NIST-SC-18 Mobile Code

a. Define acceptable and unacceptable mobile code and mobile code technologies; and b. Authorize, monitor, and control the use of mobile code within the system.

Mobile code includes any program, application, or content that can be transmitted across a network (e.g., embedded in an email, document, or website) and executed on a remote system. Decisions regarding the use of mobile code within organizational systems are based on the potential for the code to cause damage to the systems if used maliciously. Mobile code technologies include Java applets, JavaScript, HTML5, WebGL, and VBScript. Usage restrictions and implementation guidelines apply to both the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations and devices, including notebook computers and smart phones. Mobile code policy and procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.

• T1021.003 Distributed Component Object Model • T1055 Process Injection • T1055.001 Dynamic-link Library Injection • T1055.002 Portable Executable Injection • T1055.003 Thread Execution Hijacking • T1055.004 Asynchronous Procedure Call • T1055.005 Thread Local Storage • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1055.011 Extra Window Memory Injection • T1055.012 Process Hollowing • T1055.013 Process Doppelgänging • T1055.014 VDSO Hijacking • T1059 Command and Scripting Interpreter • T1059.005 Visual Basic • T1059.007 JavaScript • T1068 Exploitation for Privilege Escalation • T1127.002 ClickOnce • T1137 Office Application Startup • T1137.001 Office Template Macros • T1137.002 Office Test • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1137.006 Add-ins • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1203 Exploitation for Client Execution • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1218.001 Compiled HTML File • T1218.015 Electron Applications • T1548 Abuse Elevation Control Mechanism • T1548.004 Elevated Execution with Prompt • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1559.002 Dynamic Data Exchange