LiveActive security incident?Get immediate response
MITRE ATT&CK® Mitigation

M1054: Software Configuration

Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:

Conduct a Security Review of Application Settings:

- Review the software documentation to identify recommended security configurations. - Compare default settings against organizational policies and compliance requirements.

Implement Access Controls and Permissions:

- Restrict access to sensitive features or data within the software. - Enforce least privilege principles for all roles and accounts interacting with the software.

Enable Logging and Monitoring:

- Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity. - Integrate logs with a centralized monitoring solution, such as a SIEM.

Update and Patch Software Regularly:

- Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities. - Use automated patch management tools to streamline the update process.

Disable Unnecessary Features or Services:

- Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.

Test Configuration Changes:

- Perform configuration changes in a staging environment before applying them in production. - Conduct regular audits to ensure that settings remain aligned with security policies.

*Tools for Implementation*

Configuration Management Tools:

- Ansible: Automates configuration changes across multiple applications and environments. - Chef: Ensures consistent application settings through code-based configuration management. - Puppet: Automates software configurations and audits changes for compliance.

Security Benchmarking Tools:

- CIS-CAT: Provides benchmarks and audits for secure software configurations. - Aqua Security Trivy: Scans containerized applications for configuration issues.

Vulnerability Management Solutions:

- Nessus: Identifies misconfigurations and suggests corrective actions.

Logging and Monitoring Tools:

- Splunk: Aggregates and analyzes application logs to detect suspicious activity.

EnterpriseM1054MitigationObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Software Configuration is a broad but high-value mitigation: it turns default or convenience-oriented software settings into security-aligned operating standards. For leaders, the practical issue is not whether tools are installed, but whether applications, SaaS platforms, databases, Office components, cloud services, and supporting software are configured to reduce persistence, collection, credential abuse, phishing exposure, exfiltration paths, and trust-control bypass opportunities.

Executive priority

Prioritize this as a governance and resilience control because many related ATT&CK techniques depend on permissive defaults, unused features, weak access controls, limited logging, or unmonitored cloud/SaaS settings. Executives should ask whether critical business systems have documented secure baselines, change control, audit evidence, logging integration, patch/configuration ownership, and periodic review against policy and compliance requirements.

Technical view

SOC, IR, identity, cloud, and vulnerability teams should validate that security-relevant settings are known, enforced, monitored, and auditable. Relationship context points to Windows and Office persistence, SaaS and database data collection, IaaS region abuse, cloud-to-cloud transfer, web session cookie abuse, system process modification, container service changes, PowerShell profiles, trust store changes, password manager exposure, IPC/DDE abuse, phishing controls, and DNS/SaaS exposure. Because ATT&CK provides no official detection for this mitigation, local validation should focus on whether configuration changes, authentication failures, access-control changes, logging state, patch state, disabled features, and privileged software settings are visible in centralized monitoring.

Likely telemetry

  • Application and middleware configuration change logs
  • Database configuration, access, and audit logs
  • SaaS administration, sharing, authentication, and data access logs
  • Cloud control-plane logs, including region enablement/use and cloud-to-cloud transfer activity where available
  • Windows registry and Office configuration evidence relevant to Office startup and Office Test behavior

Detection direction

  • Confirm whether each critical software platform has security-relevant logs enabled before relying on SOC detection use cases.
  • Tune alerts around configuration changes to sensitive features, permissions, logging settings, cloud regions, sharing/sync controls, services, trust stores, and startup mechanisms.
  • Baseline expected administrative activity so legitimate maintenance, patching, and deployment automation do not overwhelm analysts.
  • Pay special attention to blind spots where SaaS, databases, containers, Office settings, or unused cloud regions are not integrated into centralized monitoring.
  • Use relationship-driven coverage reviews: map secure configuration evidence against persistence, collection, credential-access, lateral-movement, exfiltration, reconnaissance, execution, and defense-impairment techniques listed in the ATT&CK relationships.

Mitigation priorities

  • Start with an inventory of applications, middleware, databases, SaaS platforms, cloud services, and other software that store sensitive data or support critical operations.
  • Define secure configuration baselines using vendor documentation, organizational policy, and compliance requirements.
  • Enforce least privilege for software roles, administrative accounts, sensitive features, and data access.
  • Enable detailed logging for authentication failures, configuration changes, unusual activity, and other key application events; forward relevant logs to centralized monitoring.
  • Patch and update software regularly, using automated patch management where appropriate.
Additional notes and limits

This object is a mitigation rather than a technique, so the defensive value comes from operationalizing secure baselines and proving they remain in force. The relationship set shows this mitigation is relevant across Office, Windows, Linux, macOS, SaaS, IaaS, containers, identity provider, and pre-compromise reconnaissance contexts through the related techniques, even though the mitigation object itself does not specify platforms or tactics.

ATT&CK does not provide an official detection section for M1054, and the mitigation object is intentionally broad. Specific control requirements, telemetry availability, false-positive patterns, and audit evidence must be determined from the organization’s actual software stack, cloud/SaaS providers, regulatory obligations, and change-management practices.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Software Configuration

Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:

Conduct a Security Review of Application Settings:

- Review the software documentation to identify recommended security configurations. - Compare default settings against organizational policies and compliance requirements.

Implement Access Controls and Permissions:

- Restrict access to sensitive features or data within the software. - Enforce least privilege principles for all roles and accounts interacting with the software.

Enable Logging and Monitoring:

- Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity. - Integrate logs with a centralized monitoring solution, such as a SIEM.

Update and Patch Software Regularly:

- Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities. - Use automated patch management tools to streamline the update process.

Disable Unnecessary Features or Services:

- Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.

Test Configuration Changes:

- Perform configuration changes in a staging environment before applying them in production. - Conduct regular audits to ensure that settings remain aligned with security policies.

*Tools for Implementation*

Configuration Management Tools:

- Ansible: Automates configuration changes across multiple applications and environments. - Chef: Ensures consistent application settings through code-based configuration management. - Puppet: Automates software configurations and audits changes for compliance.

Security Benchmarking Tools:

- CIS-CAT: Provides benchmarks and audits for secure software configurations. - Aqua Security Trivy: Scans containerized applications for configuration issues.

Vulnerability Management Solutions:

- Nessus: Identifies misconfigurations and suggests corrective actions.

Logging and Monitoring Tools:

- Splunk: Aggregates and analyzes application logs to detect suspicious activity.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

36 rows
DomainIDNameRelationship / procedure
EnterpriseT1566.002Spearphishing LinkSub-technique

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2].

Furthermore, policies may enforce / install browser extensions that protect against IDN and homograph attacks.

EnterpriseT1688Safe Mode Boot

Ensure that endpoint defenses run in safe mode.[3]

EnterpriseT1550.004Web Session CookieSub-technique

Configure browsers or tasks to regularly delete persistent cookies.

EnterpriseT1602.001SNMP (MIB Dump)Sub-technique

Allowlist MIB objects and implement SNMP views.[4]

EnterpriseT1539Steal Web Session Cookie

Configure browsers or tasks to regularly delete persistent cookies.

Additionally, minimize the length of time a web cookie is viable to potentially reduce the impact of stolen cookies while also increasing the needed frequency of cookie theft attempts – providing defenders with additional chances at detection.[5] For example, use non-persistent cookies to limit the duration a session ID will remain on the web client cache where an attacker could obtain it.[6]

EnterpriseT1553.004Install Root CertificateSub-technique

HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. [7]

EnterpriseT1137.002Office TestSub-technique

Create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.[8]

EnterpriseT1559Inter-Process Communication

Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[9][10]

EnterpriseT1666Modify Cloud Resource Hierarchy

In Azure environments, consider setting a policy to block subscription transfers.[11] In AWS environments, consider using Service Control Policies to prevent the use of the `LeaveOrganization` API call.[12]

EnterpriseT1685Disable or Modify Tools

Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.

EnterpriseT1684.002Email SpoofingSub-technique

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2]

EnterpriseT1213Data from Information Repositories

Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.

EnterpriseT1535Unused/Unsupported Cloud Regions

Cloud service providers may allow customers to deactivate unused regions.[13]

EnterpriseT1598Phishing for Information

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2]

EnterpriseT1566Phishing

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2]

EnterpriseT1537Transfer Data to Cloud Account

Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.[14] [15]

EnterpriseT1677Poisoned Pipeline Execution

Where possible, avoid allowing pipelines to run unreviewed code. Where this is necessary, ensure that these pipelines are executed on isolated nodes without access to secrets. In GitHub, avoid using the `pull_request_target` trigger if possible, do not treat user-controlled inputs (such as branch names) as trusted, and do not use self-hosted runners on public repositories.

EnterpriseT1602Data from Configuration Repository

Allowlist MIB objects and implement SNMP views.[4]

EnterpriseT1213.004Customer Relationship Management SoftwareSub-technique

Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.

EnterpriseT1543.005Container ServiceSub-technique

Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.

EnterpriseT1689Downgrade Attack

Consider implementing policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.[16]

EnterpriseT1602.002Network Device Configuration DumpSub-technique

Allowlist MIB objects and implement SNMP views. Disable Smart Install (SMI) if not used.[4][17]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[9][10]

EnterpriseT1543Create or Modify System Process

Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.

EnterpriseT1590.002DNSSub-technique

Consider implementing policies for DNS servers, such as Zone Transfer Policies, that enforce a list of validated servers permitted for zone transfers.[18]

EnterpriseT1213.006DatabasesSub-technique

Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.

EnterpriseT1546.013PowerShell ProfileSub-technique

Avoid PowerShell profiles if not needed. Use the -No Profile flag with when executing PowerShell scripts remotely to prevent local profiles and scripts from being executed.

EnterpriseT1555.005Password ManagersSub-technique

Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases.

EnterpriseT1606Forge Web Credentials

Configure browsers/applications to regularly delete persistent web credentials (such as cookies).

EnterpriseT1553Subvert Trust Controls

HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. [7]

EnterpriseT1606.001Web CookiesSub-technique

Configure browsers/applications to regularly delete persistent web cookies.

EnterpriseT1667Email Bombing

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2] Note that additional filtering may be necessary if emails are coming from legitimate sources.

EnterpriseT1137Office Application Startup

For the Office Test method, create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation. [8]

EnterpriseT1598.002Spearphishing AttachmentSub-technique

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2]

EnterpriseT1598.003Spearphishing LinkSub-technique

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[1][2]

Furthermore, policies may enforce / install browser extensions that protect against IDN and homograph attacks. Browser password managers may also be configured to only populate credential fields when the URL matches that of the original, legitimate site.

Relationship explorer

All related ATT&CK context

mitigates · TechniqueT1566.002: Spearphishing LinkEnterprisemitigates · TechniqueT1688: Safe Mode BootEnterprisemitigates · TechniqueT1550.004: Web Session CookieEnterprisemitigates · TechniqueT1602.001: SNMP (MIB Dump)Enterprisemitigates · TechniqueT1539: Steal Web Session CookieEnterprisemitigates · TechniqueT1553.004: Install Root CertificateEnterprisemitigates · TechniqueT1137.002: Office TestEnterprisemitigates · TechniqueT1559: Inter-Process CommunicationEnterprisemitigates · TechniqueT1666: Modify Cloud Resource HierarchyEnterprisemitigates · TechniqueT1685: Disable or Modify ToolsEnterprisemitigates · TechniqueT1684.002: Email SpoofingEnterprisemitigates · TechniqueT1213: Data from Information RepositoriesEnterprisemitigates · TechniqueT1535: Unused/Unsupported Cloud RegionsEnterprisemitigates · TechniqueT1598: Phishing for InformationEnterprisemitigates · TechniqueT1566: PhishingEnterprisemitigates · TechniqueT1537: Transfer Data to Cloud AccountEnterprisemitigates · TechniqueT1677: Poisoned Pipeline ExecutionEnterprisemitigates · TechniqueT1602: Data from Configuration RepositoryEnterprisemitigates · TechniqueT1213.004: Customer Relationship Management SoftwareEnterprisemitigates · TechniqueT1543.005: Container ServiceEnterprisemitigates · TechniqueT1689: Downgrade AttackEnterprisemitigates · TechniqueT1602.002: Network Device Configuration DumpEnterprisemitigates · TechniqueT1566.001: Spearphishing AttachmentEnterprisemitigates · TechniqueT1559.002: Dynamic Data ExchangeEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
f79592c17fccb014...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundlef79592c17fcc…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  2. [2]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  3. [3]
    CyberArk Labs Safe Mode 2016

    Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021.

    Open source URL
  4. [4]
    Cisco Securing SNMP

    Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020.

    Open source URL
  5. [5]
    Token tactics

    Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023.

    Open source URL
  6. [6]
    Session Management Cheat Sheet

    OWASP CheatSheets Series Team. (n.d.). Session Management Cheat Sheet. Retrieved December 26, 2023.

    Open source URL
  7. [7]
    Wikipedia HPKP

    Wikipedia. (2017, February 28). HTTP Public Key Pinning. Retrieved March 31, 2017.

    Open source URL
  8. [8]
    Palo Alto Office Test Sofacy

    Falcone, R. (2016, July 20). Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017.

    Open source URL
  9. [9]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  10. [10]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  11. [11]
    Azure Subscription Policies

    Microsoft Azure. (2024, March 21). Manage Azure subscription policies. Retrieved September 25, 2024.

    Open source URL
  12. [12]
    AWS RE:Inforce Threat Detection 2024

    Ben Fletcher and Steve de Vera. (2024, June). New tactics and techniques for proactive threat detection. Retrieved September 25, 2024.

    Open source URL
  13. [13]
    CloudSploit - Unused AWS Regions

    CloudSploit. (2019, June 8). The Danger of Unused AWS Regions. Retrieved October 8, 2019.

    Open source URL
  14. [14]
    Google Workspace External Sharing

    Google. (n.d.). Manage external sharing for your organization. Retrieved March 4, 2024.

    Open source URL
  15. [15]
    Microsoft 365 External Sharing

    Microsoft. (2023, October 11). Manage sharing settings for SharePoint and OneDrive in Microsoft 365. Retrieved March 4, 2024.

    Open source URL
  16. [16]
    Chromium HSTS

    Chromium. (n.d.). HTTP Strict Transport Security. Retrieved May 24, 2023.

    Open source URL
  17. [17]
    US-CERT TA18-106A Network Infrastructure Devices 2018

    US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.

    Open source URL
  18. [18]
    DNS-msft

    Microsoft. (2022). DNS Policies Overview. Retrieved June 6, 2024.

    Open source URL
  19. [19]
    mitre-attackM1054
    Open source URL
  20. [20]
    mitre-attackM1054
    Open source URL
  21. [21]
    mitre-attackM1054
    Open source URL
  22. [22]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  23. [23]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  24. [24]
    CyberArk Labs Safe Mode 2016

    Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021.

    Open source URL
  25. [25]
    Cisco Securing SNMP

    Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020.

    Open source URL
  26. [26]
    Session Management Cheat Sheet

    OWASP CheatSheets Series Team. (n.d.). Session Management Cheat Sheet. Retrieved December 26, 2023.

    Open source URL
  27. [27]
    Token tactics

    Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023.

    Open source URL
  28. [28]
    Wikipedia HPKP

    Wikipedia. (2017, February 28). HTTP Public Key Pinning. Retrieved March 31, 2017.

    Open source URL
  29. [29]
    Palo Alto Office Test Sofacy

    Falcone, R. (2016, July 20). Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017.

    Open source URL
  30. [30]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  31. [31]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  32. [32]
    AWS RE:Inforce Threat Detection 2024

    Ben Fletcher and Steve de Vera. (2024, June). New tactics and techniques for proactive threat detection. Retrieved September 25, 2024.

    Open source URL
  33. [33]
    Azure Subscription Policies

    Microsoft Azure. (2024, March 21). Manage Azure subscription policies. Retrieved September 25, 2024.

    Open source URL
  34. [34]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  35. [35]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  36. [36]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  37. [37]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  38. [38]
    CloudSploit - Unused AWS Regions

    CloudSploit. (2019, June 8). The Danger of Unused AWS Regions. Retrieved October 8, 2019.

    Open source URL
  39. [39]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  40. [40]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  41. [41]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  42. [42]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  43. [43]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  44. [44]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  45. [45]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  46. [46]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  47. [47]
    Google Workspace External Sharing

    Google. (n.d.). Manage external sharing for your organization. Retrieved March 4, 2024.

    Open source URL
  48. [48]
    Microsoft 365 External Sharing

    Microsoft. (2023, October 11). Manage sharing settings for SharePoint and OneDrive in Microsoft 365. Retrieved March 4, 2024.

    Open source URL
  49. [49]
    Cisco Securing SNMP

    Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020.

    Open source URL
  50. [50]
    Cisco Securing SNMP

    Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020.

    Open source URL
  51. [51]
    Chromium HSTS

    Chromium. (n.d.). HTTP Strict Transport Security. Retrieved May 24, 2023.

    Open source URL
  52. [52]
    Cisco Securing SNMP

    Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020.

    Open source URL
  53. [53]
    Cisco Securing SNMP

    Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020.

    Open source URL
  54. [54]
    US-CERT TA18-106A Network Infrastructure Devices 2018

    US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.

    Open source URL
  55. [55]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  56. [56]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  57. [57]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  58. [58]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  59. [59]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  60. [60]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  61. [61]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  62. [62]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  63. [63]
    DNS-msft

    Microsoft. (2022). DNS Policies Overview. Retrieved June 6, 2024.

    Open source URL
  64. [64]
    Wikipedia HPKP

    Wikipedia. (2017, February 28). HTTP Public Key Pinning. Retrieved March 31, 2017.

    Open source URL
  65. [65]
    Wikipedia HPKP

    Wikipedia. (2017, February 28). HTTP Public Key Pinning. Retrieved March 31, 2017.

    Open source URL
  66. [66]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  67. [67]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  68. [68]
    Palo Alto Office Test Sofacy

    Falcone, R. (2016, July 20). Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017.

    Open source URL
  69. [69]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  70. [70]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
  71. [71]
    ACSC Email Spoofing

    Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.

    Open source URL
  72. [72]
    Microsoft Anti Spoofing

    Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use