NIST-SI-4 System Monitoring

a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: monitoring objectives] ; and 2. Unauthorized local, network, and remote connections; b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: techniques and methods]; c. Invoke internal monitoring capabilities or deploy monitoring devices: 1. Strategically within the system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Analyze detected events and anomalies; e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f. Obtain legal opinion regarding system monitoring activities; and g. Provide [Assignment: system monitoring information] to [Assignment: personnel or roles] [Selection (one or more of): as needed; {{ insert: param, si-04_odp.06 }} ].

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software. Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1005 Data from Local System • T1008 Fallback Channels • T1011 Exfiltration Over Other Network Medium • T1011.001 Exfiltration Over Bluetooth • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.008 Direct Cloud VM Connections • T1025 Data from Removable Media • T1027 Obfuscated Files or Information • T1027.002 Software Packing • T1027.007 Dynamic API Resolution • T1027.008 Stripped Payloads • T1027.009 Embedded Payloads • T1027.010 Command Obfuscation • T1027.011 Fileless Storage • T1027.012 LNK Icon Smuggling • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1036 Masquerading • T1036.001 Invalid Code Signature • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.007 Double File Extension • T1036.008 Masquerade File Type • T1036.010 Masquerade Account Name • T1037 Boot or Logon Initialization Scripts • T1037.002 Login Hook • T1037.003 Network Logon Script • T1037.004 RC Scripts • T1037.005 Startup Items • T1040 Network Sniffing • T1041 Exfiltration Over C2 Channel • T1046 Network Service Discovery • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1055 Process Injection • T1055.001 Dynamic-link Library Injection • T1055.002 Portable Executable Injection • T1055.003 Thread Execution Hijacking • T1055.004 Asynchronous Procedure Call • T1055.005 Thread Local Storage • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1055.011 Extra Window Memory Injection • T1055.012 Process Hollowing • T1055.013 Process Doppelgänging • T1055.014 VDSO Hijacking • T1056.002 GUI Input Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.009 Cloud API • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1070.010 Relocate Malware • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1071.005 Publish/Subscribe Protocols • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1080 Taint Shared Content • T1087 Account Discovery • T1087.001 Local Account • T1087.002 Domain Account • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1091 Replication Through Removable Media • T1092 Communication Through Removable Media • T1095 Non-Application Layer Protocol • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.007 Additional Local or Domain Groups • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1106 Native API • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1111 Multi-Factor Authentication Interception • T1114 Email Collection • T1114.001 Local Email Collection • T1114.002 Remote Email Collection • T1114.003 Email Forwarding Rule • T1119 Automated Collection • T1127 Trusted Developer Utilities Proxy Execution • T1127.001 MSBuild • T1127.002 ClickOnce • T1129 Shared Modules • T1132 Data Encoding • T1132.001 Standard Encoding … and 225 more