Executable Allowlisting

Derived by composition, not from a source that names this pair. D3FEND publishes that Executable Allowlisting counters T1562.003 Impair Command History Logging; SafeMode's curated mapping records DE-0003.08 as addressing that same adversary behaviour in the space domain. Authenticating a file by digital signature before it is opened is the same mechanism as verifying a signed software or table upload before the spacecraft loads it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Executable Allowlisting counters T1565.003 Runtime Data Manipulation; SafeMode's curated mapping records EX-0012.01 as addressing that same adversary behaviour in the space domain. Authenticating a file by digital signature before it is opened is the same mechanism as verifying a signed software or table upload before the spacecraft loads it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Executable Allowlisting counters T1565.003 Runtime Data Manipulation; SafeMode's curated mapping records EX-0012.03 as addressing that same adversary behaviour in the space domain. Authenticating a file by digital signature before it is opened is the same mechanism as verifying a signed software or table upload before the spacecraft loads it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

Derived by composition, not from a source that names this pair. D3FEND publishes that Executable Allowlisting counters T1565.003 Runtime Data Manipulation; SafeMode's curated mapping records EX-0012.12 as addressing that same adversary behaviour in the space domain. Authenticating a file by digital signature before it is opened is the same mechanism as verifying a signed software or table upload before the spacecraft loads it. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.