Attackers rarely need to write new malware when they can install a remote access tool, a browser extension or a poisoned package that the endpoint happily accepts. MITRE ATT&CK mitigation M1033 Limit Software Installation exists to close that door: prevent users or groups from installing unapproved software. In ATT&CK v20 it is mapped to 17 current techniques and sub-techniques, spanning remote access tools, browser and IDE extensions, scripting interpreters, Linux services and developer dependencies. This guide reads the mapping as a control owner would: which techniques M1033 cuts off, which installation paths it misses, how to implement it across endpoints, browsers, IDEs and package managers, and how to measure it. It is written for endpoint, platform and detection engineering teams. For allowlisting engines and rule design, see the Application Allowlisting Guide; this page does not repeat it.
Key takeaways
- M1033 controls installation, not execution. CISA's RMM advisory shows attackers running remote access tools as portable executables that need no administrator rights and so bypass install controls; pair M1033 with execution prevention (M1038).
- Extensions and packages are software too. Four of the mappings are about browser extensions, IDE extensions and developer dependencies, which classic endpoint install controls never see.
- Removing local admin is the cheapest win. ATT&CK's own description starts with removing local administrator rights from non-IT users and restricting installation to privileged roles.
- Allowlists need version control. A trusted extension or package can turn malicious in an update, so pin versions and stage updates for high-risk tools.
- Measure unapproved software found, not policies deployed. Inventory drift against the approved catalogue is the honest metric.
What M1033 is in ATT&CK v20
M1033 was created in June 2019; its page shows version 1.1, last modified 18 December 2024. The description is unusually practical. It lists application allowlisting with Microsoft AppLocker or App Control for Business (WDAC), removing local administrator rights, Software Restriction Policies that deny binaries in %AppData%, %Temp% and removable drives, central endpoint management, logging of installation events (it names Windows Event ID 4688 and Event ID 11707), and regular software inventory audits. MITRE D3FEND relates M1033 to two defensive techniques: D3-EAL Executable Allowlisting and D3-EDL Executable Denylisting.
Techniques M1033 mitigates, by tactic
The table lists all 17 current v20 mappings. "How M1033 helps" paraphrases ATT&CK's usage text.
| Tactic | Technique (mapped sub-techniques) | How M1033 helps, per ATT&CK |
|---|---|---|
| Execution | T1059 Command and Scripting Interpreter (.006 Python, .011 Lua) | Prevent users installing interpreters, such as Python and Lua, where they are not required |
| Execution | T1204 User Execution (.005 Malicious Library) | Developers pull from internal repositories of verified, approved packages |
| Initial Access | T1195 Supply Chain Compromise (.001 Software Dependencies and Development Tools) | The same internal repository requirement |
| Execution, Lateral Movement | T1072 Software Deployment Tools | Restrict third-party software suites installed in the enterprise |
| Lateral Movement | T1021.005 VNC (see T1021 Remote Services) | A VNC server must be installed manually, so restrict installation to groups that need it |
| Persistence | T1176 Software Extensions (.001 Browser Extensions, .002 IDE Extensions) | Install only verified extensions from trusted sources; control browser extensions through Group Policy |
| Persistence, Privilege Escalation | T1543 Create or Modify System Process (.002 Systemd Service); T1547.013 XDG Autostart Entries (see T1547) | Install only from trusted repositories and watch for orphaned packages |
| Stealth | T1564 Hide Artifacts (.003 Hidden Window) | Restrict software that can create hidden desktops, such as hVNC, to groups that require it |
Remote access tools are a notable case. T1219 Remote Access Tools is not mapped to M1033 in v20, yet CISA's advisory AA23-025A recommends allowlisting approved RMM programs and blocking both installation and execution of unauthorised portable RMM tools. Treat RMM as in scope. See the MITRE ATT&CK T1219 Remote Access Tools page and the RMM Tool Security Guide.
Prioritising the mapping
- Remote access and hidden desktops: T1021.005, T1564.003 and unapproved RMM. Highest impact, because one install gives interactive control.
- Extensions: T1176.001 and T1176.002. Extensions run with the user's session and, in IDEs, with access to source, tokens and cloud CLIs.
- Developer dependencies: T1195.001 and T1204.005. One poisoned package reaches every build that pulls it.
- Interpreters and services: T1059.006, T1059.011, T1543.002, T1547.013. Lower volume, but they turn a foothold into durable persistence.
- Deployment suites: T1072. Limit how many software deployment tools exist, because each is a lateral movement platform.
How to implement M1033 by installation channel
| Channel | Control | Specifics from vendor documentation |
|---|---|---|
| Windows desktop software | Remove local admin; allowlist with AppLocker or App Control for Business | AppLocker covers executables, scripts, Windows Installer files, DLLs, packaged apps and packaged app installers, with publisher, path or hash rules and an audit-only mode. Microsoft describes AppLocker as a defence-in-depth feature and points to App Control for Business for robust protection. |
| Browser extensions | Chrome ExtensionSettings policy, with equivalent policies in other managed browsers | Installation modes allowed, blocked, force_installed, normal_installed; a "*" entry sets the default for all extensions and blocked_permissions blocks extensions that request named permissions. It overrides the older allowlist and blocklist policies. |
| VS Code extensions | AllowedExtensions policy (user setting extensions.allowed, from VS Code 1.96) | Allow by publisher, extension ID, exact versions or "stable"; anything not matched is blocked once a list exists, and already installed extensions that are blocked are disabled. Rules match declared identifiers in local VSIX files and do not verify origin. |
| Developer packages | Internal repository or proxy with approved packages | Builds and developer machines resolve only through the internal source. See the Private Package Repository and Proxy Guide. |
| Linux servers | Trusted repositories only; restrict package manager use to configuration management | Watch for orphaned packages and unexpected systemd units or XDG autostart entries. |
| macOS and mobile | MDM-managed app catalogues | Restrict installs to the managed catalogue for non-IT users. |
Rollout sequence
- Inventory first. Collect installed software, extensions and package sources across a representative sample. Build the approved catalogue from what the business actually uses.
- Remove local admin for non-IT users, with an elevation workflow. See the Endpoint Privilege Management Guide.
- Audit mode. Deploy AppLocker or App Control policies in audit mode, and extension policies to a pilot ring; review blocked-would-be events for two to four weeks.
- Enforce in rings: IT pilot, then general staff, then developers and administrators, who need the most exceptions and the most protection.
- Pin high-risk tools. For IDE extensions and developer packages, allow specific versions and stage updates, so a compromised update is not installed automatically.
- Roll back by reverting the policy to audit mode or adding a scoped allow rule, never by restoring local admin broadly.
Where identity fits
Installation control is an identity control in two ways. First, who may install is a question of privilege: local administrator rights, deployment tool accounts and package publishing tokens all decide what reaches an endpoint. Second, the software that gets through often harvests machine credentials. In the GlassWorm campaign attackers used leaked publishing tokens to push malicious versions of VS Code extensions, which then stole npm, GitHub, Git and Open VSX credentials from developer machines and added hidden VNC access. An extension allowlist with pinned versions would have kept those updates off managed machines; scoped, short-lived publishing tokens would have kept them from being published. See the GlassWorm VS Code Extension Worm Guide and the RubyGems, NuGet and Crates.io Publishing Tokens Guide.
What M1033 does not stop
- Portable executables: software that runs without installing, as CISA describes for RMM tools. Execution prevention (M1038) and application allowlisting cover this.
- Trusted software turned malicious: a compromised update of an approved extension or package passes an allowlist that trusts the publisher.
- Abuse of software already present: built-in interpreters and system binaries are not installed, so M1033 does not touch them.
- Privileged installers: an attacker with admin rights or control of a deployment tool installs whatever they want, which is why T1072 sits in the mapping.
- Cloud and SaaS integrations: OAuth apps added to a tenant are "installed" without touching an endpoint.
Detection and measurement
- Unapproved software rate: endpoints with at least one item outside the approved catalogue, as a percentage of managed endpoints.
- Local admin coverage: percentage of non-IT users without standing local administrator rights.
- Extension allowlist coverage: share of managed browsers and IDEs with an allowlist policy applied, from management reports.
- Internal package resolution: share of builds that resolve dependencies only through the internal repository.
- Install events reviewed: Event ID 11707 (Windows Installer success) and process creation 4688 for installers on non-IT machines, alerted and triaged within one business day.
- Exception age: number and median age of install exceptions.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | M1033 Limit Software Installation | 17 current mapped techniques and sub-techniques |
| MITRE D3FEND | D3-EAL, D3-EDL | Executable allowlisting and denylisting |
| NIST SP 800-53 Rev 5 | CM-11 User-installed Software, CM-7(5) Authorized Software, CM-10 Software Usage Restrictions, CM-8 System Component Inventory | Install policy, allow-by-exception, inventory |
| NIST CSF 2.0 | PR.PS-05, PR.PS-02 | Unauthorised software installation and execution are prevented; software maintained and removed by risk |
Common failure patterns
- Endpoint-only scope: desktop installs locked down while browsers, IDEs and package managers stay open.
- Publisher-wide trust: allowing every version from a publisher, so a hijacked publishing account ships straight to users.
- Admin rights for developers by default: the group with access to the most secrets has the fewest install controls.
- Install control without execution control: portable RMM binaries run from the Downloads folder.
- No inventory loop: policies deployed once and never compared with what is actually installed.
Practitioner checklist
- Remove standing local admin from non-IT users and provide an elevation workflow.
- Deploy AppLocker or App Control for Business in audit mode, then enforce in rings.
- Apply a browser extension policy with a default block and an approved list.
- Apply
AllowedExtensionsfor VS Code with pinned versions for high-risk extensions. - Route all package installs through an internal repository or proxy.
- Allowlist the approved RMM tool and block others from installing and running.
- Alert on installer events on non-IT endpoints and on new systemd or autostart entries.
- Review the software inventory against the approved catalogue every month.
Standards and references
- MITRE ATT&CK: M1033 Limit Software Installation
- MITRE D3FEND: Executable Allowlisting
- CISA: Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
- Microsoft Learn: AppLocker overview
- Google: Manage extensions in your enterprise
- Microsoft: VS Code extension management for enterprises
Related NHI Mgmt Group resources: M1038 Execution Prevention, M1034 Limit Hardware Installation, Application Allowlisting Guide, App Control for Business (WDAC), Browser Extension Security Guide, RMM Tool Security Guide, M1032 Multi-factor Authentication.