Configure managed endpoints with anti-malware detection and prevention technology and services.
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1221 | Template Injection |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1204 | User Execution |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1543 | Create or Modify System Process |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1564 | Hide Artifacts |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1221 | Template Injection |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1080 | Taint Shared Content |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1027 | Obfuscated Files or Information |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1036 | Masquerading |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1059.006 | Python |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1059.005 | Visual Basic |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1059.001 | PowerShell |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1059 | Command and Scripting Interpreter |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1092 | Communication Through Removable Media |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1091 | Replication Through Removable Media |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|
| UEM-09 | Anti-Malware Detection and Prevention | mitigates | T1025 | Data from Removable Media |
Comments
This control describes the implementation of endpoint security, including anti-malware software, to mitigate the risk of exploitation by threat actors. The implementation guidance provides several examples of that the technical measures under Anti-Malware should aid with preventing which include:
Scan installed software and system data content to identify and remove unauthorized code/software.
Prohibit the use of installation of unauthorized software.
Restricting on obtaining malicious data and software from external networks.
Endpoint removable media management.
|