NIST-AC-3 Access Enforcement

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection ( [PE](#pe) ) family.

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1005 Data from Local System • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.007 Cloud Services • T1021.008 Direct Cloud VM Connections • T1025 Data from Removable Media • T1027 Obfuscated Files or Information • T1036 Masquerading • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.010 Masquerade Account Name • T1037 Boot or Logon Initialization Scripts • T1037.002 Login Hook • T1037.003 Network Logon Script • T1037.004 RC Scripts • T1037.005 Startup Items • T1041 Exfiltration Over C2 Channel • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1053.007 Container Orchestration Job • T1055 Process Injection • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.009 Cloud API • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1071.004 DNS • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1080 Taint Shared Content • T1087.004 Cloud Account • T1090 Proxy • T1090.003 Multi-hop Proxy • T1091 Replication Through Removable Media • T1095 Non-Application Layer Protocol • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.005 Device Registration • T1098.006 Additional Container Cluster Roles • T1098.007 Additional Local or Domain Groups • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1114 Email Collection • T1114.002 Remote Email Collection • T1133 External Remote Services • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1134.005 SID-History Injection • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1185 Browser Session Hijacking • T1187 Forced Authentication • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1197 BITS Jobs • T1199 Trusted Relationship • T1200 Hardware Additions • T1205 Traffic Signaling • T1205.001 Port Knocking • T1210 Exploitation of Remote Services • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.002 Control Panel • T1218.007 Msiexec • T1218.012 Verclsid • T1219 Remote Access Software • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1484 Domain or Tenant Policy Modification • T1485 Data Destruction • T1485.001 Lifecycle-Triggered Deletion • T1486 Data Encrypted for Impact • T1489 Service Stop • T1490 Inhibit System Recovery • T1491 Defacement • T1491.001 Internal Defacement • T1491.002 External Defacement • T1495 Firmware Corruption • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1505 Server Software Component • T1505.002 Transport Agent • T1505.003 Web Shell … and 131 more