M1047Audit
Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.
ZT: verify explicitlyLogging & Audit PolicyWindowsLinuxmacOSCloudIdentity
TA0004Defense Plan
Privilege Escalation
Gaining higher privileges
Techniques in this tactic (1)
M1038Execution Prevention
Allowlisting that permits only approved applications/scripts to run; blocks unknown code execution by default.
ZT: least privilegeApplication Control / AllowlistingWindowsLinuxmacOS
Identity Governance and Access Certification
Identity governance (Access Reviews, entitlement, cross-tenant) that prevents privilege creep and unmonitored external access.
ZT: least privilegeIGA / Access ReviewWindowsCloudIdentity
Just-in-Time Privileged Access (PIM/JIT)
PIM that makes privileged roles eligible rather than permanent, used via approved and time-limited activation.
ZT: least privilegePIM / JITWindowsLinuxCloudIdentity
M1032Multi-factor Authentication
Multi-factor authentication that stops the vast majority of password-based attacks; enforced in Entra via Conditional Access.
ZT: verify explicitlyConditional Access / IAMWindowsIdentity
M1026Privileged Account Management
Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.
ZT: least privilegePAM / Tiered AdminWindowsLinuxIdentityCloud
M1051Update Software
Closing the exploitation surface by timely patching of known vulnerabilities; eliminates one of the most common origins of breaches.
Vulnerability & Patch ManagementWindowsLinuxmacOSNetworkCloud
M1018User Account Management
Account lifecycle management: proper creation, assignment with least privilege, timely disabling, and periodic access reviews.
ZT: least privilegeIAM / Joiner-Mover-LeaverWindowsLinuxmacOSIdentityCloud
Application Allowlisting
Blocking LOLBin/malware attacks by allowing only approved code, libraries, and scripts to execute.
ZT: least privilegeAppLocker / WDAC PolicyWindows
Zero Trust Architecture
A least-privilege architecture that rejects the assumption of a trusted internal network and verifies every access request by identity, device, and context.
ZT: verify explicitlyZero Trust / ZTNAWindowsLinuxmacOSCloudIdentity