M1013Application Developer Guidance
Reducing application-layer vulnerabilities at the source through secure development practices.
ZT: verify explicitlySecure SDLCCloudWebMobile
TA0003Defense Plan
Persistence
Establishing persistence
Techniques in this tactic (6)
T1098Active Directory ACL/DACL Suistimali: GenericAll'dan Gölge Kimlik Bilgilerine ve AdminSDHolder KalıcılığınaT1543.002Linux Saldırı Tespiti ve DFIR: Kalıcılık, Yetki Yükseltme ve Log AnaliziT1546.003WMI Event Subscription Kalıcılığı: __EventFilter / __EventConsumer / __FilterToConsumerBinding ile Gizli Arka KapılarT1574.001DLL Tabanlı Kalıcılık ve Yükleme Suistimali: Search Order Hijacking, Side-Loading, COM Hijacking, AppInit ve AppCertT1543.003Windows Servis ve SCM Suistimali: Kalıcılık, Yetki Yükseltme ve Lateral HareketT1053.005Zamanlanmış Görevler ile Kalıcılık ve Lateral Hareket: Teknik Analizi
M1047Audit
Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.
ZT: verify explicitlyLogging & Audit PolicyWindowsLinuxmacOSCloudIdentity
Source:Windows Servis ve SCM Suistimali: Kalıcılık, Yetki Yükseltme ve Lateral HareketDLL Tabanlı Kalıcılık ve Yükleme Suistimali: Search Order Hijacking, Side-Loading, COM Hijacking, AppInit ve AppCertZamanlanmış Görevler ile Kalıcılık ve Lateral Hareket: Teknik AnaliziLinux Saldırı Tespiti ve DFIR: Kalıcılık, Yetki Yükseltme ve Log Analizi
M1040Behavior Prevention on Endpoint
Block common attack behaviors using Defender ASR rules and Office macro restrictions.
ZT: assume breachEDR / Attack Surface ReductionWindowsLinuxmacOS
Source:Windows Servis ve SCM Suistimali: Kalıcılık, Yetki Yükseltme ve Lateral HareketDLL Tabanlı Kalıcılık ve Yükleme Suistimali: Search Order Hijacking, Side-Loading, COM Hijacking, AppInit ve AppCertLinux Saldırı Tespiti ve DFIR: Kalıcılık, Yetki Yükseltme ve Log AnaliziWMI Event Subscription Kalıcılığı: __EventFilter / __EventConsumer / __FilterToConsumerBinding ile Gizli Arka Kapılar
M1038Execution Prevention
Allowlisting that permits only approved applications/scripts to run; blocks unknown code execution by default.
ZT: least privilegeApplication Control / AllowlistingWindowsLinuxmacOS
M1032Multi-factor Authentication
Multi-factor authentication that stops the vast majority of password-based attacks; enforced in Entra via Conditional Access.
ZT: verify explicitlyConditional Access / IAMWindowsIdentity
M1026Privileged Account Management
Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.
ZT: least privilegePAM / Tiered AdminWindowsLinuxIdentityCloud
Source:Active Directory ACL/DACL Suistimali: GenericAll'dan Gölge Kimlik Bilgilerine ve AdminSDHolder KalıcılığınaWindows Servis ve SCM Suistimali: Kalıcılık, Yetki Yükseltme ve Lateral HareketZamanlanmış Görevler ile Kalıcılık ve Lateral Hareket: Teknik AnaliziLinux Saldırı Tespiti ve DFIR: Kalıcılık, Yetki Yükseltme ve Log AnaliziWMI Event Subscription Kalıcılığı: __EventFilter / __EventConsumer / __FilterToConsumerBinding ile Gizli Arka Kapılar
M1051Update Software
Closing the exploitation surface by timely patching of known vulnerabilities; eliminates one of the most common origins of breaches.
Vulnerability & Patch ManagementWindowsLinuxmacOSNetworkCloud
M1018User Account Management
Account lifecycle management: proper creation, assignment with least privilege, timely disabling, and periodic access reviews.
ZT: least privilegeIAM / Joiner-Mover-LeaverWindowsLinuxmacOSIdentityCloud
Source:Active Directory ACL/DACL Suistimali: GenericAll'dan Gölge Kimlik Bilgilerine ve AdminSDHolder KalıcılığınaWindows Servis ve SCM Suistimali: Kalıcılık, Yetki Yükseltme ve Lateral HareketDLL Tabanlı Kalıcılık ve Yükleme Suistimali: Search Order Hijacking, Side-Loading, COM Hijacking, AppInit ve AppCertZamanlanmış Görevler ile Kalıcılık ve Lateral Hareket: Teknik AnaliziLinux Saldırı Tespiti ve DFIR: Kalıcılık, Yetki Yükseltme ve Log AnaliziWMI Event Subscription Kalıcılığı: __EventFilter / __EventConsumer / __FilterToConsumerBinding ile Gizli Arka Kapılar
Application Allowlisting
Blocking LOLBin/malware attacks by allowing only approved code, libraries, and scripts to execute.
ZT: least privilegeAppLocker / WDAC PolicyWindows