Skip to content

M1054 Software Configuration

Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:

Conduct a Security Review of Application Settings:

  • Review the software documentation to identify recommended security configurations.
  • Compare default settings against organizational policies and compliance requirements.

Implement Access Controls and Permissions:

  • Restrict access to sensitive features or data within the software.
  • Enforce least privilege principles for all roles and accounts interacting with the software.

Enable Logging and Monitoring:

  • Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity.
  • Integrate logs with a centralized monitoring solution, such as a SIEM.

Update and Patch Software Regularly:

  • Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities.
  • Use automated patch management tools to streamline the update process.

Disable Unnecessary Features or Services:

  • Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.

Test Configuration Changes:

  • Perform configuration changes in a staging environment before applying them in production.
  • Conduct regular audits to ensure that settings remain aligned with security policies.

Tools for Implementation

Configuration Management Tools:

  • Ansible: Automates configuration changes across multiple applications and environments.
  • Chef: Ensures consistent application settings through code-based configuration management.
  • Puppet: Automates software configurations and audits changes for compliance.

Security Benchmarking Tools:

  • CIS-CAT: Provides benchmarks and audits for secure software configurations.
  • Aqua Security Trivy: Scans containerized applications for configuration issues.

Vulnerability Management Solutions:

  • Nessus: Identifies misconfigurations and suggests corrective actions.

Logging and Monitoring Tools:

  • Splunk: Aggregates and analyzes application logs to detect suspicious activity.
Item Value
ID M1054
Version 1.3
Created 19 July 2019
Last Modified 24 December 2024
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
enterprise T1543 Create or Modify System Process Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.
enterprise T1543.005 Container Service Where possible, consider enforcing the use of container services in rootless mode to limit the possibility of privilege escalation or malicious effects on the host running the container.
enterprise T1555 Credentials from Password Stores -
enterprise T1555.005 Password Managers Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases.
enterprise T1602 Data from Configuration Repository Allowlist MIB objects and implement SNMP views.3
enterprise T1602.001 SNMP (MIB Dump) Allowlist MIB objects and implement SNMP views.3
enterprise T1602.002 Network Device Configuration Dump Allowlist MIB objects and implement SNMP views. Disable Smart Install (SMI) if not used.316
enterprise T1213 Data from Information Repositories Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
enterprise T1213.004 Customer Relationship Management Software Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
enterprise T1213.006 Databases Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
enterprise T1667 Email Bombing Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21 Note that additional filtering may be necessary if emails are coming from legitimate sources.
enterprise T1672 Email Spoofing Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21
enterprise T1546 Event Triggered Execution -
enterprise T1546.013 PowerShell Profile Avoid PowerShell profiles if not needed. Use the -No Profile flag with when executing PowerShell scripts remotely to prevent local profiles and scripts from being executed.
enterprise T1606 Forge Web Credentials Configure browsers/applications to regularly delete persistent web credentials (such as cookies).
enterprise T1606.001 Web Cookies Configure browsers/applications to regularly delete persistent web cookies.
enterprise T1590 Gather Victim Network Information -
enterprise T1590.002 DNS Consider implementing policies for DNS servers, such as Zone Transfer Policies, that enforce a list of validated servers permitted for zone transfers.17
enterprise T1562 Impair Defenses Consider implementing policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.12
enterprise T1562.006 Indicator Blocking Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.
enterprise T1562.009 Safe Mode Boot Ensure that endpoint defenses run in safe mode.18
enterprise T1562.010 Downgrade Attack Consider implementing policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.12
enterprise T1559 Inter-Process Communication Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.89
enterprise T1559.002 Dynamic Data Exchange Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.89
enterprise T1666 Modify Cloud Resource Hierarchy In Azure environments, consider setting a policy to block subscription transfers.11 In AWS environments, consider using Service Control Policies to prevent the use of the LeaveOrganization API call.10
enterprise T1137 Office Application Startup For the Office Test method, create the Registry key used to execute it and set the permissions to “Read Control” to prevent easy access to the key without administrator permissions or requiring Privilege Escalation. 7
enterprise T1137.002 Office Test Create the Registry key used to execute it and set the permissions to “Read Control” to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.7
enterprise T1566 Phishing Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21
enterprise T1566.001 Spearphishing Attachment Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21
enterprise T1566.002 Spearphishing Link Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21.
enterprise T1598 Phishing for Information Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21
enterprise T1598.002 Spearphishing Attachment Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21
enterprise T1598.003 Spearphishing Link Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.21
enterprise T1677 Poisoned Pipeline Execution Where possible, avoid allowing pipelines to run unreviewed code. Where this is necessary, ensure that these pipelines are executed on isolated nodes without access to secrets. In GitHub, avoid using the pull_request_target trigger if possible, do not treat user-controlled inputs (such as branch names) as trusted, and do not use self-hosted runners on public repositories.
enterprise T1539 Steal Web Session Cookie Configure browsers or tasks to regularly delete persistent cookies.
enterprise T1553 Subvert Trust Controls HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. 6
enterprise T1553.004 Install Root Certificate HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate. 6
enterprise T1537 Transfer Data to Cloud Account Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.14 15
enterprise T1535 Unused/Unsupported Cloud Regions Cloud service providers may allow customers to deactivate unused regions.13
enterprise T1550 Use Alternate Authentication Material -
enterprise T1550.004 Web Session Cookie Configure browsers or tasks to regularly delete persistent cookies.

References

  1. Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024. ↩↩↩↩↩↩↩↩

  2. Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. ↩↩↩↩↩↩↩↩

  3. Cisco. (2006, May 10). Securing Simple Network Management Protocol. Retrieved October 19, 2020. ↩↩↩

  4. Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023. ↩

  5. OWASP CheatSheets Series Team. (n.d.). Session Management Cheat Sheet. Retrieved December 26, 2023. ↩

  6. Wikipedia. (2017, February 28). HTTP Public Key Pinning. Retrieved March 31, 2017. ↩↩

  7. Falcone, R. (2016, July 20). Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017. ↩↩

  8. Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018. ↩↩

  9. Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018. ↩↩

  10. Ben Fletcher and Steve de Vera. (2024, June). New tactics and techniques for proactive threat detection. Retrieved September 25, 2024. ↩

  11. Microsoft Azure. (2024, March 21). Manage Azure subscription policies. Retrieved September 25, 2024. ↩

  12. Chromium. (n.d.). HTTP Strict Transport Security. Retrieved May 24, 2023. ↩↩

  13. CloudSploit. (2019, June 8). The Danger of Unused AWS Regions. Retrieved October 8, 2019. ↩

  14. Google. (n.d.). Manage external sharing for your organization. Retrieved March 4, 2024. ↩

  15. Microsoft. (2023, October 11). Manage sharing settings for SharePoint and OneDrive in Microsoft 365. Retrieved March 4, 2024. ↩

  16. US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020. ↩

  17. Microsoft. (2022). DNS Policies Overview. Retrieved June 6, 2024. ↩

  18. Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021. ↩