TA0002Defense Plan

Execution

Executing malicious code

Techniques in this tactic (1)

Signature + heuristic + cloud-based malware detection; a foundational protection layer used alongside modern NGAV/EDR.

ZT: assume breachEndpoint ProtectionWindowsLinuxmacOS

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

ZT: verify explicitlyLogging & Audit PolicyWindowsLinuxmacOSCloudIdentity

Block common attack behaviors using Defender ASR rules and Office macro restrictions.

ZT: assume breachEDR / Attack Surface ReductionWindowsLinuxmacOS

Allowlisting that permits only approved applications/scripts to run; blocks unknown code execution by default.

ZT: least privilegeApplication Control / AllowlistingWindowsLinuxmacOS

Platform protections (DEP, ASLR, CFG, CET) that block memory corruption and exploitation techniques.

ZT: assume breachExploit MitigationWindowsLinuxmacOS

Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.

ZT: least privilegePAM / Tiered AdminWindowsLinuxIdentityCloud

Narrows egress channels with DNS hardening (protective DNS/RPZ + sinkhole) and web proxy/filtering.

ZT: verify explicitlyWeb/DNS FilteringWindowsLinuxmacOSNetwork

Blocking LOLBin/malware attacks by allowing only approved code, libraries, and scripts to execute.

ZT: least privilegeAppLocker / WDAC PolicyWindows