M1054: Software Configuration
Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:
Conduct a Security Review of Application Settings:
- Review the software documentation to identify recommended security configurations. - Compare default settings against organizational policies and compliance requirements.
Implement Access Controls and Permissions:
- Restrict access to sensitive features or data within the software. - Enforce least privilege principles for all roles and accounts interacting with the software.
Enable Logging and Monitoring:
- Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity. - Integrate logs with a centralized monitoring solution, such as a SIEM.
Update and Patch Software Regularly:
- Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities. - Use automated patch management tools to streamline the update process.
Disable Unnecessary Features or Services:
- Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.
Test Configuration Changes:
- Perform configuration changes in a staging environment before applying them in production. - Conduct regular audits to ensure that settings remain aligned with security policies.
*Tools for Implementation*
Configuration Management Tools:
- Ansible: Automates configuration changes across multiple applications and environments. - Chef: Ensures consistent application settings through code-based configuration management. - Puppet: Automates software configurations and audits changes for compliance.
Security Benchmarking Tools:
- CIS-CAT: Provides benchmarks and audits for secure software configurations. - Aqua Security Trivy: Scans containerized applications for configuration issues.
Vulnerability Management Solutions:
- Nessus: Identifies misconfigurations and suggests corrective actions.
Logging and Monitoring Tools:
- Splunk: Aggregates and analyzes application logs to detect suspicious activity.
Security context for executives and security teams
M1054: Software Configuration describes Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures: Conduct a Security Review of Application Settings: - Review the software documentation to identify recommended security configurations. - Compare default settings against organizati...
Executive priority
M1054: Software Configuration is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M1054: Software Configuration by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M1054: Software Configuration appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Software Configuration
Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:
Conduct a Security Review of Application Settings:
- Review the software documentation to identify recommended security configurations. - Compare default settings against organizational policies and compliance requirements.
Implement Access Controls and Permissions:
- Restrict access to sensitive features or data within the software. - Enforce least privilege principles for all roles and accounts interacting with the software.
Enable Logging and Monitoring:
- Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity. - Integrate logs with a centralized monitoring solution, such as a SIEM.
Update and Patch Software Regularly:
- Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities. - Use automated patch management tools to streamline the update process.
Disable Unnecessary Features or Services:
- Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.
Test Configuration Changes:
- Perform configuration changes in a staging environment before applying them in production. - Conduct regular audits to ensure that settings remain aligned with security policies.
*Tools for Implementation*
Configuration Management Tools:
- Ansible: Automates configuration changes across multiple applications and environments. - Chef: Ensures consistent application settings through code-based configuration management. - Puppet: Automates software configurations and audits changes for compliance.
Security Benchmarking Tools:
- CIS-CAT: Provides benchmarks and audits for secure software configurations. - Aqua Security Trivy: Scans containerized applications for configuration issues.
Vulnerability Management Solutions:
- Nessus: Identifies misconfigurations and suggests corrective actions.
Logging and Monitoring Tools:
- Splunk: Aggregates and analyzes application logs to detect suspicious activity.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1566.002 | Spearphishing LinkSub-technique | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing. Furthermore, policies may enforce / install browser extensions that protect against IDN and homograph attacks. |
| Enterprise | T1688 | Safe Mode Boot | Ensure that endpoint defenses run in safe mode.CitationCyberArk Labs Safe Mode 2016 |
| Enterprise | T1550.004 | Web Session CookieSub-technique | Configure browsers or tasks to regularly delete persistent cookies. |
| Enterprise | T1602.001 | SNMP (MIB Dump)Sub-technique | Allowlist MIB objects and implement SNMP views.CitationCisco Securing SNMP |
| Enterprise | T1539 | Steal Web Session Cookie | Configure browsers or tasks to regularly delete persistent cookies. Additionally, minimize the length of time a web cookie is viable to potentially reduce the impact of stolen cookies while also increasing the needed frequency of cookie theft attempts – providing defenders with additional chances at detection.CitationToken tactics For example, use non-persistent cookies to limit the duration a session ID will remain on the web client cache where an attacker could obtain it.CitationSession Management Cheat Sheet |
| Enterprise | T1553.004 | Install Root CertificateSub-technique | HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. CitationWikipedia HPKP |
| Enterprise | T1137.002 | Office TestSub-technique | Create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.CitationPalo Alto Office Test Sofacy |
| Enterprise | T1559 | Inter-Process Communication | Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.CitationEnigma Reviving DDE Jan 2018CitationGitHub Disable DDEAUTO Oct 2017 |
| Enterprise | T1666 | Modify Cloud Resource Hierarchy | In Azure environments, consider setting a policy to block subscription transfers.CitationAzure Subscription Policies In AWS environments, consider using Service Control Policies to prevent the use of the `LeaveOrganization` API call.CitationAWS RE:Inforce Threat Detection 2024 |
| Enterprise | T1685 | Disable or Modify Tools | Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations. |
| Enterprise | T1684.002 | Email SpoofingSub-technique | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing |
| Enterprise | T1213 | Data from Information Repositories | Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed. |
| Enterprise | T1535 | Unused/Unsupported Cloud Regions | Cloud service providers may allow customers to deactivate unused regions.CitationCloudSploit - Unused AWS Regions |
| Enterprise | T1598 | Phishing for Information | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing |
| Enterprise | T1566 | Phishing | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing |
| Enterprise | T1537 | Transfer Data to Cloud Account | Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.CitationGoogle Workspace External Sharing CitationMicrosoft 365 External Sharing |
| Enterprise | T1677 | Poisoned Pipeline Execution | Where possible, avoid allowing pipelines to run unreviewed code. Where this is necessary, ensure that these pipelines are executed on isolated nodes without access to secrets. In GitHub, avoid using the `pull_request_target` trigger if possible, do not treat user-controlled inputs (such as branch names) as trusted, and do not use self-hosted runners on public repositories. |
| Enterprise | T1602 | Data from Configuration Repository | Allowlist MIB objects and implement SNMP views.CitationCisco Securing SNMP |
| Enterprise | T1213.004 | Customer Relationship Management SoftwareSub-technique | Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed. |
| Enterprise | T1543.005 | Container ServiceSub-technique | Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container. |
| Enterprise | T1689 | Downgrade Attack | Consider implementing policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.CitationChromium HSTS |
| Enterprise | T1602.002 | Network Device Configuration DumpSub-technique | Allowlist MIB objects and implement SNMP views. Disable Smart Install (SMI) if not used.CitationCisco Securing SNMPCitationUS-CERT TA18-106A Network Infrastructure Devices 2018 |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing |
| Enterprise | T1559.002 | Dynamic Data ExchangeSub-technique | Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.CitationEnigma Reviving DDE Jan 2018CitationGitHub Disable DDEAUTO Oct 2017 |
| Enterprise | T1543 | Create or Modify System Process | Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container. |
| Enterprise | T1590.002 | DNSSub-technique | Consider implementing policies for DNS servers, such as Zone Transfer Policies, that enforce a list of validated servers permitted for zone transfers.CitationDNS-msft |
| Enterprise | T1213.006 | DatabasesSub-technique | Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed. |
| Enterprise | T1546.013 | PowerShell ProfileSub-technique | Avoid PowerShell profiles if not needed. Use the -No Profile flag with when executing PowerShell scripts remotely to prevent local profiles and scripts from being executed. |
| Enterprise | T1555.005 | Password ManagersSub-technique | Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases. |
| Enterprise | T1606 | Forge Web Credentials | Configure browsers/applications to regularly delete persistent web credentials (such as cookies). |
| Enterprise | T1553 | Subvert Trust Controls | HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. CitationWikipedia HPKP |
| Enterprise | T1606.001 | Web CookiesSub-technique | Configure browsers/applications to regularly delete persistent web cookies. |
| Enterprise | T1667 | Email Bombing | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing Note that additional filtering may be necessary if emails are coming from legitimate sources. |
| Enterprise | T1137 | Office Application Startup | For the Office Test method, create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation. CitationPalo Alto Office Test Sofacy |
| Enterprise | T1598.002 | Spearphishing AttachmentSub-technique | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing |
| Enterprise | T1598.003 | Spearphishing LinkSub-technique | Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.CitationMicrosoft Anti SpoofingCitationACSC Email Spoofing Furthermore, policies may enforce / install browser extensions that protect against IDN and homograph attacks. Browser password managers may also be configured to only populate credential fields when the URL matches that of the original, legitimate site. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.3 | Current bundle | f79592c17fcc… | ||
| 19.2 | 1.3 | Older bundle | f79592c17fcc… | ||
| 19.1 | 1.3 | Older bundle | f79592c17fcc… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackM1054Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.