Exploit Protection
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| ICS | T1701 | .001 | Command and Scripting Interpreter: PowerShell |
Use supported exploit-protection controls on Windows-based ICS overlap assets to reduce execution paths commonly used to launch or inject PowerShell-driven payloads. Validate compatibility with HMI, historian, engineering, and vendor applications before enforcement. |
| .004 | Command and Scripting Interpreter: Visual Basic |
Harden applications that can host or launch VB/VBA/VBScript content and reduce exposed script-host execution paths where operationally feasible. |
||
| .005 | Command and Scripting Interpreter: Python |
Apply exploit-protection controls to Python-capable Windows/Linux ICS overlap assets where supported, particularly when Python is embedded in engineering or vendor applications. |
||
| .006 | Command and Scripting Interpreter: JavaScript |
Harden browsers, HTML applications, and Windows scripting hosts that can execute JavaScript/JScript on ICS overlap assets. |
||
| ICS | T0817 | Drive-by Compromise |
Utilize exploit protection to prevent activities which may be exploited through malicious web sites. |
|
| ICS | T0819 | Exploit Public-Facing Application |
Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application. [1] |
|
| ICS | T0820 | Exploitation for Evasion |
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [2] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [3] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted. |
|
| ICS | T0890 | Exploitation for Privilege Escalation |
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [2] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [3] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted. |
|
| ICS | T0866 | Exploitation of Remote Services |
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [2] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [3] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted. |
|