+Execution Prevention

Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures: Application Control: - Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`) Script Blocking: - Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`) Executable Blocking: - Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories. Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is related to Mitigations
blocks IDE Tunneling
blocks SyncAppvPublishingServer
blocks SIP and Trust Provider Hijacking
blocks AutoHotKey & AutoIT
blocks Match Legitimate Resource Name or Location
blocks Path Interception by Search Order Hijacking
blocks Dynamic Linker Hijacking
blocks Screensaver
blocks Hidden Window
blocks Subvert Trust Controls
blocks IDE Extensions
blocks Mshta
blocks Visual Basic
blocks InstallUtil
blocks User Execution
blocks DLL
blocks Malicious Copy and Paste
blocks Shared Modules
blocks Regsvcs/Regasm
blocks Abuse Elevation Control Mechanism
blocks Elevated Execution with Prompt
blocks Escape to Host
blocks PubPrn
blocks Shortcut Modification
blocks Verclsid
blocks Native API
blocks JamPlus
blocks Electron Applications
blocks Remote Access Tools
blocks System Script Proxy Execution
blocks Windows Management Instrumentation
blocks Input Injection
blocks JavaScript
blocks Malicious File
blocks AppInit DLLs
blocks Unix Shell
blocks Hijack Execution Flow
blocks IIS Components
blocks Winlogon Helper DLL
blocks AppleScript
blocks Gatekeeper Bypass
blocks Masquerade File Type
blocks Odbcconf
blocks Disable or Modify Tools
blocks Command and Scripting Interpreter
blocks Path Interception by PATH Environment Variable
blocks Trusted Developer Utilities Proxy Execution
blocks Inhibit System Recovery
blocks Network Device CLI
blocks System Binary Proxy Execution
blocks Control Panel
blocks Windows Command Shell
blocks LC_LOAD_DYLIB Addition
blocks XSL Script Processing
blocks Taint Shared Content
blocks Cloud API
blocks Kernel Modules and Extensions
blocks Path Interception by Unquoted Path
blocks Python
blocks Container CLI/API
blocks Lua
blocks MSBuild
blocks COR_PROFILER
blocks Accessibility Features
blocks AppCert DLLs
blocks Software Extensions
blocks Exploitation for Privilege Escalation
blocks Browser Extensions
blocks Mark-of-the-Web Bypass
blocks CMSTP
blocks Remote Desktop Software
blocks Masquerading
blocks MMC
blocks Compiled HTML File
blocks Mavinject
blocks Run Virtual Instance
blocks Container Administration Command
blocks Modify or Spoof Tool UI
blocks PowerShell
  • MITREATTACK -

    © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. https://attack.mitre.org/

    Terms of Use

    LICENSE

    The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

    "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

    DISCLAIMERS

    MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.

    ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

    See our FAQ for more information on how to use and represent the ATT&CK name.
Impressum German English