NIST-SI-3 Malicious Code Protection

a. Implement [Selection (one or more of): signature-based; non-signature-based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures; c. Configure malicious code protection mechanisms to: 1. Perform periodic scans of the system [Assignment: frequency] and real-time scans of files from external sources at [Selection (one or more of): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and 2. [Selection (one or more of): block malicious code; quarantine malicious code; take {{ insert: param, si-03_odp.05 }} ] ; and send alert to [Assignment: personnel or roles] in response to malicious code detection; and d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.

System entry and exit points include firewalls, remote access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats contained within compressed or hidden files or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways, including by electronic mail, the world-wide web, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Malicious code protection mechanisms include both signature- and nonsignature-based technologies. Nonsignature-based detection mechanisms include artificial intelligence techniques that use heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide controls against such code for which signatures do not yet exist or for which existing signatures may not be effective. Malicious code for which active signatures do not yet exist or may be ineffective includes polymorphic malicious code (i.e., code that changes signatures when it replicates). Nonsignature-based mechanisms also include reputation-based technologies. In addition to the above technologies, pervasive configuration management, comprehensive software integrity controls, and anti-exploitation software may be effective in preventing the execution of unauthorized code. Malicious code may be present in commercial off-the-shelf software as well as custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions. In situations where malicious code cannot be detected by detection methods or technologies, organizations rely on other types of controls, including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to ensure that software does not perform functions other than the functions intended. Organizations may determine that, in response to the detection of malicious code, different actions may be warranted. For example, organizations can define actions in response to malicious code detection during periodic scans, the detection of malicious downloads, or the detection of maliciousness when attempting to open or execute files.

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1005 Data from Local System • T1008 Fallback Channels • T1011.001 Exfiltration Over Bluetooth • T1021.003 Distributed Component Object Model • T1021.005 VNC • T1025 Data from Removable Media • T1027 Obfuscated Files or Information • T1027.002 Software Packing • T1027.007 Dynamic API Resolution • T1027.008 Stripped Payloads • T1027.009 Embedded Payloads • T1027.010 Command Obfuscation • T1027.012 LNK Icon Smuggling • T1027.013 Encrypted/Encoded File — Encrypted/encoded malware is designed to hide its true purpose from an observer, meaning that signature-based methods of detection may fail. Incorporating alternative detection methods as noted in control SI-03 can provide additional avenues to detect these obfuscated malware and protect against the damage they can cause. • T1027.014 Polymorphic Code — As polymorphic code is difficult to detect via signature-based means, non-signature-based means, pointed out in this control, should be implemented for detection. Additionally, endpoint-level fortifications should be taken to prevent the malware from inflicting damage on systems. • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1036 Masquerading • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.008 Masquerade File Type • T1037 Boot or Logon Initialization Scripts • T1037.002 Login Hook • T1037.003 Network Logon Script • T1037.004 RC Scripts • T1037.005 Startup Items • T1041 Exfiltration Over C2 Channel • T1046 Network Service Discovery • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1055 Process Injection • T1055.001 Dynamic-link Library Injection • T1055.002 Portable Executable Injection • T1055.003 Thread Execution Hijacking • T1055.004 Asynchronous Procedure Call • T1055.005 Thread Local Storage • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1055.011 Extra Window Memory Injection • T1055.012 Process Hollowing • T1055.013 Process Doppelgänging • T1055.014 VDSO Hijacking • T1055.015 ListPlanting • T1056.002 GUI Input Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1070.010 Relocate Malware • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1072 Software Deployment Tools • T1080 Taint Shared Content • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1091 Replication Through Removable Media • T1092 Communication Through Removable Media • T1095 Non-Application Layer Protocol • T1098.004 SSH Authorized Keys • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1106 Native API • T1111 Multi-Factor Authentication Interception • T1129 Shared Modules • T1132 Data Encoding • T1132.001 Standard Encoding • T1132.002 Non-Standard Encoding • T1137 Office Application Startup • T1137.001 Office Template Macros • T1176 Browser Extensions • T1185 Browser Session Hijacking • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1201 Password Policy Discovery • T1203 Exploitation for Client Execution • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1218 System Binary Proxy Execution • T1218.001 Compiled HTML File • T1218.002 Control Panel • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1218.015 Electron Applications • T1219 Remote Access Software • T1221 Template Injection • T1485 Data Destruction • T1486 Data Encrypted for Impact • T1490 Inhibit System Recovery • T1491 Defacement • T1491.001 Internal Defacement • T1491.002 External Defacement • T1505.004 IIS Components • T1525 Implant Internal Image • T1539 Steal Web Session Cookie • T1543 Create or Modify System Process • T1543.002 Systemd Service • T1546.002 Screensaver … and 76 more