Trellix Cyber Resilience in Motion

WHY THE MATURITY LEVEL CHANGESTradecraft & targeting

Move through the level to see the adversary capability and attack path the controls are intended to resist.

ATTACKER PROFILEOpportunistic actors using widely available tools

LIKELY ATTACK PATHPublic exploits, stolen or guessed credentials, and common social engineering.

RESILIENCE GOALClose high-volume entry paths before commodity ransomware or malware gains control.

THREAT RESISTANCECommon, opportunistic tradecraft

Reduce the most common paths used to compromise everyday users and internet-facing services.

ML1ESTABLISH

All eight mitigations
at the target level

LEVEL 1 · ESTABLISH LEVEL 2 · EXTEND LEVEL 3 · HARDENTarget posture: Baseline resistance

01 / 08

SELECTED MITIGATION · TARGET ML1

Application control

Unauthorised code is prevented from running across the assessed scope, with policy decisions and blocked events available for review.

IMPLEMENT TO REACH ML1

Control execution on workstations

Allow only approved executables, libraries, scripts and installers.
Enforce the rules in user profiles and temporary folders.

EVIDENCE TO PREPARE

Prove it is implemented and effective

Enforced ruleset and scoped workstation/server inventory
Controlled execution test showing an unapproved file is blocked
Central event logs, exception register and ruleset review record

ATTACK PATH INTERRUPTED

Interrupts malware, scripts, installers and unapproved tools before they can establish execution or persistence.

This mitigation reduces attacker opportunity; the product mappings below show where the selected level can contribute.

NEXT UPLIFT · SHIFT TO ML2

Broaden enforcement, validation and event visibility.

Minimise exceptions. Document approvals and demonstrate equivalent protection for any compensating control.

WORKBOOK PRODUCT MAPPING · ML1How Trellix contributes at this target level

The supplied mapping places Trellix Application Control at the enforcement point for workstation execution.

01Trellix Application Control

Enforces allowlisting to stop unapproved executables, libraries, scripts and installers from running.

ROLEPrevent unauthorised execution

WHAT YOU CAN SHOWAllow/block events, ruleset status, enforcement coverage and approved exceptions.

Source: Trellix E8 Maturity Model Technical Spreadsheet — Customer Version (Nov-23). Product names have been normalised where the supplied mapping uses historical platform names.

KEYBOARD← → maturity levels