CIS-6.5 Require MFA for Administrative Access

• T1072 Software Deployment Tools — Implement multi-factor authentication (MFA) for administrative accounts to provide system and access isolation for critical network systems. • T1078 Valid Accounts — Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised. • T1078.001 Default Accounts — Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised. • T1078.002 Domain Accounts — Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised. • T1078.003 Local Accounts — Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised. • T1078.004 Cloud Accounts — Implement multi-factor authentication (MFA) for administrative accounts to help prevent unauthorized access, even if credentials are compromised. • T1098 Account Manipulation — Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to maintain or elevate access using compromised credentials. • T1098.001 Additional Cloud Credentials — Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to add adversary-owned credentials to a cloud account to maintain or elevate access. • T1098.002 Additional Email Delegate Permissions — Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to grant additional permission levels to an adversary-controlled email account. • T1098.003 Additional Cloud Roles — Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to add additional roles or permissions to an adversary-controlled cloud account to maintain or elevate access. • T1098.005 Device Registration — Requiring multi-factor authentication (MFA) to register devices in Entra ID, configuring MFA systems to disallow enrolling new devices for inactive accounts, and using conditional access policies to restrict initial MFA device enrollment to trusted locations or devices reduces the success of adversary attempts to add additional devices to an adversary-controlled account. • T1110 Brute Force — Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from brute forcing admin credentials. • T1110.001 Password Guessing — Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using password guessing to access admin accounts. • T1110.002 Password Cracking — Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using password cracking to recover admin credentials. • T1110.003 Password Spraying — Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using commonly used passwords to attempt to acquire valid admin credentials. • T1110.004 Credential Stuffing — Implement multi-factor authentication (MFA) for administrative accounts to help prevent adversaries from using credentials obtained from breach dumps to gain access to admin accounts through credential overlap. • T1136 Create Account — Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login. • T1136.001 Local Account — Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login. • T1136.002 Domain Account — Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login. • T1136.003 Cloud Account — Using multi-factor authentication for administrative accounts reduces the likelihood that adversaries can use a compromised admin credential to sign in and create additional accounts by preventing access at login. • T1199 Trusted Relationship — Using multi-factor authentication for administrative accounts reduces the success of adversaries breaching trusted third party relationships to compromise those networks and gain access to intended victims. • T1556 Modify Authentication Process — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to modify authentication processes or mechanisms. • T1556.001 Domain Controller Authentication — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. • T1556.002 Password Filter DLL — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to register malicious password filter dynamic link libraries (DLLs) into the authentication process. • T1556.003 Pluggable Authentication Modules — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. • T1556.004 Network Device Authentication — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to bypass of native authentication mechanisms for tenant/device management accounts on network devices. • T1556.004 Network Device Authentication — Requiring multi-factor authentication on administrator accounts ensures that adversaries cannot rely on a single implanted or backdoor password to gain access to network devices without also satisfying an independent second factor. • T1556.005 Reversible Encryption — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials (e.g., domain/identity policy administrator, local security policy administrator) to abuse Active Directory encryption properties and gain access to credentials on Windows systems. • T1556.006 Multi-Factor Authentication — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to disable or modify MFA mechanisms and enable persistent access to compromised accounts. • T1556.007 Hybrid Identity — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials (e.g., hybrid identity environment admin, synchronization service, cloud tenant) to patch, modify, or otherwise backdoor cloud authentication processes • T1556.008 Network Provider DLL — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. • T1556.009 Conditional Access Policies — Integrate multi-factor authentication (MFA) for administrative accounts to reduce the risk of adversaries using compromised privileged credentials to disable or modify conditional access policies. • T1599 Network Boundary Bridging — Using multi-factor authentication on accounts that administer network devices helps prevent adversaries from using compromised credentials to reconfigure or bypass network boundaries by limiting their ability to log in. • T1599.001 Network Address Translation Traversal — Using multi-factor authentication on accounts that administer network devices helps prevent adversaries from using compromised credentials to modify a network device’s Network Address Translation (NAT) configuration by limiting their ability to log in. • T1601 Modify System Image — Using multi-factor authentication on administrator accounts helps prevent adversaries from using compromised credentials to modify system images by limiting their ability to log in. • T1601.001 Patch System Image — Using multi-factor authentication on administrator accounts helps prevent adversaries from using compromised credentials to modify system images and introduce new capabilities or weaken defenses by limiting their ability to log in. • T1601.002 Downgrade System Image — Using multi-factor authentication on administrator accounts helps prevent adversaries from using compromised credentials to install older operating systems by limiting their ability to log in.