CIS-2.6 Allowlist Authorized Libraries

• T1129 Shared Modules — Adversaries load DLLs, shared objects, and other modules into processes to execute malicious code. Library allowlisting directly restricts this behavior by permitting only approved modules to load. • T1505.004 IIS Components — Malicious IIS components commonly use ISAPI extensions, filters, or modules implemented as DLLs loaded by IIS worker processes. Where library allowlisting governs IIS library loads, blocking unauthorized DLLs directly prevents those malicious components from loading. • T1546.006 LC_LOAD_DYLIB Addition — LC_LOAD_DYLIB abuse causes a modified Mach-O binary to load an attacker-controlled dylib. Where macOS libraries are covered by the allowlist, blocking the unauthorized dylib directly limits this technique. • T1546.009 AppCert DLLs — Unauthorized persistence DLLs cannot load if restricted by library allowlisting. • T1546.010 AppInit DLLs — Prevents unauthorized AppInit DLL persistence where load control is enforced. • T1547.002 Authentication Package — Authentication Package persistence relies on a malicious authentication DLL being loaded by the Windows authentication subsystem. Where these DLLs are subject to allowlisting, unauthorized authentication packages can be blocked at load time. • T1547.004 Winlogon Helper DLL — Winlogon helper persistence relies on loading an unauthorized DLL. Library allowlisting prevents loading of non-authorized modules, directly disrupting this persistence method. • T1547.005 Security Support Provider — SSP persistence requires loading a malicious authentication DLL. Load validation blocks unauthorized SSP modules from being loaded into LSASS. • T1547.008 LSASS Driver — LSASS Driver persistence relies on malicious DLLs or LSA plug-ins being loaded into the LSASS process. Library allowlisting can prevent unauthorized libraries from loading into LSASS, directly disrupting this persistence mechanism. • T1553.003 SIP and Trust Provider Hijacking — Trust Provider Hijacking can replace or introduce malicious DLLs used by Windows trust-validation mechanisms. Where these libraries are governed, allowlisting approved trust-provider DLLs can directly prevent unauthorized components from loading. • T1574.001 DLL — Unauthorized DLLs fail to load if not on the allowlist, directly mitigating search order hijacking. Side-loaded malicious libraries are blocked when load validation is enforced. • T1574.006 Dynamic Linker Hijacking — Enforced library validation prevents execution of malicious shared objects via linker abuse. • T1574.012 COR_PROFILER — COR_PROFILER abuse requires loading a malicious profiling DLL. Library enforcement prevents unauthorized profiler DLLs from loading into .NET processes.