NIST-CM-7 Least Functionality

a. Configure the system to provide only [Assignment: mission-essential capabilities] ; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].

Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.005 Cached Domain Credentials • T1008 Fallback Channels • T1011 Exfiltration Over Other Network Medium • T1011.001 Exfiltration Over Bluetooth • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.008 Direct Cloud VM Connections • T1027 Obfuscated Files or Information • T1036 Masquerading • T1036.005 Match Legitimate Name or Location • T1036.007 Double File Extension • T1036.008 Masquerade File Type • T1037 Boot or Logon Initialization Scripts • T1037.001 Logon Script (Windows) • T1040 Network Sniffing • T1046 Network Service Discovery • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.005 Scheduled Task • T1059 Command and Scripting Interpreter • T1059.005 Visual Basic • T1059.007 JavaScript • T1059.009 Cloud API • T1059.010 AutoHotKey & AutoIT • T1068 Exploitation for Privilege Escalation • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.004 Cloud Accounts • T1080 Taint Shared Content • T1087 Account Discovery • T1087.001 Local Account • T1087.002 Domain Account • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1090.003 Multi-hop Proxy • T1092 Communication Through Removable Media • T1095 Non-Application Layer Protocol • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.004 SSH Authorized Keys • T1098.007 Additional Local or Domain Groups • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1106 Native API • T1112 Modify Registry • T1127 Trusted Developer Utilities Proxy Execution • T1127.002 ClickOnce • T1129 Shared Modules • T1133 External Remote Services • T1135 Network Share Discovery • T1136 Create Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1176 Browser Extensions • T1187 Forced Authentication • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1197 BITS Jobs • T1199 Trusted Relationship • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1205 Traffic Signaling • T1205.001 Port Knocking • T1210 Exploitation of Remote Services • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1216 System Script Proxy Execution • T1216.001 PubPrn • T1216.002 SyncAppvPublishingServer • T1218 System Binary Proxy Execution • T1218.001 Compiled HTML File • T1218.002 Control Panel • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.007 Msiexec • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1218.015 Electron Applications • T1219 Remote Access Software • T1220 XSL Script Processing • T1221 Template Injection • T1482 Domain Trust Discovery • T1484 Domain or Tenant Policy Modification • T1489 Service Stop • T1490 Inhibit System Recovery • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1505.004 IIS Components • T1525 Implant Internal Image • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1546.002 Screensaver • T1546.006 LC_LOAD_DYLIB Addition • T1546.008 Accessibility Features • T1546.009 AppCert DLLs • T1546.010 AppInit DLLs • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1547.007 Re-opened Applications • T1547.009 Shortcut Modification • T1548 Abuse Elevation Control Mechanism • T1548.001 Setuid and Setgid • T1548.003 Sudo and Sudo Caching • T1548.004 Elevated Execution with Prompt • T1548.006 TCC Manipulation … and 75 more