CIS-2.3 Address Unauthorized Software

• T1021.005 VNC — Adversaries use VNC server software to establish remote interactive access to systems. When VNC server software is classified as unauthorized, this safeguard requires it to be removed, eliminating the VNC server endpoint required to establish the remote session. • T1059.006 Python — Adversaries use installed Python interpreters to execute commands, scripts, and payloads. When Python is classified as unauthorized and removed under this safeguard, the local interpreter required for Python-based execution is eliminated, directly restricting this execution path. • T1059.011 Lua — Adversaries can use a Lua interpreter to execute malicious Lua commands or scripts. When Lua is unauthorized on the asset and is removed through this safeguard, the interpreter required to execute Lua code is no longer available, directly restricting the technique. • T1127.001 MSBuild — Adversaries abuse MSBuild to execute malicious code through a trusted developer utility. When MSBuild is unnecessary, explicitly classified as unauthorized, and removed under this safeguard, the executable required for this proxy-execution technique is eliminated. • T1543 Create or Modify System Process — Automated detection and removal of unauthorized installed services can directly disrupt adversary-created system services used for persistence. Enforcement reduces persistence reliability. • T1543.003 Windows Service — Removal of unauthorized service binaries prevents continued execution of adversary-installed services. • T1547 Boot or Logon Autostart Execution — If unauthorized startup software is identified and removed, persistence via installed startup components is disrupted.