Audits
Settings
Links
Tenable Cloud
Tenable Community & Support
Tenable University
Theme
Light
Dark
Auto
Help
Plugins
Overview
Plugins Pipeline
Newest
Updated
Search
Nessus Families
WAS Families
NNM Families
LCE Families
Tenable OT Security Families
About Plugin Families
Release Notes
Audits
Overview
Newest
Updated
Search Audit Files
Search Items
References
Authorities
Documentation
Download All Audit Files
Indicators
Overview
Search
Indicators of Attack
Indicators of Exposure
CVEs
Overview
Newest
Updated
Search
Attack Path Techniques
Overview
Search
Links
Tenable Cloud
Tenable Community & Support
Tenable University
Settings
Theme
Light
Dark
Auto
Detections
Plugins
Overview
Plugins Pipeline
Release Notes
Newest
Updated
Search
Nessus Families
WAS Families
NNM Families
LCE Families
Tenable OT Security Families
About Plugin Families
Audits
Overview
Newest
Updated
Search Audit Files
Search Items
References
Authorities
Documentation
Download All Audit Files
Indicators
Overview
Search
Indicators of Attack
Indicators of Exposure
Analytics
CVEs
Overview
Newest
Updated
Search
Attack Path Techniques
Overview
Search
Audits
References
CCI
CCI-002233
CCI
CCI|CCI-002233
Title
Prevent the organization-defined software from executing at higher privilege levels than users executing the software.
Reference Item Details
Reference:
CCI - DISA Control Correlation Identifier
Category:
2024
Audit Items
View all Reference Audit Items
Name
Plugin
Audit Name
AIOS-15-009700 - Apple iOS/iPadOS 15 must not allow non-DoD applications to access DoD data.
MDM
MobileIron - DISA Apple iOS/iPadOS 14 v1r4
AIOS-15-009700 - Apple iOS/iPadOS 15 must not allow non-DoD applications to access DoD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 14 v1r4
AIOS-16-009700 - Apple iOS/iPadOS 16 must not allow non-DoD applications to access DoD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 16 v2r1
AIOS-16-009700 - Apple iOS/iPadOS 16 must not allow non-DoD applications to access DoD data.
MDM
MobileIron - DISA Apple iOS/iPadOS 16 v2r1
AIOS-16-709700 - Apple iOS/iPadOS 16 must not allow non-DOD applications to access DOD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 16 BYOAD v1r1
AIOS-16-709700 - Apple iOS/iPadOS 16 must not allow non-DOD applications to access DOD data.
MDM
MobileIron - DISA Apple iOS/iPadOS BYOAD 16 v1r1
AIOS-16-714900 - Apple iOS/iPadOS 16 must not allow DOD applications to access non-DOD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 16 BYOAD v1r1
AIOS-16-714900 - Apple iOS/iPadOS 16 must not allow DOD applications to access non-DOD data.
MDM
MobileIron - DISA Apple iOS/iPadOS BYOAD 16 v1r1
AIOS-17-009700 - Apple iOS/iPadOS 17 must not allow non-DOD applications to access DOD data.
MDM
MobileIron - DISA Apple iOS/iPadOS 17 v2r1
AIOS-17-009700 - Apple iOS/iPadOS 17 must not allow non-DOD applications to access DOD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 17 v2r1
AIOS-17-709700 - Apple iOS/iPadOS 17 must not allow non-DOD applications to access DOD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 17 BYOAD v1r1
AIOS-17-709700 - Apple iOS/iPadOS 17 must not allow non-DOD applications to access DOD data.
MDM
MobileIron - DISA Apple iOS/iPadOS BYOAD 17 v1r1
AIOS-17-714900 - Apple iOS/iPadOS 17 must not allow DOD applications to access non-DOD data.
MDM
MobileIron - DISA Apple iOS/iPadOS BYOAD 17 v1r1
AIOS-17-714900 - Apple iOS/iPadOS 17 must not allow DOD applications to access non-DOD data.
MDM
AirWatch - DISA Apple iOS/iPadOS 17 BYOAD v1r1
AIX7-00-001138 - NFS file systems on AIX must be mounted with the nosuid option unless the NFS file systems contain approved setuid or setgid programs.
Unix
DISA STIG AIX 7.x v2r9
Big Sur - Prevent Software From Executing at Higher Privilege Levels than Users Executing The Software
Unix
NIST macOS Big Sur v1.4.0 - All Profiles
Catalina - Prevent Software From Executing at Higher Privilege Levels than Users Executing The Software
Unix
NIST macOS Catalina v1.5.0 - All Profiles
CD12-00-003600 - Execution of software modules (to include functions and trigger procedures) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
DISA STIG Crunchy Data PostgreSQL DB v3r1
DKER-EE-001170 - A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r2
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - repositoryAccess
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix DTR v2r2
DKER-EE-001180 - A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set - team member access
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix UCP v2r2
DKER-EE-003200 - Docker Enterprise images must be built with the USER instruction to prevent containers from running as root.
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
EP11-00-007500 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
EDB PostgreSQL Advanced Server v11 DB Audit v2r4
EP11-00-007510 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
EDB PostgreSQL Advanced Server v11 DB Audit v2r4
EPAS-00-007500 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
EnterpriseDB PostgreSQL Advanced Server DB v2r1
EPAS-00-007510 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
EnterpriseDB PostgreSQL Advanced Server DB v2r1
GEN000520 - The root user must not own the logon session for an application requiring a continuous display.
Unix
DISA STIG Solaris 10 X86 v2r4
GEN000520 - The root user must not own the logon session for an application requiring a continuous display.
Unix
DISA STIG Solaris 10 SPARC v2r4
GEN000920 - The root account's home directory (other than /) must have mode 0700.
Unix
DISA STIG Solaris 10 X86 v2r4
GEN000920 - The root account's home directory (other than /) must have mode 0700.
Unix
DISA STIG Solaris 10 SPARC v2r4
MADB-10-006900 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
MySQLDB
DISA MariaDB Enterprise 10.x v2r1 DB
Monterey - Prevent Software From Executing at Higher Privilege Levels than Users Executing The Software
Unix
NIST macOS Monterey v1.0.0 - All Profiles
MSFT-11-004500 - Microsoft Android 11 must be configured to disable exceptions to the access control policy that prevent application processes from accessing all data stored by other application processes - Copy/Paste
MDM
MobileIron - DISA Microsoft Android 11 COPE v1r2
MSFT-11-004500 - Microsoft Android 11 must be configured to disable exceptions to the access control policy that prevent application processes from accessing all data stored by other application processes - Sharing data into the profile
MDM
MobileIron - DISA Microsoft Android 11 COPE v1r2
MSFT-11-004500 - Microsoft Android 11 must be configured to disable exceptions to the access control policy that prevent application processes from accessing all data stored by other application processes.
MDM
AirWatch - DISA Microsoft Android 11 COPE v1r2
MYS8-00-010600 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
MySQLDB
DISA Oracle MySQL 8.0 v2r1 DB
OL08-00-030000 - The OL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
Unix
DISA Oracle Linux 8 STIG v2r1
PGS9-00-003600 - Execution of software modules (to include functions and trigger procedures) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
DISA STIG PostgreSQL 9.x on RHEL DB v2r5
PHTN-40-000019 The Photon operating system must be configured to audit the execution of privileged functions.
Unix
DISA VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 STIG v2r1
PPS9-00-007500 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
EDB PostgreSQL Advanced Server DB Audit v2r3
PPS9-00-007510 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
PostgreSQLDB
EDB PostgreSQL Advanced Server DB Audit v2r3
RHEL-08-030000 - The RHEL 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software.
Unix
DISA Red Hat Enterprise Linux 8 STIG v2r1
RHEL-09-654010 - RHEL 9 must audit uses of the 'execve' system call - execve system call.
Unix
DISA Red Hat Enterprise Linux 9 STIG v2r2
SLES-12-010600 - The SUSE operating system Apparmor tool must be configured to control whitelisted applications and user home directory access control.
Unix
DISA SLES 12 STIG v2r13
SLES-15-010390 - SUSE operating system AppArmor tool must be configured to control whitelisted applications and user home directory access control.
Unix
DISA SLES 15 STIG v2r1
SQL4-00-032600 - Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.
MS_SQLDB
DISA STIG SQL Server 2014 Instance DB Audit v2r4
SQL6-D0-002900 - Execution of stored procedures and functions that utilize execute as must be restricted to necessary cases only.
MS_SQLDB
DISA STIG SQL Server 2016 Database Audit v3r1
SQL6-D0-010500 - Use of credentials and proxies must be restricted to necessary cases only.
MS_SQLDB
DISA STIG SQL Server 2016 Instance DB Audit v3r1
SQL6-D0-016400 - Execution of startup stored procedures must be restricted to necessary cases only.
MS_SQLDB
DISA STIG SQL Server 2016 Instance DB Audit v3r1
UBTU-16-020350 - The audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software - egid b32
Unix
DISA STIG Ubuntu 16.04 LTS v2r3
