M1054 Software Configuration: Software Configuration Controls Mapped to ATT&CK

Many ATT&CK techniques succeed not because software is vulnerable but because a setting was left at a permissive default: email accepted without sender validation, cookies that live for weeks, CI pipelines that run untrusted code with secrets, or external sharing open to anyone. MITRE ATT&CK mitigation M1054 Software Configuration covers the security-focused adjustment of application, middleware, database and SaaS settings. In ATT&CK v20 it mitigates 36 techniques across 12 tactics, which makes it one of the broadest mitigations in the framework and one of the hardest to own. This guide groups those techniques into seven configuration families, gives the specific setting ATT&CK names for each, sets implementation priorities and shows how to measure coverage. It is for detection engineers, platform owners and security architects; baseline mechanics are in the CIS Benchmarks Guide.

Key takeaways

• 36 techniques, 12 tactics. M1054 spans reconnaissance, initial access, execution, persistence, privilege escalation, credential access, collection, lateral movement, exfiltration, impact and the v20 Defense Impairment and Stealth tactics.
• Group by owner, not by technique. The techniques fall into seven configuration families (email, browser and session, Office, SaaS and cloud, CI/CD and containers, network services, endpoint tooling), each with a natural platform owner.
• Email authentication is the largest single block. SPF, DKIM and DMARC appear in ATT&CK's usage text for eight techniques, from phishing to email bombing and spoofing.
• Several settings protect non-human identities directly. Keeping secrets away from pipelines that run unreviewed code, rootless container services and short session lifetimes all reduce the value of stolen machine credentials and tokens.
• Configuration drifts. M1054 is only as good as continuous checking: baseline, enforce through code, audit and alert on change.

What M1054 is in ATT&CK terms

ATT&CK defines M1054 Software Configuration as making security-focused adjustments to application, middleware, database or other software settings to reduce attack surface, enforce good practice and protect sensitive data. Its implementation guidance lists six measures: review application settings against documentation and policy, apply access controls and least privilege inside the software, enable logging to a central monitoring platform, keep software patched, disable unnecessary features such as debugging interfaces or deprecated APIs, and test configuration changes in staging with regular audits afterwards.

M1054 overlaps with three neighbouring mitigations. M1028 Operating System Configuration covers the operating system itself, M1042 Disable or Remove Feature or Program covers removing components entirely, and M1051 Update Software covers patching. M1054 is the setting-level control for applications and services that stay installed.

The MITRE D3FEND ontology relates M1054 to two defensive techniques: D3-ACH Application Configuration Hardening (modifying an application's configuration to reduce its attack surface) and D3-CP Certificate Pinning.

Techniques M1054 mitigates, by configuration family

All 36 non-revoked techniques linked to M1054 in ATT&CK v20 (enterprise-attack 20.0), grouped into families. The setting column paraphrases ATT&CK's own usage text for that technique.

ATT&CK's T1553.004 text cites HTTP Public Key Pinning, which mainstream browsers no longer support; apply the pinning idea in your own mobile and thick-client applications (D3-CP) rather than through browser headers.

Implementation priorities

NHI Mgmt Group recommends ordering the families by how often the technique starts an intrusion and how cheaply the setting can be enforced:

1. Email authentication: publish SPF and DKIM for every sending domain, including parked ones, and move DMARC to an enforcing policy. One owner, eight techniques. See the DMARC, SPF and DKIM Guide and the MITRE ATT&CK T1566 Phishing.
2. CI/CD pipelines: the setting directly protects secrets and publishing tokens. In the Ultralytics PyPI compromise, a pull_request_target workflow placed a branch name straight into a shell command, and a long-lived PyPI token that survived a move to Trusted Publishing let the attacker publish further malicious releases. GitHub's secure use reference advises avoiding pull_request_target unless necessary, passing untrusted values through intermediate environment variables, and almost never using self-hosted runners on public repositories. See the GitHub and GitHub Actions Security Guide.
3. SaaS sharing and cloud guardrails: set the SharePoint and OneDrive organisation sharing level below "Anyone" where business allows, limit external sharing by domain or security group, and apply organisation policies against subscription transfer, leaving the organisation and unused regions. Microsoft documents four organisation levels: Anyone, New and existing guests, Existing guests, and Only people in your organization, with domain allow or block lists of up to 5,000 domains (Microsoft Learn).
4. Browser and session: set server-side idle and absolute timeouts and prefer non-persistent session cookies. OWASP's Session Management Cheat Sheet gives idle timeouts of 2 to 5 minutes for high-value applications and 15 to 30 minutes for low-risk ones, and notes that deleting a cookie does not invalidate a copy already stolen, so expiry must be enforced on the server. See the Browser Security Hardening Guide.
5. Office: apply the ATT&CK settings for Office Test and embedded files alongside macro controls. See the Office Macro Blocking Guide.
6. Network services and endpoint tooling: SNMP views, zone transfer restrictions, HSTS, safe mode coverage of endpoint agents and scheduled relaunch of log forwarders. See the SNMP Security Guide.

Where identity fits

Several of M1054's techniques are about credentials and tokens rather than code. Session cookie lifetime decides how long a stolen browser session works (T1539, T1550.004). Pipeline configuration decides whether untrusted code can reach CI secrets and publishing tokens (T1677). Password manager re-lock timeouts limit how long plaintext credentials sit in memory (T1555.005). Root certificate and pinning settings decide whether intercepted machine-to-machine traffic can be read (T1553.004). For non-human identities, the most valuable M1054 settings are: no secrets in jobs triggered by untrusted input, short-lived federated credentials for build and deploy jobs, and service principals scoped so that a configuration change cannot exfiltrate data to another tenant (T1537).

Implementation approach

1. Assign owners per family: messaging, browser, Microsoft 365 or Google Workspace, cloud platform, DevOps, network and endpoint teams each own one row of the table above.
2. Baseline: write the target setting per product, using vendor guidance and CIS Benchmarks where they exist.
3. Audit before enforcing: DMARC report-only (p=none) before quarantine and reject; SharePoint sharing changes reviewed against active external links; pipeline rules run as checks before they block merges.
4. Enforce as code: configuration management, policy-as-code and SaaS posture tooling so settings are reapplied, not just set once.
5. Test and roll back: stage changes for one business unit or repository set first; keep the previous configuration exported so it can be reapplied quickly.
6. Audit continuously: compare live settings with the baseline on a schedule and alert on drift.

Decision guidance

What M1054 does not stop

• Exploitable vulnerabilities: a hardened setting does not fix a code flaw; that is M1051 and M1016 territory.
• Valid credentials: correct sharing settings still allow an attacker with a legitimate account to read what that account can read; pair with MFA and least privilege.
• Lookalike domains: DMARC protects your exact domains, not cousin domains registered by an attacker.
• Stolen sessions used quickly: short lifetimes reduce, but do not remove, the window for cookie replay.
• Administrator changes: an attacker with admin rights in the application can reverse any setting, which is why change alerts matter.

Detection and measurement

Every M1054 setting should produce a signal when it changes: DMARC policy and DNS record changes, SharePoint and Google Workspace sharing setting changes, new GitHub workflows using pull_request_target, cloud organisation policy and region enablement changes, firewall and log forwarder configuration changes, and new trusted root certificates on endpoints. Feed these to the SIEM and treat unexpected changes to security settings as incidents.

Framework mapping and related controls

Related ATT&CK mitigations: M1028 Operating System Configuration, M1042 Disable or Remove Feature or Program, M1018 User Account Management and M1047 Audit.

Common failure patterns

• DMARC parked at p=none: reports are collected but spoofed mail is still delivered.
• Pipelines that mix untrusted input and secrets: the Ultralytics case combined pull_request_target, an unsanitised branch name and a leftover long-lived publishing token.
• Organisation-wide "Anyone" sharing: set for convenience and never revisited, enabling silent T1537 transfers.
• Long-lived persistent sessions for admin portals: a stolen cookie works for days.
• Settings applied by hand: no code, no drift detection, and the next upgrade restores the default.

Practitioner checklist

• Name an owner for each of the seven configuration families.
• Move every domain to DMARC enforcement with SPF and DKIM aligned.
• Remove pull_request_target where possible and keep secrets out of jobs that run untrusted code.
• Restrict SaaS external sharing by level, domain or security group.
• Set server-side idle and absolute session timeouts per application risk tier.
• Apply ATT&CK's Office Test and embedded file settings.
• Restrict SNMP with views and DNS zone transfers to validated servers.
• Enforce settings as code and alert on drift and unexpected security setting changes.

Standards and references

• MITRE ATT&CK: M1054 Software Configuration
• MITRE ATT&CK: T1677 Poisoned Pipeline Execution
• MITRE D3FEND: Application Configuration Hardening
• GitHub Docs: Secure use reference for GitHub Actions
• Microsoft Learn: Manage sharing settings for SharePoint and OneDrive
• OWASP: Session Management Cheat Sheet

Related NHI Mgmt Group resources: CIS Benchmarks Guide · DMARC, SPF and DKIM Guide · GitHub and GitHub Actions Security Guide · Browser Security Hardening Guide · M1028 Operating System Configuration