NIST-AC-6 Least Privilege

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1005 Data from Local System • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.007 Cloud Services • T1021.008 Direct Cloud VM Connections • T1025 Data from Removable Media • T1036 Masquerading • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1041 Exfiltration Over C2 Channel • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1053.007 Container Orchestration Job • T1055 Process Injection • T1055.001 Dynamic-link Library Injection • T1055.002 Portable Executable Injection • T1055.003 Thread Execution Hijacking • T1055.004 Asynchronous Procedure Call • T1055.005 Thread Local Storage • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1055.011 Extra Window Memory Injection • T1055.012 Process Hollowing • T1055.013 Process Doppelgänging • T1055.014 VDSO Hijacking • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.009 Cloud API • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1087.004 Cloud Account • T1091 Replication Through Removable Media • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.005 Device Registration • T1098.006 Additional Container Cluster Roles • T1098.007 Additional Local or Domain Groups • T1106 Native API • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1112 Modify Registry • T1133 External Remote Services • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1134.005 SID-History Injection • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1137 Office Application Startup • T1137.001 Office Template Macros • T1137.002 Office Test • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1137.006 Add-ins • T1176 Browser Extensions • T1185 Browser Session Hijacking • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1197 BITS Jobs • T1199 Trusted Relationship • T1200 Hardware Additions • T1203 Exploitation for Client Execution • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.003 Code Repositories • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.007 Msiexec • T1218.015 Electron Applications • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1484 Domain or Tenant Policy Modification • T1485 Data Destruction • T1485.001 Lifecycle-Triggered Deletion • T1486 Data Encrypted for Impact • T1489 Service Stop • T1490 Inhibit System Recovery • T1491 Defacement • T1491.001 Internal Defacement • T1491.002 External Defacement • T1495 Firmware Corruption • T1505 Server Software Component • T1505.002 Transport Agent • T1505.003 Web Shell • T1505.004 IIS Components • T1505.005 Terminal Services DLL • T1525 Implant Internal Image … and 120 more