Every protocol, interpreter, remote service and convenience feature left switched on is a technique an attacker does not have to bring with them. MITRE ATT&CK mitigation M1042, Disable or Remove Feature or Program, is the control of removing unneeded software, features and services so they cannot be abused. In ATT&CK v20 it is mapped to 72 techniques and sub-techniques, more than most mitigations, because so much of the attacker playbook runs on built-in functionality: LLMNR, Office macros, system binaries, RDP, WinRM, SSH agent forwarding, app passwords, legacy metadata services. This guide reads M1042 from the ATT&CK data, prioritises the features worth removing first, shows how to retire them safely, and how to prove they stay off. It is for endpoint, identity and platform engineers and the detection teams who track ATT&CK coverage.
Key takeaways
- M1042 is the broadest preventive mitigation in day-to-day use. ATT&CK v20 maps it to 72 relationships, led by Stealth (19, mostly System Binary Proxy Execution), Lateral Movement (12) and Persistence (11).
- Removal beats detection when the feature has no business use. A disabled LLMNR responder or a removed MSBuild cannot be abused, tuned around or evaded.
- Several of the highest-value removals are identity features. App passwords, legacy authentication, user consent to OAuth apps, SSH agent forwarding and IMDSv1 all hand attackers credentials or tokens.
- Audit usage before you switch off. SMBv1 auditing, IMDS usage metrics and macro telemetry tell you who will break, so removal is a planned change rather than an outage.
- Drift is the real enemy. Features come back with new images, application installs and default changes, so M1042 needs continuous configuration checks, not a one-off project.
What ATT&CK means by Disable or Remove Feature or Program
The ATT&CK v20 description of M1042 is to disable or remove unnecessary and potentially vulnerable software, features or services to reduce the attack surface. It names five areas: removing legacy software that no longer receives patches, disabling unused operating system features (its examples are SMBv1, Telnet and RDP where not required), controlling which applications users can install, removing unnecessary default services such as unused administrative shares, and restricting browser add-ons and plugins.
It differs from its neighbours in a useful way. M1038 Execution Prevention blocks code by policy while leaving it installed; M1040 Behavior Prevention on Endpoint judges what running code does (see M1040 Behavior Prevention on Endpoint). M1042 takes the capability away. Where a feature can be removed without business impact, it is the most robust of the three.
Priority techniques M1042 mitigates
The table shows a prioritised selection of the 72 relationships, chosen for frequency in real intrusions and ease of removal, with the gist of ATT&CK's own usage text. The full list also covers screensavers, emond, Wake-on-LAN, removable media, Bluetooth and Wi-Fi exfiltration, container tooling and more.
| Tactic | Technique (ATT&CK v20) | What to disable or remove, per ATT&CK |
|---|---|---|
| Credential Access, Collection | T1557, T1557.001 Name Resolution Poisoning and SMB Relay | Disable LLMNR, mDNS and NetBIOS by local policy or Group Policy where not needed; disable legacy network protocols. |
| Credential Access | T1552.005 Cloud Instance Metadata API | Disable unneeded metadata services; restrict or disable insecure versions. |
| Credential Access | T1697 Steal Application Specific Passwords | Disable app password functionality where modern authentication is available, and legacy authentication. |
| Credential Access | T1649 Steal or Forge Authentication Certificates | Disable old protocols such as NTLM and unneeded AD CS web enrolment roles. |
| Credential Access | T1555.004 Windows Credential Manager | Enable "Network access: Do not allow storage of passwords and credentials for network authentication". |
| Persistence, Privilege Escalation | T1098.001 Additional Cloud Credentials | Remove abusable authentication mechanisms, for example the Entra ID app password feature. |
| Persistence, Privilege Escalation | T1098.002 Additional Email Delegate Permissions | Disable email delegation where not required. |
| Persistence, Privilege Escalation | T1098.004 SSH Authorized Keys | Disable SSH where not needed or restrict it in sshd_config; set PermitRootLogin no. |
| Persistence | T1671 Cloud Application Integration | Stop users adding SaaS integrations; in Entra ID, consider not allowing user consent. |
| Persistence | T1137, T1137.001 Office Template Macros | Disable Office VBA macros and unneeded add-ins. |
| Persistence | T1505, T1505.003 Web Shell | Disable abusable server components and dangerous web functions. |
| Collection | T1114.003 Email Forwarding Rule | Consider disabling external email forwarding. |
| Execution | T1059, T1059.001 PowerShell, .005 Visual Basic, .007 JavaScript | Remove unneeded shells and interpreters; PowerShell removal needs an impact review. |
| Execution | T1559, T1559.002 Dynamic Data Exchange | Office feature control registry keys disable automatic DDE/OLE execution. |
| Execution, Privilege Escalation | T1609, T1611 | Remove unnecessary tools and software from containers. |
| Lateral Movement | T1021: .001 RDP, .003 DCOM, .004 SSH, .005 VNC, .006 WinRM, .008 Direct Cloud VM Connections | Disable each remote service where not required; ATT&CK suggests ESXi lockdown mode and disabling the SSH daemon on ESXi. |
| Lateral Movement | T1563, T1563.001 SSH Hijacking | Disable SSH agent forwarding where not explicitly required. |
| Persistence, Initial Access | T1133 External Remote Services | Disable or block remotely available services that are not needed. |
| Stealth | T1218: .003 CMSTP, .004 InstallUtil, .005 Mshta, .008 Odbcconf, .009 Regsvcs/Regasm, .012 Verclsid, .013 Mavinject, .014 MMC | Many native binaries are unnecessary in a given environment; remove or deny them. |
| Stealth | T1218.007 Msiexec | Disable the AlwaysInstallElevated policy. |
| Stealth, Execution | T1127.001 MSBuild, T1127.002 ClickOnce | Remove MSBuild where unused; disable ClickOnce installs from the internet. |
| Stealth | T1221 Template Injection, T1564.007 VBA Stomping | Disable Office macros and active content; restrict unneeded VB components. |
| Defense Impairment | T1553.005 Mark-of-the-Web Bypass | Disable auto-mounting of disk image files (.iso, .img, .vhd, .vhdx). |
| Defense Impairment | T1685, T1689 Downgrade Attack | Remove previous, unneeded versions of tools. |
| Command and Control | T1219, T1219.002 Remote Desktop Software | Disable unapproved remote access software and built-in remote features. |
| Exfiltration | T1011, T1052 Exfiltration Over Physical Medium | Disable unneeded radios (Wi-Fi, Bluetooth, cellular) and Autorun; restrict removable media. |
| Discovery | T1046 Network Service Discovery | Close unnecessary ports and services. |
| Reconnaissance | T1595.003 Wordlist Scanning | Remove external access to anything not required externally. |
Removal playbook: the features to retire first
The settings below come from vendor documentation checked in November 2026. Each row lists how to measure usage before switching off, which is what turns removal into a safe change.
| Feature | How to retire it | Measure usage first |
|---|---|---|
| SMBv1 | Set-SmbServerConfiguration -EnableSMB1Protocol $false or remove the SMB1Protocol optional feature. Microsoft states SMBv1 is not installed by default in Windows 11 or Windows Server 2019 and later. | Set-SmbServerConfiguration -AuditSmb1Access $true; event ID 3000 in Microsoft-Windows-SMBServer/Audit per client attempt |
| Office macros from the internet | Policy "Block macros from running in Office files from the Internet" (per app, Trust Center); otherwise "VBA Macro Notification Settings" set to disable all except digitally signed macros | Macro-enabled file inventory; review Trusted Locations, which Microsoft notes bypass the Mark of the Web check |
| LLMNR, NetBIOS, mDNS | Group Policy "Turn off multicast name resolution"; NetBIOS over TCP/IP disabled on adapters | Network capture of UDP 5355 and 137 traffic. See LLMNR and NBT-NS Poisoning |
| WDigest credential caching | UseLogonCredential under HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest; Microsoft states it defaults to 0 (caching disabled) on Windows 8.1 and Server 2012 R2 and later when the entry is absent. Ensure nothing sets it to 1. | Configuration scan for value 1 |
| IMDSv1 on EC2 | aws ec2 modify-instance-metadata-options --http-tokens required --http-endpoint enabled, or --http-endpoint disabled where no metadata is needed; account-level defaults through ModifyInstanceMetadataDefaults | CloudWatch MetadataNoToken metric at zero. See the EC2 Instance Metadata Service Hardening Guide |
| User consent to OAuth apps | Entra admin center: Enterprise apps > Consent and permissions > User consent settings; restrict to verified publishers and selected permissions, or remove user consent | Recent consent grants and the apps that rely on them |
| App passwords and legacy authentication | Disable the ability to create app passwords; block legacy authentication protocols | Sign-in logs filtered to legacy clients. See the Legacy Authentication and ROPC Retirement Guide |
| Disk image auto-mount | Change Explorer file associations for .iso, .img, .vhd, .vhdx | Count of users opening images from mail and web |
The Capital One breach shows what the metadata row is about: a misconfigured firewall was made to request its own metadata endpoint and return its role's credentials, which then read customer data in S3. The NHI Mgmt Group breach page notes that IMDSv2's session token requirement blocks many forged requests of that kind.
Where identity fits
A large share of M1042 is identity hygiene. App passwords (T1697, T1098.001) are long-lived secrets that bypass MFA. User consent (T1671) lets any user create a persistent OAuth integration, a non-human identity with delegated access to mail and files. SSH agent forwarding (T1563.001) exposes the keys of whoever forwarded. Legacy metadata endpoints (T1552.005) hand out workload credentials to anything that can make the instance send a request. Removing these features shrinks the population of unmanaged credentials more cheaply than rotating them. See the App Passwords Security Guide.
How to implement M1042, step by step
- Build the feature inventory: per platform image, list protocols, services, interpreters, remote access features and identity features (app passwords, consent, delegation) that are on.
- Classify each one: required, required for a named group, or not required. Anything without an owner is "not required" until someone claims it.
- Audit usage: turn on the usage signals in the playbook table (SMB1 audit, MetadataNoToken, legacy sign-ins, macro telemetry) and collect long enough to cover monthly and quarterly business cycles.
- Remove in rings: IT and security staff first, then a pilot, then broad. Use Group Policy, Intune or configuration management so the change is versioned.
- Handle exceptions narrowly: keep a feature only for the named systems or users that need it, with an expiry date. The Hardening Exceptions and Compensating Controls Template gives a format.
- Roll back by scope: re-enable for the affected group or system only, never globally, and fix the dependency before re-applying.
- Bake it into images: remove features in the golden image so new builds start clean. See the Server Build and Golden Image Hardening Guide.
Choosing what to remove first
- Small organisations: start with defaults that have almost no business use: SMBv1, LLMNR and NetBIOS, internet macros, app passwords, user consent to unverified apps, disk image auto-mount.
- Large estates: prioritise by blast radius: features on domain controllers, jump hosts, hypervisors and cloud workloads before user desktops.
- Remove or block: if the binary must stay for servicing (for example MMC on admin workstations), block it for standard users with application control rather than removing it everywhere.
- PowerShell: ATT&CK itself warns that removing PowerShell needs an impact review because administration depends on it; constraining and logging it is usually the better answer.
What M1042 does not stop
- Features you genuinely need: RDP to jump hosts, SSH to Linux servers and PowerShell for administration stay on, and must be protected by authentication, network restriction and monitoring.
- Attacker-supplied tools: removing MSBuild does not stop an attacker bringing a binary; that is application control and behaviour prevention.
- Valid credentials on remaining services: see T1078 Valid Accounts.
- Re-enablement by an attacker with admin rights: an attacker who holds local admin can turn features back on, which is why configuration drift alerts matter.
In the D3FEND ontology, M1042 is related to D3-ACH Application Configuration Hardening, D3-EDL Executable Denylisting and D3-SCF System Call Filtering, which are the technical forms removal takes on endpoints and containers.
Common failure patterns
- Disabled in policy, alive in practice: LLMNR off by Group Policy for domain machines but on for unmanaged and non-Windows devices on the same segment.
- Trusted Locations undoing macro blocks: network shares added as Trusted Locations, which skip the Mark of the Web check.
- Legacy auth blocked, app passwords left: one path closed, the other still issuing MFA-bypassing secrets.
- IMDSv2 required on old instances only: new launch templates and account defaults left allowing IMDSv1.
- Feature returns with software installs: a vendor installer re-enables a service or drops a VNC server.
- No owner for exceptions: exceptions granted during a migration that never expire.
Detection and measurement
| Metric | Source | Target |
|---|---|---|
| Feature compliance per image | Configuration management or CIS-style benchmark scan | Above 98% for "not required" features |
| SMBv1 client attempts | Event ID 3000, SMBServer Audit log | Zero |
| IMDSv1 calls | CloudWatch MetadataNoToken | Zero; instances set to HttpTokens required |
| Legacy auth and app password sign-ins | Identity provider sign-in logs | Zero outside named exceptions |
| Name resolution poisoning exposure | LLMNR and NBT-NS traffic seen by sensors | Falling to zero |
| Open exceptions past expiry | Exception register | Zero |
Framework mapping
| Framework | Reference | Relevance to M1042 |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-7 Least Functionality; CM-7(2) Prevent Program Execution; CM-6 Configuration Settings | Remove and restrict unneeded functions |
| NIST CSF 2.0 | PR.PS-01; PR.PS-02 | Configuration management; software removed commensurate with risk |
| CIS Controls v8.1 | 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software; 2.3 Address Unauthorized Software | Service and software reduction |
| ISO/IEC 27001:2022 | Annex A 8.9 Configuration management | Secure baseline configuration |
| MITRE D3FEND | D3-ACH; D3-EDL; D3-SCF | Related techniques in the D3FEND ontology |
Related ATT&CK mitigations: M1038 Execution Prevention, M1040 Behavior Prevention on Endpoint, M1041 Encrypt Sensitive Information (see M1041 Encrypt Sensitive Information) and M1028 Operating System Configuration.
Practitioner checklist
- Inventory features per image and give every enabled feature an owner or a removal date.
- Disable SMBv1, LLMNR, NetBIOS over TCP/IP and WDigest caching across Windows.
- Block internet macros in Office and review Trusted Locations.
- Require IMDSv2 (or disable IMDS) on every instance and in account defaults.
- Disable app passwords and legacy authentication; restrict user consent to OAuth apps.
- Disable SSH agent forwarding and root login where not required.
- Remove or block unneeded LOLBins (MSBuild, InstallUtil, Mshta, CMSTP) and disable AlwaysInstallElevated.
- Strip shells and tooling from container images.
- Alert on configuration drift that re-enables any removed feature.
Standards and references
- MITRE ATT&CK: M1042 Disable or Remove Feature or Program
- Microsoft Learn: Detect, enable and disable SMBv1, SMBv2 and SMBv3
- Microsoft Learn: Macros from the internet are blocked by default in Office
- Microsoft Support: Update to improve credentials protection and management
- AWS: Modify instance metadata options for existing instances
- Microsoft Learn: Configure how users consent to applications
- MITRE D3FEND knowledge graph
Related NHI Mgmt Group resources: LLMNR and NBT-NS Poisoning · Living off the Land Guide · Legacy Authentication and ROPC Retirement Guide · Macro Malware Guide · Endpoint Hardening Checklist