NIST-SI-10 Information Input Validation

Check the validity of the following information inputs: [Assignment: information inputs].

Checking the valid syntax and semantics of system inputs—including character set, length, numerical range, and acceptable values—verifies that inputs match specified definitions for format and content. For example, if the organization specifies that numerical values between 1-100 are the only acceptable inputs for a field in a given application, inputs of "387," "abc," or "%K%" are invalid inputs and are not accepted as input to the system. Valid inputs are likely to vary from field to field within a software application. Applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, then the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the corrupted output will perform the wrong operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing them to interpreters prevents the content from being unintentionally interpreted as commands. Input validation ensures accurate and correct inputs and prevents attacks such as cross-site scripting and a variety of injection attacks.

• T1021.002 SMB/Windows Admin Shares • T1021.005 VNC • T1027.010 Command Obfuscation • T1036 Masquerading • T1036.005 Match Legitimate Name or Location • T1036.008 Masquerade File Type • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1071.004 DNS • T1080 Taint Shared Content • T1090 Proxy • T1090.003 Multi-hop Proxy • T1095 Non-Application Layer Protocol • T1127 Trusted Developer Utilities Proxy Execution • T1127.002 ClickOnce • T1129 Shared Modules • T1176 Browser Extensions • T1187 Forced Authentication • T1190 Exploit Public-Facing Application • T1197 BITS Jobs • T1204 User Execution • T1204.002 Malicious File • T1216 System Script Proxy Execution • T1216.001 PubPrn • T1218 System Binary Proxy Execution • T1218.001 Compiled HTML File • T1218.002 Control Panel • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.010 Regsvr32 • T1218.011 Rundll32 • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1218.015 Electron Applications • T1219 Remote Access Software • T1220 XSL Script Processing • T1221 Template Injection • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1546.002 Screensaver • T1546.006 LC_LOAD_DYLIB Addition • T1546.008 Accessibility Features • T1546.009 AppCert DLLs • T1546.010 AppInit DLLs • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1548.006 TCC Manipulation • T1552 Unsecured Credentials • T1552.005 Cloud Instance Metadata API • T1553 Subvert Trust Controls • T1553.001 Gatekeeper Bypass • T1553.003 SIP and Trust Provider Hijacking • T1553.005 Mark-of-the-Web Bypass • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1564.003 Hidden Window • T1564.006 Run Virtual Instance • T1564.009 Resource Forking • T1570 Lateral Tool Transfer • T1572 Protocol Tunneling • T1574 Hijack Execution Flow • T1574.001 DLL Search Order Hijacking • T1574.006 Dynamic Linker Hijacking • T1574.007 Path Interception by PATH Environment Variable • T1574.008 Path Interception by Search Order Hijacking • T1574.009 Path Interception by Unquoted Path • T1574.012 COR_PROFILER • T1574.013 KernelCallbackTable • T1574.014 AppDomainManager • T1599 Network Boundary Bridging • T1599.001 Network Address Translation Traversal • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1609 Container Administration Command • T1622 Debugger Evasion