Skip to content

Behavior Prevention on Endpoint

Mitigation · ATTACK:enterprise:M1040

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:M1040",
  "title": "Behavior Prevention on Endpoint",
  "type": "Mitigation",
  "source_url": "https://attack.mitre.org/mitigations/M1040",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "course-of-action--90f39ee1-d5a3-4aaa-9f28-3b42815b0d46",
  "external_id": "M1040",
  "domain": "enterprise",
  "created": "2019-06-11T16:43:05.712Z",
  "modified": "2024-12-10T16:29:44.429Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [

  ]
}

Explicit source assertions (51)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--096287e3-0985-4678-95d1-0f6e5a22b7e6

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a28651c-ea35-4f05-a483-d9a60b06cbaf

Malicious Driver Reporting Center · Microsoft driver block rules

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e530e67-4e80-412f-8b38-fbc14085f05c

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1016e15c-64ed-4338-9ca9-83ffae3beb82

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10263c76-62fa-4db6-ab3e-968f130ed893

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d97864c-3e73-48ac-9ddd-83743ee62be6

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f4fe996-b32f-4cc5-b5d6-dc10a9bebeeb

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24db980d-90c2-4934-838c-92209ae110f7

Microsoft ASR Obfuscation

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25fc21a1-4965-4c18-9415-215390eab16c

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2869490f-0728-4a73-a9c2-3a5de5f9f5e7

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3086bfc5-96b1-4768-a243-a82da7155728

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1204

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3551c43c-b1b9-432b-8c3a-cf0265ca74ff

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1543

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3633dab7-324d-4726-af7c-226022996785

Malicious Driver Reporting Center · Microsoft driver block rules

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1559.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38482de7-5eb7-4baf-9007-2e1a6efe9622

Microsoft ASR Nov 2017 · Enigma Reviving DDE Jan 2018

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39acd21f-8be0-4116-9449-09d1f4dd91fd

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--421f569c-e961-4112-a527-1aa5cabd37a1

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50565ea3-2627-44b0-8dd3-155e37d425f3

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--505e8568-1870-4aca-81ff-7c222eb4db37

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1216.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5279a80d-fe4c-45f5-a963-252e02640167

Microsoft_rec_block_rules

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5566a165-9435-4683-9461-870f15450fd3

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5611881f-a9a3-4527-99a6-e717630703bb

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65b695b7-ce85-4362-b174-107e26345547

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--747c6b21-0916-43ee-9655-937cc9e9f0ab

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74a7cfb9-2b2a-44c2-b5ea-0327fe9e17e9

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--782ee381-61f2-4405-b399-9faa99d00fea

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--783be033-9c1b-4c44-a949-d120b0871d7c

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b5bc34e-73b1-4f08-bef2-4e1307232f6d

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1574.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--868d0bb7-fb2a-42d8-8a8a-5772d8a10eea

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--875eff48-2319-4e86-b3cf-0f17d6253b9c

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dfddd1a-dd5f-461f-86ce-ba1fd557a397

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1564.014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ad3e3f4-5db6-44c9-8b67-308eb1087751

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c3ee91e-c64e-47c5-8aeb-300bc8aa6b6e

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c8dee77-e751-40b6-ab99-ccfe6a832e0a

Halcyon AWS Ransomware 2025 · win10_asr

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a584d785-0c26-43e3-93c3-3e4caf397768

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8ec5ebc-8505-471c-ae81-877229b53a65

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b33fd646-b98b-4ea0-8ae3-5cf0367140f6

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba25a8ba-dc7a-4197-b885-d910524588b7

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcdd57cf-632f-4fc5-a8e8-d3137cb832e8

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1569

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcfcbbdb-302d-4e63-ba65-7333dfdaec3a

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3f09021-8932-4433-ad02-a6b7c07b627d

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca928ba4-bb4b-4cd9-a105-8c0d4d81891f

Microsoft ASR Nov 2017 · Enigma Reviving DDE Jan 2018

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cca451aa-d4ca-4697-ac64-745841fb8658

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce044795-c25e-44ba-8b23-d6a2173e9000

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1137.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6651e18-7d44-42a4-b597-1b1c344dd852

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1546.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcbc4dd1-01e6-4ff6-b21e-572f5074f417

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de3095b9-2434-48e8-880b-a4b75a1788c4

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e93059c7-2f60-47f5-af11-bc0a6e7e6d25

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee720f16-feda-4146-891e-fb814f912280

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0df2494-6465-4bd1-9a57-7d93666bba4c

Obfuscated scripts

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8b6eae9-cf2b-4b16-8c44-03d989533dd6

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffe0659a-ff5b-4ffb-a842-38bb630fd6b8

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.