqueT1059.007: JavaScriptEnterprisemitigates · TechniqueT1204: User ExecutionEnterprisemitigates · TechniqueT1543: Create or Modify System ProcessEnterprisemitigates · TechniqueT1559.002: Dynamic Data ExchangeEnterprisemitigates · TechniqueT1574: Hijack Execution FlowEnterprisemitigates · TechniqueT1569.002: Service ExecutionEnterprisemitigates · TechniqueT1055.014: VDSO HijackingEnterprisemitigates · TechniqueT1055.013: Process DoppelgängingEnterprisemitigates · TechniqueT1216.001: PubPrnEnterprisemitigates · TechniqueT1036: MasqueradingEnterprisemitigates · TechniqueT1055.003: Thread Execution HijackingEnterprisemitigates · TechniqueT1137.004: Outlook Home PageEnterprisemitigates · TechniqueT1137: Office Application StartupEnterprisemitigates · TechniqueT1091: Replication Through Removable MediaEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
d22d3c6d3233910c...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundled22d3c6d3233…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Malicious Driver Reporting Center

    Azure Edge and Platform Security Team & Microsoft 365 Defender Research Team. (2021, December 8). Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center. Retrieved April 6, 2022.

    Open source URL
  2. [2]
    Microsoft driver block rules

    Jordan Geurten et al. . (2022, March 29). Microsoft recommended driver block rules. Retrieved April 7, 2022.

    Open source URL
  3. [3]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  4. [4]
    Microsoft ASR Obfuscation

    Microsoft. (2023, February 22). Attack surface reduction (ASR) rules reference: Block execution of potentially obfuscated scripts. Retrieved March 17, 2023.

    Open source URL
  5. [5]
    Microsoft ASR Nov 2017

    Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.

    Open source URL
  6. [6]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  7. [7]
    Microsoft_rec_block_rules

    Microsoft. (2021, August 23). Retrieved August 16, 2021.

    Open source URL
  8. [8]
    Halcyon AWS Ransomware 2025

    Halcyon RISE Team. (2025, January 13). Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C. Retrieved March 18, 2025.

    Open source URL
  9. [9]
    Obfuscated scripts

    Microsoft. (2024, March 4). Attack surface reduction rules reference. Retrieved March 29, 2024.

    Open source URL
  10. [10]
    mitre-attackM1040
    Open source URL
  11. [11]
    mitre-attackM1040
    Open source URL
  12. [12]
    mitre-attackM1040
    Open source URL
  13. [13]
    Malicious Driver Reporting Center

    Azure Edge and Platform Security Team & Microsoft 365 Defender Research Team. (2021, December 8). Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center. Retrieved April 6, 2022.

    Open source URL
  14. [14]
    Microsoft driver block rules

    Jordan Geurten et al. . (2022, March 29). Microsoft recommended driver block rules. Retrieved April 7, 2022.

    Open source URL
  15. [15]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  16. [16]
    Microsoft ASR Obfuscation

    Microsoft. (2023, February 22). Attack surface reduction (ASR) rules reference: Block execution of potentially obfuscated scripts. Retrieved March 17, 2023.

    Open source URL
  17. [17]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  18. [18]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  19. [19]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  20. [20]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  21. [21]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  22. [22]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  23. [23]
    Malicious Driver Reporting Center

    Azure Edge and Platform Security Team & Microsoft 365 Defender Research Team. (2021, December 8). Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center. Retrieved April 6, 2022.

    Open source URL
  24. [24]
    Malicious Driver Reporting Center

    Azure Edge and Platform Security Team & Microsoft 365 Defender Research Team. (2021, December 8). Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center. Retrieved April 6, 2022.

    Open source URL
  25. [25]
    Microsoft driver block rules

    Jordan Geurten et al. . (2022, March 29). Microsoft recommended driver block rules. Retrieved April 7, 2022.

    Open source URL
  26. [26]
    Microsoft driver block rules

    Jordan Geurten et al. . (2022, March 29). Microsoft recommended driver block rules. Retrieved April 7, 2022.

    Open source URL
  27. [27]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  28. [28]
    Microsoft ASR Nov 2017

    Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.

    Open source URL
  29. [29]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  30. [30]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  31. [31]
    Microsoft_rec_block_rules

    Microsoft. (2021, August 23). Retrieved August 16, 2021.

    Open source URL
  32. [32]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  33. [33]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  34. [34]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  35. [35]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  36. [36]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  37. [37]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  38. [38]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  39. [39]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  40. [40]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  41. [41]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  42. [42]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  43. [43]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  44. [44]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  45. [45]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  46. [46]
    Halcyon AWS Ransomware 2025

    Halcyon RISE Team. (2025, January 13). Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C. Retrieved March 18, 2025.

    Open source URL
  47. [47]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  48. [48]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  49. [49]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  50. [50]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  51. [51]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  52. [52]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  53. [53]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  54. [54]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  55. [55]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  56. [56]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  57. [57]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  58. [58]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  59. [59]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  60. [60]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  61. [61]
    Microsoft ASR Nov 2017

    Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.

    Open source URL
  62. [62]
    Microsoft ASR Nov 2017

    Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.

    Open source URL
  63. [63]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  64. [64]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  65. [65]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  66. [66]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  67. [67]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  68. [68]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  69. [69]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  70. [70]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  71. [71]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use