The sub-techniques beta is now live! Read the release blog post for more info.

Operating System Configuration

Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.

ID: M1028
Version: 1.0
Created: 06 June 2019
Last Modified: 06 June 2019

Techniques Addressed by Mitigation

Domain ID Name Description
Enterprise T1015 Accessibility Features

To use this technique remotely, an adversary must use it in conjunction with RDP. Ensure that Network Level Authentication is enabled to force the remote desktop session to authenticate before the session is created and the login screen displayed. It is enabled by default on Windows Vista and later.[1]

Enterprise T1087 Account Discovery

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: E numerate administrator accounts on elevation.[2]

Enterprise T1098 Account Manipulation

Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.

Enterprise T1139 Bash History

There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands:set +o history and set -o history to start logging again;unset HISTFILE being added to a user's .bash_rc file; andln -s /dev/null ~/.bash_history to write commands to /dev/nullinstead.

Enterprise T1197 BITS Jobs

Consider reducing the default BITS job lifetime in Group Policy or by editing the JobInactivityTimeout and MaxDownloadTime Registry values in HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS.[3]

Enterprise T1092 Communication Through Removable Media

Disallow or restrict removable media at an organizational policy level if they are not required for business operations.

Enterprise T1136 Create Account

Protect domain controllers by ensuring proper security configuration for critical servers.

Enterprise T1003 Credential Dumping

Consider disabling or restricting NTLM.[5]

Enterprise T1011 Exfiltration Over Other Network Medium

Prevent the creation of new network adapters where possible.

Enterprise T1147 Hidden Users

If the computer is domain joined, then group policy can help restrict the ability to create or hide users. Similarly, preventing the modification of the /Library/Preferences/ Hide500Users value will force all users to be visible.

Enterprise T1148 HISTCONTROL

Make sure that the HISTCONTROL environment variable is set to "ignoredup" instead of "ignoreboth" or "ignorespace".

Enterprise T1490 Inhibit System Recovery

Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery.

Enterprise T1130 Install Root Certificate

Windows Group Policy can be used to manage root certificates and the Flags value of HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots can be set to 1 to prevent non-administrator users from making further root installations into their own HKCU certificate store.[6]

Enterprise T1174 Password Filter DLL

Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.

Enterprise T1076 Remote Desktop Protocol

Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.[4]

Enterprise T1053 Scheduled Task

Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl. The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled.[7]

Enterprise T1166 Setuid and Setgid

Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system.

Enterprise T1206 Sudo Caching

Similarly, ensuring that the tty_tickets setting is enabled will prevent this leakage across tty sessions.