HardenD3-SCP
System Configuration Permissions
Definition
Restricting system configuration modifications to a specific user or group of users.
- D3FEND ID
- D3-SCP
- Tactic
- Harden
- Certification relevance
- Security+CISSPCCSP
ATT&CK techniques it counters
11 techniques, 21 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1012Query Registry
- T1112Modify Registry
- T1137Office Application Startup
- T1207Rogue Domain Controller
- T1218System Binary Proxy Execution
- T1543Create or Modify System Process
- T1546Event Triggered Execution
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1564Hide Artifacts
- T1614System Location Discovery
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 11 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-01-002Autorun Differences3 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands3 shared
- CAR-2013-03-001Reg.exe called from Command Shell2 shared
- CAR-2020-05-003Rare LolBAS Command Lines2 shared
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-03-006RunDLL32.exe monitoring1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-005Remote Registry1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2019-04-001UAC Bypass1 shared
- CAR-2019-04-002Generic Regsvr321 shared