AC-6Least Privilege

Implementations targeting this control (4)

• aws-config-iam-root-access-key-check Root account has no active access keys AWS::IAM::AccountSummary partial
• aws-config-iam-policy-no-statements-with-admin-access No IAM policy grants full admin (*:*) AWS::IAM::Policy mostly
• aws-config-iam-no-inline-policy-check IAM identities have no inline policies AWS::IAM::Role partial
• gcp-cis-iam-no-primitive-roles No primitive roles granted at the project level cloudresourcemanager.googleapis.com/Project mostly

ATT&CK techniques this control mitigates (268)

• T1003 OS Credential Dumping Credential Access
• T1003.001 LSASS Memory Credential Access
• T1003.002 Security Account Manager Credential Access
• T1003.003 NTDS Credential Access
• T1003.004 LSA Secrets Credential Access
• T1003.005 Cached Domain Credentials Credential Access
• T1003.006 DCSync Credential Access
• T1003.007 Proc Filesystem Credential Access
• T1003.008 /etc/passwd and /etc/shadow Credential Access
• T1005 Data from Local System Collection
• T1020.001 Traffic Duplication Exfiltration
• T1021 Remote Services Lateral Movement
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.002 SMB/Windows Admin Shares Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.004 SSH Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1021.007 Cloud Services Lateral Movement
• T1021.008 Direct Cloud VM Connections Lateral Movement
• T1025 Data from Removable Media Collection
• T1036 Masquerading Stealth
• T1036.003 Rename Legitimate Utilities Stealth
• T1036.005 Match Legitimate Resource Name or Location Stealth
• T1041 Exfiltration Over C2 Channel Exfiltration
• T1047 Windows Management Instrumentation Execution
• T1048 Exfiltration Over Alternative Protocol Exfiltration
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
• T1052 Exfiltration Over Physical Medium Exfiltration
• T1052.001 Exfiltration over USB Exfiltration
• T1053 Scheduled Task/Job Execution, Persistence, Privilege Escalation
• T1053.002 At Execution, Persistence, Privilege Escalation
• T1053.003 Cron Execution, Persistence, Privilege Escalation
• T1053.005 Scheduled Task Execution, Persistence, Privilege Escalation
• T1053.006 Systemd Timers Execution, Persistence, Privilege Escalation
• T1053.007 Container Orchestration Job Execution, Persistence, Privilege Escalation
• T1055 Process Injection Stealth, Privilege Escalation
• T1055.001 Dynamic-link Library Injection Stealth, Privilege Escalation
• T1055.002 Portable Executable Injection Stealth, Privilege Escalation
• T1055.003 Thread Execution Hijacking Stealth, Privilege Escalation
• T1055.004 Asynchronous Procedure Call Stealth, Privilege Escalation
• T1055.005 Thread Local Storage Stealth, Privilege Escalation
• T1055.008 Ptrace System Calls Stealth, Privilege Escalation
• T1055.009 Proc Memory Stealth, Privilege Escalation
• T1055.011 Extra Window Memory Injection Stealth, Privilege Escalation
• T1055.012 Process Hollowing Stealth, Privilege Escalation
• T1055.013 Process Doppelgänging Stealth, Privilege Escalation
• T1055.014 VDSO Hijacking Stealth, Privilege Escalation
• T1056.003 Web Portal Capture Collection, Credential Access

Weaknesses this control addresses (8)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family AC