The Cybersecurity Control Playbook

Appendix GRecommended Metrics for MITRE ATT&CK Techniques

Technique	Tactic	Mitigation	Control Type	Suggested Metric
T1001—Data Obfuscation	Command and Control	M1039—Environment Variable Permissions	Preventive	% of systems with restricted variable modification; logs of changes to variables
T1003—OS Credential Dumping	Credential Access	M1043—Credential Access Protection	Preventive	# of credential dumping attempts blocked; % of systems with credential protection enabled
T1005—Data from Local System	Collection	M1022—Restrict File and Directory Permissions	Preventive	% of critical files with restricted access; audit log of access attempts to protected files
T1006—Direct Volume Access	Defense Evasion	M1046—Boot Integrity	Preventive	% of systems with secure boot enabled; alerts for unauthorized boot attempts
T1007—System Service Discovery	Discovery	M1047—Audit	Detective	Frequency of system service discovery attempts detected in audit logs
T1008—Fallback Channels	Command and Control	M1037—Filter Network Traffic	Preventive	# of fallback channel connections blocked; % of traffic filtered
T1010—Application Window Discovery	Discovery	M1021—Restrict Web‐Based Content	Preventive	% of systems with restricted window discovery; application access logs reviewed regularly
T1011—Exfiltration Over Other Network Medium	Exfiltration	M1057—Data Loss Prevention	Preventive	# of exfiltration attempts blocked; % of data monitored by DLP
T1012—Query Registry	Discovery	M1024—Restrict ...