NIST-CM-2 Baseline Configuration

a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: frequency]; 2. When required due to [Assignment: circumstances] ; and 3. When system components are installed or upgraded.

Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1008 Fallback Channels • T1011.001 Exfiltration Over Bluetooth • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.005 VNC • T1021.006 Windows Remote Management • T1027 Obfuscated Files or Information • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1036 Masquerading • T1036.001 Invalid Code Signature • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.007 Double File Extension • T1037 Boot or Logon Initialization Scripts • T1037.002 Login Hook • T1037.003 Network Logon Script • T1037.004 RC Scripts • T1037.005 Startup Items • T1046 Network Service Discovery • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.005 Scheduled Task • T1059 Command and Scripting Interpreter • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1068 Exploitation for Privilege Escalation • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1072 Software Deployment Tools • T1080 Taint Shared Content • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1091 Replication Through Removable Media • T1092 Communication Through Removable Media • T1095 Non-Application Layer Protocol • T1098.004 SSH Authorized Keys • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1106 Native API • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1111 Multi-Factor Authentication Interception • T1114 Email Collection • T1114.002 Remote Email Collection • T1119 Automated Collection • T1127 Trusted Developer Utilities Proxy Execution • T1127.001 MSBuild • T1127.002 ClickOnce • T1129 Shared Modules • T1132 Data Encoding • T1132.001 Standard Encoding • T1132.002 Non-Standard Encoding • T1133 External Remote Services • T1134.005 SID-History Injection • T1137 Office Application Startup • T1137.001 Office Template Macros • T1137.002 Office Test • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1137.006 Add-ins • T1176 Browser Extensions • T1176 Browser Extensions • T1185 Browser Session Hijacking • T1187 Forced Authentication • T1189 Drive-by Compromise • T1195 Supply Chain Compromise • T1195.003 Compromise Hardware Supply Chain • T1201 Password Policy Discovery • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1204.003 Malicious Image • T1205 Traffic Signaling • T1210 Exploitation of Remote Services • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.001 Confluence • T1213.002 Sharepoint • T1213.002 Sharepoint • T1213.005 Messaging Applications • T1216 System Script Proxy Execution • T1216.001 PubPrn • T1216.002 SyncAppvPublishingServer • T1218 System Binary Proxy Execution … and 184 more