VM Manager is a suite of tools that can be used to manage operating systems for large virtual machine (VM) fleets running Windows and Linux on Compute Engine. VM Manager allows administrators to deploy patches and enforce specific security policies on VMs, including firewall rules, software package management, and other configuration settings.
| Capability ID | Capability Description | Category | Value | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|---|
| vm_manager | VM Manager | protect | partial | T1068 | Exploitation for Privilege Escalation |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1072 | Software Deployment Tools |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1190 | Exploit Public-Facing Application |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1203 | Exploitation for Client Execution |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1210 | Exploitation of Remote Services |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1211 | Exploitation for Stealth |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1212 | Exploitation for Credential Access |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| vm_manager | VM Manager | protect | partial | T1689 | Downgrade Attack |
Comments
VM Manager OS policies can install, remove, and maintain software packages in an enforced desired state, and Patch can keep managed VM operating systems and packages current. These capabilities can reduce downgrade opportunities by removing or replacing obsolete software versions and enforcing approved versions on managed VMs. The mapping is Partial because T1689 also includes protocol and boot-component downgrades that are outside VM Manager software-package enforcement.
References
|
| vm_manager | VM Manager | protect | partial | T1690 | Prevent Command History Logging |
Comments
VM Manager OS policies can manage operating-system files and run condition-based configuration scripts while periodically enforcing the desired state. On managed Linux and Windows VMs, these controls can be used to enforce shell and PowerShell history configuration and restore settings that suppress command-history logging. The mapping is Partial because it requires an explicitly authored policy and does not cover network devices, ESXi, or activity that bypasses the managed configuration.
References
|
| vm_manager | VM Manager | protect | minimal | T1686.003 | Windows Host Firewall |
Comments
VM Manager OS policies can enforce Windows configuration state through managed files, scripts, packages, and policy assignments. If an organization explicitly uses OS policies to maintain Windows Firewall configuration or associated permissions, VM Manager can help restore or enforce the intended firewall state after unauthorized modification. This mapping is Minimal because the protection depends on specific policy configuration and VM Manager does not inherently prevent all firewall changes.
References
|