Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Контрмера Disable or Remove Feature or Program
Риски
Каталоги
MITRE ATT&CK
Контрмеры
Disable or Remove Feature or P...
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date. Disable Unused Features: - Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue. Control Applications Installed by Users: - Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment. Remove Unnecessary Services: - Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations. Restrict Add-ons and Plugins: - Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.
ID: M1042
Version: 1.2
Created: 11 Jun 2019
Last Modified: 10 Dec 2024

Techniques Addressed by Mitigation
Domain ID Name Use
Enterprise T1559 Inter-Process Communication

Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017)(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.(Citation: Microsoft ADV170021 Dec 2017)

T1559.002 Dynamic Data Exchange

Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017)(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.(Citation: Microsoft ADV170021 Dec 2017)

Enterprise T1021 Remote Services

If remote services, such as the ability to make direct connections to cloud virtual machines, are not required, disable these connection types where feasible. On ESXi servers, consider enabling lockdown mode, which disables direct access to an ESXi host and requires that the host be managed remotely using vCenter.(Citation: Google Cloud Threat Intelligence ESXi Hardening 2023)(Citation: Broadcom ESXi Lockdown Mode)

T1021.001 Remote Desktop Protocol

Disable the RDP service if it is unnecessary.

T1021.003 Distributed Component Object Model

Consider disabling DCOM through Dcomcnfg.exe.(Citation: Microsoft Disable DCOM)

T1021.004 SSH

Disable the SSH daemon on systems that do not require it, especially ESXi servers. For macOS, ensure Remote Login is disabled under Sharing Preferences.(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)

T1021.005 VNC

Uninstall any VNC server software where not required.

T1021.006 Windows Remote Management

Disable the WinRM service.

T1021.008 Direct Cloud VM Connections

If direct virtual machine connections are not required for administrative use, disable these connection types where feasible.

Enterprise T1505 Server Software Component

Consider disabling software components from servers when possible to prevent abuse by adversaries.(Citation: ITSyndicate Disabling PHP functions)

T1505.003 Web Shell

Consider disabling functions from web technologies such as PHP’s `evaI()` that may be abused for web shells.(Citation: ITSyndicate Disabling PHP functions)

Enterprise T1137 Office Application Startup

Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Disable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. (Citation: MRWLabs Office Persistence Add-ins)

T1137.001 Office Template Macros

Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing. Disable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. (Citation: MRWLabs Office Persistence Add-ins)

Enterprise T1091 Replication Through Removable Media

Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control)

Enterprise T1092 Communication Through Removable Media

Disable Autoruns if it is unnecessary.(Citation: Microsoft Disable Autorun)

Enterprise T1052 Exfiltration Over Physical Medium

Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)

T1052.001 Exfiltration over USB

Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)

Enterprise T1221 Template Injection

Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents (Citation: Microsoft Disable Macros), though this setting may not mitigate the Forced Authentication use for this technique.

Enterprise T1671 Cloud Application Integration

Do not allow users to add new application integrations into a SaaS environment. In Entra ID environments, consider enforcing the “Do not allow user consent” option.(Citation: Microsoft Entra Configure OAuth Consent)

Enterprise T1649 Steal or Forge Authentication Certificates

Consider disabling old/dangerous authentication protocols (e.g. NTLM), as well as unnecessary certificate features, such as potentially vulnerable AD CS web and other enrollment server roles.(Citation: SpecterOps Certified Pre Owned)

Enterprise T1210 Exploitation of Remote Services

Minimize available services to only those that are necessary.

Enterprise T1046 Network Service Discovery

Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.

Enterprise T1557 Adversary-in-the-Middle

Disable legacy network protocols that may be used to intercept network traffic if applicable, especially those that are not needed within an environment.

T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay

Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. (Citation: ADSecurity Windows Secure Baseline)

T1557.002 ARP Cache Poisoning

Consider disabling updating the ARP cache on gratuitous ARP replies.

Enterprise T1011 Exfiltration Over Other Network Medium

Disable WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel in local computer security settings or by group policy if it is not needed within an environment.

T1011.001 Exfiltration Over Bluetooth

Disable Bluetooth in local computer security settings or by group policy if it is not needed within an environment.

Enterprise T1098 Account Manipulation

Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.

T1098.001 Additional Cloud Credentials

Remove unnecessary and potentially abusable authentication mechanisms where possible. For example, in Entra ID environments, disable the app password feature unless explicitly required.

T1098.002 Additional Email Delegate Permissions

If email delegation is not required, disable it. In Google Workspace this can be accomplished through the Google Admin console.(Citation: Gmail Delegation)

T1098.004 SSH Authorized Keys

Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using /etc/ssh/sshd_config. Setting the `PermitRootLogin` directive to `no` will prevent the root user from logging in via SSH.(Citation: Broadcom ESXi SSH)

Enterprise T1059 Command and Scripting Interpreter

Disable or remove any unnecessary or unused shells or interpreters.

T1059.001 PowerShell

It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions. Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.

T1059.005 Visual Basic

Turn off or restrict access to unneeded VB components.

T1059.007 JavaScript

Turn off or restrict access to unneeded scripting components.

Enterprise T1563 Remote Service Session Hijacking

Disable the remote service (ex: SSH, RDP, etc.) if it is unnecessary.

T1563.001 SSH Hijacking

Ensure that agent forwarding is disabled on systems that do not explicitly require this feature to prevent misuse. (Citation: Symantec SSH and ssh-agent)

T1563.002 RDP Hijacking

Disable the RDP service if it is unnecessary.

Enterprise T1133 External Remote Services

Disable or block remotely available services that may be unnecessary.

Enterprise T1609 Container Administration Command

Remove unnecessary tools and software from containers.

Enterprise T1205 Traffic Signaling

Disable Wake-on-LAN if it is not needed within an environment.

Enterprise T1218 System Binary Proxy Execution

Many native binaries may not be necessary within a given environment.

T1218.003 CMSTP

CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).

T1218.004 InstallUtil

InstallUtil may not be necessary within a given environment.

T1218.005 Mshta

Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life.

T1218.007 Msiexec

Consider disabling the AlwaysInstallElevated policy to prevent elevated execution of Windows Installer packages.(Citation: Microsoft AlwaysInstallElevated 2018)

T1218.008 Odbcconf

Odbcconf.exe may not be necessary within a given environment.

T1218.009 Regsvcs/Regasm

Regsvcs and Regasm may not be necessary within a given environment.

T1218.012 Verclsid

Consider removing verclsid.exe if it is not necessary within a given environment.

T1218.013 Mavinject

Consider removing mavinject.exe if Microsoft App-V is not used within a given environment.

T1218.014 MMC

MMC may not be necessary within a given environment since it is primarily used by system administrators, not regular users or clients.

T1218.015 Electron Applications

Remove or deny access to unnecessary and potentially vulnerable software and features to prevent abuse by adversaries. Many native binaries may not be necessary within a given environment: for example, consider disabling the Node.js integration in all renderers that display remote content to protect users by limiting adversaries’ power to plant malicious JavaScript within Electron applications.(Citation: Electron Security 2)

Enterprise T1562 Impair Defenses

Consider removing previous versions of tools that are unnecessary to the environment when possible.

T1562.010 Downgrade Attack

Consider removing previous versions of tools that are unnecessary to the environment when possible.

Enterprise T1127 Trusted Developer Utilities Proxy Execution

Specific developer utilities may not be necessary within a given environment and should be removed if not used.

T1127.001 MSBuild

MSBuild.exe may not be necessary within an environment and should be removed if not being used.

T1127.002 ClickOnce

Disable ClickOnce installations from the internet using the following registry key: `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\TrustManager\PromptingLevel — Internet:Disabled`(Citation: NetSPI ClickOnce)(Citation: Microsoft Learn ClickOnce Config) ClickOnce may not be necessary within an environment and should be disabled if not being used.

T1127.003 JamPlus

JamPlus may not be necessary within a given environment and should be removed if not used.

Enterprise T1611 Escape to Host

Remove unnecessary tools and software from containers.

Enterprise T1219 Remote Access Tools

Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.

T1219.002 Remote Desktop Software

Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.

Enterprise T1552 T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Disable unnecessary metadata services and restrict or disable insecure versions of metadata services that are in use to prevent adversary access.(Citation: Amazon AWS IMDS V2)
Enterprise T1553 T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass

Consider disabling auto-mounting of disk image files (i.e., .iso, .img, .vhd, and .vhdx). This can be achieved by modifying the Registry values related to the Windows Explorer file associations in order to disable the automatic Explorer "Mount and Burn" dialog for these file extensions. Note: this will not deactivate the mount functionality itself.(Citation: GitHub MOTW)
Enterprise T1114 T1114.003 Email Collection: Email Forwarding Rule

Consider disabling external email forwarding.(Citation: Microsoft BEC Campaign)
Enterprise T1564 T1564.006 Hide Artifacts: Run Virtual Instance

Disable Hyper-V if not necessary within a given environment.
T1564.007 VBA Stomping

Turn off or restrict access to unneeded VB components.(Citation: Microsoft Disable VBA Jan 2020)

Enterprise T1555 T1555.004 Credentials from Password Stores: Windows Credential Manager

Consider enabling the “Network access: Do not allow storage of passwords and credentials for network authentication” setting that will prevent network credentials from being stored by the Credential Manager.(Citation: Microsoft Network access Credential Manager)
Enterprise T1546 T1546.002 Event Triggered Execution: Screensaver

Use Group Policy to disable screensavers if they are unnecessary.(Citation: TechNet Screensaver GP)
T1546.014 Emond

Consider disabling emond by removing the Launch Daemon plist file.

Enterprise T1547 T1547.007 Boot or Logon Autostart Execution: Re-opened Applications

This feature can be disabled entirely with the following terminal command: defaults write -g ApplePersistence -bool no.
Enterprise T1595 T1595.003 Active Scanning: Wordlist Scanning

Remove or disable access to any systems, resources, and infrastructure that are not explicitly required to be available externally.

References

  1. Metcalf, S. (2016, October 21). Securing Windows Workstations: Developing a Secure Baseline. Retrieved November 17, 2017.
  2. Metcalf, S. (2016, October 21). Securing Windows Workstations: Developing a Secure Baseline. Retrieved November 17, 2017.
  3. MacCarthaigh, C. (2019, November 19). Add defense in depth against open firewalls, reverse proxies, and SSRF vulnerabilities with enhancements to the EC2 Instance Metadata Service. Retrieved October 14, 2020.
  4. Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] – Working From Home? Remote Logins. Retrieved August 19, 2021.
  5. Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.
  6. Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.
  7. Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.
  8. Broadcom. (2025, February 12). Enabling or disabling Lockdown mode on an ESXi host. Retrieved March 27, 2025.
  9. Broadcom. (2024, December 12). Allowing SSH access to VMware vSphere ESXi/ESX hosts with public/private key authentication. Retrieved March 26, 2025.
  10. Stack Overflow. (n.d.). Why do I see an "Electron Security Warning" after updating my Electron project to the latest version?. Retrieved March 7, 2024.
  11. Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.
  12. Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.
  13. Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.
  14. wdormann. (2019, August 29). Disable Windows Explorer file associations for Disc Image Mount. Retrieved April 16, 2022.
  15. Google. (n.d.). Turn Gmail delegation on or off. Retrieved April 1, 2022.
  16. Alex Marvi, Greg Blaum, and Ron Craft. (2023, June 28). Detection, Containment, and Hardening Opportunities for Privileged Guest Operations, Anomalous Behavior, and VMCI Backdoors on Compromised VMware Hosts. Retrieved March 26, 2025.
  17. Kondratiev, A. (n.d.). Disabling dangerous PHP functions. Retrieved July 26, 2021.
  18. Kondratiev, A. (n.d.). Disabling dangerous PHP functions. Retrieved July 26, 2021.
  19. Knowles, W. (2017, April 21). Add-In Opportunities for Office Persistence. Retrieved November 17, 2024.
  20. Knowles, W. (2017, April 21). Add-In Opportunities for Office Persistence. Retrieved November 17, 2024.
  21. Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.
  22. Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.
  23. Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.
  24. Microsoft. (2018, May 31). AlwaysInstallElevated. Retrieved December 14, 2020.
  25. Carr, N., Sellmer, S. (2021, June 14). Behind the scenes of business email compromise: Using cross-domain threat data to disrupt a large BEC campaign. Retrieved June 15, 2021.
  26. Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.
  27. Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.
  28. Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.
  29. Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
  30. Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
  31. Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
  32. Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
  33. Microsoft. (n.d.). Enable or Disable DCOM. Retrieved November 22, 2017.
  34. Microsoft. (n.d.). Enable or Disable DCOM. Retrieved November 22, 2017.
  35. Microsoft. (n.d.). Enable or disable macros in Office files. Retrieved September 13, 2018.
  36. Microsoft. (2020, January 23). How to turn off Visual Basic for Applications when you deploy Office. Retrieved September 17, 2020.
  37. Microsoft Entra. (2024, September 16). Configure how users consent to applications. Retrieved March 20, 2025.
  38. Microsoft. (2023, August 4). Configure the ClickOnce trust prompt behavior. Retrieved September 9, 2024.
  39. Microsoft. (2016, August 31). Network access: Do not allow storage of passwords and credentials for network authentication. Retrieved November 23, 2020.
  40. Ryan Gandrud. (2015, March 23). All You Need Is One – A ClickOnce Love Story. Retrieved September 9, 2024.
  41. Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.
  42. Hatch, B. (2004, November 22). SSH and ssh-agent. Retrieved January 8, 2018.
  43. Hatch, B. (2004, November 22). SSH and ssh-agent. Retrieved January 8, 2018.
  44. Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.
  45. Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.
  46. Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.
  47. Microsoft. (n.d.). Customizing the Desktop. Retrieved December 5, 2017.
  48. Microsoft. (n.d.). Customizing the Desktop. Retrieved December 5, 2017.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.