Execution Prevention

System settings can prevent applications from running that haven't been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.

Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.^{[4][5][6][7][8]} Since macOS High Sierra 10.13, Secure Kernel Extension Loading (SKEL) can also be used to restrict the loading of kernel modules.^[9]

Use application control where appropriate.

Use application control where appropriate.

Use application control where appropriate.

Use application control where appropriate.

Use application control where appropriate.

Denylist Python where not required.

Denylist scripting where appropriate.

TACACS+ can keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization. ^[11]

Allow applications via known hashes.

Adversaries can replace accessibility features binaries with alternate binaries to execute this technique. Identify and block potentially malicious software executed through accessibility features functionality by using application control ^[1] tools, like Windows Defender Application Control^[12], AppLocker, ^{[2] [3]} or Software Restriction Policies ^[13] where appropriate. ^[14]

Adversaries install new AppCertDLL binaries to execute this technique. Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control ^[1] tools, like Windows Defender Application Control^[12], AppLocker, ^{[2] [3]} or Software Restriction Policies ^[13] where appropriate. ^[14]

Adversaries can install new AppInit DLLs binaries to execute this technique. Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control ^[1] tools, like Windows Defender Application Control^[12], AppLocker, ^{[2] [3]} or Software Restriction Policies ^[13] where appropriate. ^[14]

Use application control to mitigate installation and use of unapproved virtualization software.

Adversaries may use new DLLs to execute this technique. Identify and block potentially malicious software executed through search order hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.

Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.

Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.^{[16][12][2][3][17][18]}

Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.^{[16][12][2][3][17][18]}

Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.^{[16][12][2][3][17][18]}

Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.^[1][2][3]

Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Identify and block potentially malicious and unknown .cpl files by using application control ^[1] tools, like Windows Defender Application Control^[12], AppLocker, ^{[2] [3]} or Software Restriction Policies ^[13] where appropriate. ^[14]

Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.^[20]

Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.

Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Use application control configured to block execution of mavinject.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Use application control configured to block execution of MMC if it is not required for a given system or network to prevent potential misuse by adversaries.

Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

System settings can prevent applications from running that haven't been downloaded through the Apple Store which can help mitigate some of these issues.

Enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious SIP DLLs.

Consider blocking container file types at web and/or email gateways. Consider unregistering container file extensions in Windows File Explorer.^[21]

Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.^[20]

Application control may be able to prevent the running of executables masquerading as other files.