aol.pm

Operating System Configuration

Mitigation · ATTACK:enterprise:M1028

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:M1028",
  "title": "Operating System Configuration",
  "type": "Mitigation",
  "source_url": "https://attack.mitre.org/mitigations/M1028",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "course-of-action--2f316f6c-ae42-44fe-adf8-150989e0f6d3",
  "external_id": "M1028",
  "domain": "enterprise",
  "created": "2019-06-06T21:16:18.709Z",
  "modified": "2024-12-18T18:04:26.025Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [

  ]
}

Explicit source assertions (39)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1574.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--086ec3ab-803e-4531-a451-15fa9f06297c

Apple Developer Doco Hardened Runtime

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13363d50-e3cc-4e6c-906a-47df844b8694

UCF STIG Elevation Account Enumeration

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1553

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c0ec3cf-8942-4d47-b1ac-dfdaca31bac0

SpectorOps Code Signing Dec 2017

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1053.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdd8726-606a-482d-b371-044eea79be29

TechNet Server Operator Scheduled Task

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33aebe8f-cc59-4953-9648-ba6bf1654cda

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1548.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3815ee11-af3f-48ae-b5b4-d0a0b2aa4d01

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1542.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46ace311-9be9-4d4a-8ef0-fc2c0659fba9

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b5e4611-ed5c-4223-bc75-5e272090b887

Windows RDP Sessions

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516e746b-6208-41db-8ea8-4e3fa42f5053

Microsoft Disable NTLM Nov 2012 · Microsoft WDigest Mit

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5401a61d-a795-4619-aa7e-fdf54cd4358e

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1548

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--540937b6-1afd-4f8b-8deb-c1c4f6456ce7

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57d1a497-ef75-46de-b284-eefa90a99172

Microsoft BITS

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1563.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d0c84c6-1f4b-4adf-924a-7b5489bd0933

Windows RDP Sessions

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1543

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5eb23e3a-c1fb-4d96-99d1-65be2e0a76ca

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--620d641c-8f76-45f3-a86f-03dd28399d5c

UCF STIG Elevation Account Enumeration

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63c9cdd8-0e64-46dd-9459-3d64828b0cc7

TechNet Server Operator Scheduled Task

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1136

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6808a607-0c81-433b-a027-2f1a8fe163c9

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--818e5053-404d-4cc2-ba72-037767737e04

Microsoft GPO Bluetooth FEB 2009 · TechRepublic Wireless GPO FEB 2009

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1556.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d439426-989c-4407-bbef-ac6af47896cc

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ef08a26-d881-4a36-952b-c07808093c6b

UCF STIG Elevation Account Enumeration

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1ee7b5a-94cd-4b3a-aa53-55844968c28f

Tilbury Windows Credentials

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1564.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a45378ad-7f38-47d3-87e1-a3133b29b89b

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1552.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab8f7561-4e27-4974-b93d-03a9c1ae4543

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af69bb4e-4cdb-4a9d-afff-5508c99c1276

Windows Anonymous Enumeration of SAM Accounts

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afd15f23-1829-4d86-9d8b-cae915fe8596

SpectorOps Code Signing Dec 2017

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afee7475-8e61-4bed-98f6-2cee6926e1c8

Microsoft Disable NTLM Nov 2012

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1548.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b69490a4-3768-405e-856d-da11d95183e7

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1136.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0269d4e-456a-4e10-ae89-6b50b447c94d

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1092

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4b3287c-5e5a-4ec0-bc20-4e3b6a0c296f

TechNet Removable Media Control

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4cd9acb-aaea-4b77-890e-f153a58623a4

reagentc_cmd

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1011.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9bce6d2-de66-4114-9cf6-2be555c35194

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1036.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb0b7f7e-9ce2-4917-8eda-ae92080f6ff1

Seqrite DoubleExtension · HowToGeek ShowExtension

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc458462-2c4e-443c-977a-805ea1d6e5a8

TechNet RDP NLA

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1690

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0b2b128-aa44-478f-948f-ae53b67cfb6f

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eccad76f-c5fa-46db-9ccb-5a9ebcada28e

TechNet Server Operator Scheduled Task

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1556.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3ebb911-aab1-4aa8-aac8-0dcc2aec5343

EnableMPRNotifications

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc8ef14d-1a07-4f96-85c3-b62ba6bcffc1

EnableMPRNotifications

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe849763-78b9-4b8a-9219-2781ac7b00e8

Microsoft Disable NTLM Nov 2012 · Microsoft WDigest Mit

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff7f776f-001a-4c86-b359-08c89bd08b3e

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.