Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Execution
Platforms: Windows, Linux, macOS, Network Devices, ESXi, IaaS, Containers
Relationship: mitigation context
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related defensive techniques
Inferred and experimental: These relationships are generated from D3FEND graph paths. They are hypotheses for analysis, not proof of prevention, detection, or control effectiveness.
Showing 30 of 38 inferred defensive relationships.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
What it means
Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
Why it matters
It can reduce malware and unauthorized software risk, but weak policy design or unmanaged exceptions can create bypasses and operational disruption.
Practical focus
- Build rules from trusted publishers, paths, hashes, or managed catalogs
- Include scripts and interpreters in scope
- Test in audit mode before enforcement
- Govern exceptions and rule changes
Common mistakes
- Allowing broad writable paths
- Ignoring signed malicious or vulnerable software
- Creating permanent emergency exceptions
- Deploying enforcement without business testing
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: