M1049Antivirus / Antimalware
Signature + heuristic + cloud-based malware detection; a foundational protection layer used alongside modern NGAV/EDR.
ZT: assume breachEndpoint ProtectionWindowsLinuxmacOS
TA0005Defense Plan
Defense Evasion
Evading defense mechanisms
Techniques in this tactic (3)
M1040Behavior Prevention on Endpoint
Block common attack behaviors using Defender ASR rules and Office macro restrictions.
ZT: assume breachEDR / Attack Surface ReductionWindowsLinuxmacOS
M1050Exploit Protection
Platform protections (DEP, ASLR, CFG, CET) that block memory corruption and exploitation techniques.
ZT: assume breachExploit MitigationWindowsLinuxmacOS
M1026Privileged Account Management
Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.
ZT: least privilegePAM / Tiered AdminWindowsLinuxIdentityCloud
M1018User Account Management
Account lifecycle management: proper creation, assignment with least privilege, timely disabling, and periodic access reviews.
ZT: least privilegeIAM / Joiner-Mover-LeaverWindowsLinuxmacOSIdentityCloud