漏洞情报分析系统

系统在线只读模式数据管理

D3FEND 技术详情

D3-ANAA

D3-ANAA

Administrative Network Activity Analysis

定义

Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline.

父技术

D3-NTANetwork Traffic Analysis

子技术

无

关联构件

IntranetAdministrativeNetworkTraffic

Intranet Administrative Network Traffic

Intranet administrative network traffic is administrative network traffic that does not cross a given network's boundaries and uses a standard administrative protocol.

语义关系

出向analyzesIntranet Administrative Network Traffic

出向kb referenceReference - Method and system for detecting suspicious administrative activity - Vectra Networks Inc

出向kb referenceReference - CAR-2014-11-005: Remote Registry - MITRE

出向kb referenceReference - CAR-2014-11-006: Windows Remote Management (WinRM) - MITRE

关联 ATT&CK

8

T1003.006DCSync

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Intranet Administrative Network Traffic · analyzes

T1047Windows Management Instrumentation

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Intranet Administrative Network Traffic · analyzes

T1098.001Additional Cloud Credentials

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Intranet Administrative Network Traffic · analyzes

T1110.003Password Spraying

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Intranet Administrative Network Traffic · analyzes

T1110.004Credential Stuffing

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Intranet Administrative Network Traffic · analyzes

T1207Rogue Domain Controller

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Intranet Administrative Network Traffic · analyzes

T1546.003Windows Management Instrumentation Event Subscription

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Intranet Administrative Network Traffic · analyzes

T1546.008Accessibility Features

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Intranet Administrative Network Traffic · analyzes

查看关系图在矩阵中定位