CyberStrikeus/CyberStrike - Page 84

cis-nginx-v300-4-1-8

Ensure HTTP Strict Transport Security (HSTS) is enabled (Manual)

cis-nginx-v300-4-1-9

Ensure upstream server traffic is authenticated with a client certificate (Manual)

cis-nginx-v300-5-1-1

Ensure allow and deny filters limit access to specific IP addresses (Manual)

cis-nginx-v300-5-1-2

Ensure only approved HTTP methods are allowed (Manual)

cis-nginx-v300-5-2-1

Ensure timeout values for reading the client header and body are set correctly (Manual)

cis-nginx-v300-5-2-2

Ensure the maximum request body size is set correctly (Manual)

cis-nginx-v300-5-2-3

Ensure the maximum buffer size for URIs is defined (Manual)

cis-nginx-v300-5-2-4

Ensure the number of connections per IP address is limited (Manual)

cis-nginx-v300-5-2-5

Ensure rate limits by IP address are set (Manual)

cis-nginx-v300-5-3-1

Ensure X-Content-Type-Options header is configured and enabled (Manual)

cis-nginx-v300-5-3-2

Ensure that Content Security Policy (CSP) is enabled and configured properly (Manual)

cis-nginx-v300-5-3-3

Ensure the Referrer Policy is enabled and configured properly (Manual)

t0801-monitor-process-state

Adversaries may gather information about the physical process state.

t0802-automated-collection

Adversaries may automate collection of industrial environment information using tools or scripts.

t0811-data-from-information-repositories

Adversaries may target and collect data from information repositories.

t0830-adversary-in-the-middle

Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks.

t0845-program-upload

Adversaries may attempt to upload a program from a PLC to gather information about an industrial process.

t0852-screen-capture

Adversaries may attempt to perform screen capture of devices in the control system environment.

t0861-point-tag-identification

Adversaries may collect point and tag values to gain a more comprehensive understanding of the process environment.

t0868-detect-operating-mode

Adversaries may gather information about a PLCs or controllers current operating mode.

t0877-io-image

Adversaries may seek to capture process values related to the inputs and outputs of a PLC.

t0893-data-from-local-system

Adversaries may target and collect data from local system sources, such as file systems, configuration files, or local databases.

t0869-standard-application-layer-protocol

Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus.

t0884-connection-proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.

t0885-commonly-used-port

Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection.

t0840-network-connection-enumeration

Adversaries may perform network connection enumeration to discover information about device communication patterns.

t0842-network-sniffing

Network sniffing is the practice of using a network interface on a computer system to monitor or capture information regardless of whether it is the specified destination for the information.

t0846-remote-system-discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques.

t0887-wireless-sniffing

Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments.

t0888-remote-system-information-discovery

An adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration.

t0820-exploitation-for-evasion

Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection.

t0849-masquerading

Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion.

t0851-rootkit

Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

t0856-spoof-reporting-message

Adversaries may spoof reporting messages in control system environments for evasion and to impair process control.

t0872-indicator-removal-on-host

Adversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks.

t0894-system-binary-proxy-execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

t0807-command-line-interface

Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands.

t0821-modify-controller-tasking

Adversaries may modify the tasking of a controller to allow for the execution of their own programs.

t0823-graphical-user-interface

Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities.

t0834-native-api

Adversaries may directly interact with the native OS application programming interface (API) to access system functions.