Skip to content

M1038 Execution Prevention

Block execution of code on a system through application control, and/or script blocking.

Item Value
ID M1038
Version 1.2
Created 11 June 2019
Last Modified 28 February 2022
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
enterprise T1548 Abuse Elevation Control Mechanism System settings can prevent applications from running that haven’t been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
enterprise T1548.004 Elevated Execution with Prompt System settings can prevent applications from running that haven’t been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.004 Winlogon Helper DLL Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control 3 tools like AppLocker 5 6 that are capable of auditing and/or blocking unknown DLLs.
enterprise T1547.006 Kernel Modules and Extensions Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.1819161517
enterprise T1176 Browser Extensions Set a browser extension allow or deny list as appropriate for your security policy. 9
enterprise T1059 Command and Scripting Interpreter Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).22
enterprise T1059.001 PowerShell Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).22
enterprise T1059.002 AppleScript Use application control where appropriate.
enterprise T1059.003 Windows Command Shell Use application control where appropriate.
enterprise T1059.004 Unix Shell Use application control where appropriate.
enterprise T1059.005 Visual Basic Use application control where appropriate. VBA macros obtained from the Internet, based on the file’s Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.10
enterprise T1059.006 Python Denylist Python where not required.
enterprise T1059.007 JavaScript Denylist scripting where appropriate.
enterprise T1059.008 Network Device CLI TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization. 23
enterprise T1059.009 Cloud API Use application control where appropriate to block use of PowerShell CmdLets or other host based resources to access cloud API resources.
enterprise T1609 Container Administration Command Use read-only containers, read-only file systems, and minimal images when possible to prevent the execution of commands.21 Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.20
enterprise T1611 Escape to Host Use read-only containers, read-only file systems, and minimal images when possible to prevent the running of commands.21 Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.20
enterprise T1546 Event Triggered Execution -
enterprise T1546.002 Screensaver Block .scr files from being executed from non-standard locations.
enterprise T1546.006 LC_LOAD_DYLIB Addition Allow applications via known hashes.
enterprise T1546.008 Accessibility Features Adversaries can replace accessibility features binaries with alternate binaries to execute this technique. Identify and block potentially malicious software executed through accessibility features functionality by using application control 3 tools, like Windows Defender Application Control4, AppLocker, 5 6 or Software Restriction Policies 7 where appropriate. 8
enterprise T1546.009 AppCert DLLs Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control 3 tools, like Windows Defender Application Control4, AppLocker, 5 6 or Software Restriction Policies 7 where appropriate. 8
enterprise T1546.010 AppInit DLLs Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control 3 tools, like Windows Defender Application Control4, AppLocker, 5 6 or Software Restriction Policies 7 where appropriate. 8
enterprise T1068 Exploitation for Privilege Escalation Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.11
enterprise T1564 Hide Artifacts -
enterprise T1564.003 Hidden Window Limit or restrict program execution using anti-virus software. On MacOS, allowlist programs that are allowed to have the plist tag. All other programs should be considered suspicious.
enterprise T1564.006 Run Virtual Instance Use application control to mitigate installation and use of unapproved virtualization software.
enterprise T1574 Hijack Execution Flow Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.
enterprise T1574.001 DLL Search Order Hijacking Adversaries may use new DLLs to execute this technique. Identify and block potentially malicious software executed through search order hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.
enterprise T1574.006 Dynamic Linker Hijacking Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.
enterprise T1574.007 Path Interception by PATH Environment Variable Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.124561314
enterprise T1574.008 Path Interception by Search Order Hijacking Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.124561314
enterprise T1574.009 Path Interception by Unquoted Path Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.124561314
enterprise T1574.012 COR_PROFILER Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.356
enterprise T1562 Impair Defenses Use application control where appropriate, especially regarding the execution of tools outside of the organization’s security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.
enterprise T1562.001 Disable or Modify Tools Use application control where appropriate, especially regarding the execution of tools outside of the organization’s security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.
enterprise T1562.011 Spoof Security Alerting Use application controls to mitigate installation and use of payloads that may be utilized to spoof security alerting.
enterprise T1036 Masquerading Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
enterprise T1036.005 Match Legitimate Name or Location Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
enterprise T1036.008 Masquerade File Type Ensure that input sanitization is performed and that files are validated properly before execution; furthermore, implement a strict allow list to ensure that only authorized file types are processed.1 Restrict and/or block execution of files where headers and extensions do not match.
enterprise T1106 Native API Identify and block potentially malicious software executed that may be executed through this technique by using application control 3 tools, like Windows Defender Application Control4, AppLocker, 5 6 or Software Restriction Policies 7 where appropriate. 8
enterprise T1219 Remote Access Software Use application control to mitigate installation and use of unapproved software that can be used for remote access.
enterprise T1505 Server Software Component -
enterprise T1505.004 IIS Components Restrict unallowed ISAPI extensions and filters from running by specifying a list of ISAPI extensions and filters that can run on IIS.24
enterprise T1129 Shared Modules Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown DLLs from being loaded.
enterprise T1553 Subvert Trust Controls System settings can prevent applications from running that haven’t been downloaded through the Apple Store (or other legitimate repositories) which can help mitigate some of these issues. Also enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious content.
enterprise T1553.001 Gatekeeper Bypass System settings can prevent applications from running that haven’t been downloaded through the Apple Store which can help mitigate some of these issues.
enterprise T1553.003 SIP and Trust Provider Hijacking Enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs.
enterprise T1553.005 Mark-of-the-Web Bypass Consider blocking container file types at web and/or email gateways. Consider unregistering container file extensions in Windows File Explorer.25
enterprise T1218 System Binary Proxy Execution Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.
enterprise T1218.001 Compiled HTML File Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.002 Control Panel Identify and block potentially malicious and unknown .cpl files by using application control 3 tools, like Windows Defender Application Control4, AppLocker, 5 6 or Software Restriction Policies 7 where appropriate. 8
enterprise T1218.003 CMSTP Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.004 InstallUtil Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.005 Mshta Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.2
enterprise T1218.008 Odbcconf Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.009 Regsvcs/Regasm Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.012 Verclsid Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.013 Mavinject Use application control configured to block execution of mavinject.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1218.014 MMC Use application control configured to block execution of MMC if it is not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1216 System Script Proxy Execution Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1216.001 PubPrn Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
enterprise T1080 Taint Shared Content Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control 3 tools, like AppLocker, 5 6 or Software Restriction Policies 7 where appropriate. 8
enterprise T1127 Trusted Developer Utilities Proxy Execution Certain developer utilities should be blocked or restricted if not required.
enterprise T1127.001 MSBuild Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.2
enterprise T1204 User Execution Application control may be able to prevent the running of executables masquerading as other files.
enterprise T1204.002 Malicious File Application control may be able to prevent the running of executables masquerading as other files.
enterprise T1047 Windows Management Instrumentation Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.2
enterprise T1220 XSL Script Processing If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.

References

  1. YesWeRHackers. (2021, June 16). File Upload Attacks (Part 2). Retrieved August 23, 2022. ↩

  2. Coulter, D. et al.. (2019, April 9). Microsoft recommended block rules. Retrieved August 12, 2021. ↩↩↩

  3. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014. ↩↩↩↩↩↩↩↩

  4. Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019. ↩↩↩↩↩↩↩↩

  5. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016. ↩↩↩↩↩↩↩↩↩↩↩

  6. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016. ↩↩↩↩↩↩↩↩↩↩↩

  7. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014. ↩↩↩↩↩↩

  8. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016. ↩↩↩↩↩↩

  9. Mohta, A. (n.d.). Block Chrome Extensions using Google Chrome Group Policy Settings. Retrieved January 10, 2018. ↩

  10. Kellie Eickmeyer. (2022, February 7). Helping users stay safe: Blocking internet macros by default in Office. Retrieved February 7, 2022. ↩

  11. Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021. ↩

  12. Beechey, J.. (2014, November 18). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014. ↩↩↩

  13. Corio, C., & Sayana, D. P.. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014. ↩↩↩

  14. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016. ↩↩↩

  15. Boelen, M. (2015, October 7). Increase kernel integrity with disabled Linux kernel modules loading. Retrieved June 4, 2020. ↩

  16. Kernel.org. (2020, February 6). Kernel Self-Protection. Retrieved June 4, 2020. ↩

  17. Pingios, A.. (2018, February 7). LKM loading kernel restrictions. Retrieved June 4, 2020. ↩

  18. Vander Stoep, J. (2016, April 5). [v3] selinux: restrict kernel module loadinglogin register. Retrieved April 9, 2018. ↩

  19. Wikibooks. (2018, August 19). Grsecurity/The RBAC System. Retrieved June 4, 2020. ↩

  20. Kubernetes. (n.d.). Configure a Security Context for a Pod or Container. Retrieved March 8, 2023. ↩↩

  21. National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022. ↩↩

  22. PowerShell Team. (2017, November 2). PowerShell Constrained Language Mode. Retrieved March 27, 2023. ↩↩

  23. Cisco. (n.d.). Cisco IOS Software Integrity Assurance - TACACS. Retrieved October 19, 2020. ↩

  24. Microsoft. (2016, September 26). ISAPI/CGI Restrictions . Retrieved June 3, 2021. ↩

  25. Dormann, W. (2019, September 4). The Dangers of VHD and VHDX Files. Retrieved March 16, 2021. ↩