漏洞情报分析系统

系统在线只读模式数据管理

D3FEND 技术详情

D3-APCA

D3-APCA

Application Protocol Command Analysis

定义

Analyzing application protocol level remote commands to detect unauthorized activity.

父技术

D3-NTANetwork Traffic Analysis

子技术

D3-RFUMRemote Firmware Update Monitoring

关联构件

NetworkTraffic

Network Traffic

Network traffic or data traffic is the data, or alternatively the amount of data, moving across a network at a given point of time. Network data in computer networks is mostly encapsulated in network packets, which provide the load in the network.

语义关系

出向kb referenceReference - Method and apparatus for detecting anomalies of an infrastructure in a network

出向kb referenceReference - Protocol based detection of suspicious network traffic

出向monitorsNetwork Traffic

关联 ATT&CK

90

T0814Denial of Service

Detect · Network Traffic Analysis

OT Network Traffic produces Network Traffic · monitors

T0817Drive-by Compromise

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T0819Exploit Public-Facing Application

Detect · Network Traffic Analysis

Inbound Internet Network Traffic produces Network Traffic · monitors

T0822External Remote Services

Detect · Network Traffic Analysis

Inbound Internet Network Traffic produces Network Traffic · monitors

T0830Adversary-in-the-Middle

Detect · Network Traffic Analysis

Network Traffic may-modify Network Traffic · monitors

T0840Network Connection Enumeration

Detect · Network Traffic Analysis

Network Traffic monitors Network Traffic · monitors

T0842Network Sniffing

Detect · Network Traffic Analysis

Network Traffic monitors Network Traffic · monitors

T0846Remote System Discovery

Detect · Network Traffic Analysis

Network Traffic monitors Network Traffic · monitors

T0848Rogue Master

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

Detect · Network Traffic Analysis

Network Traffic monitors Network Traffic · monitors

T0865Spearphishing Attachment

Detect · Network Traffic Analysis

Inbound Internet Mail Traffic produces Network Traffic · monitors

T0866Exploitation of Remote Services

Detect · Network Traffic Analysis

Intranet Network Traffic produces Network Traffic · monitors

T0869Standard Application Layer Protocol

Detect · Network Traffic Analysis

Outbound Network Traffic produces Network Traffic · monitors

T0884Connection Proxy

Detect · Network Traffic Analysis

Outbound Internet Network Traffic may-produce Network Traffic · monitors

Detect · Network Traffic Analysis

Intranet Network Traffic may-produce Network Traffic · monitors

T0885Commonly Used Port

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

T0886Remote Services

Detect · Network Traffic Analysis

Intranet Network Traffic produces Network Traffic · monitors

T0888Remote System Information Discovery

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

T0894System Binary Proxy Execution

Detect · Network Traffic Analysis

Network Traffic may-produce Network Traffic · monitors

T0895Autorun Image

Detect · Network Traffic Analysis

Network Traffic may-produce Network Traffic · monitors

T1001Data Obfuscation

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1003.006DCSync

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Network Traffic · monitors

T1008Fallback Channels

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1011Exfiltration Over Other Network Medium

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1018Remote System Discovery

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

T1020Automated Exfiltration

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1021Remote Services

Detect · Network Traffic Analysis

Intranet Network Traffic produces Network Traffic · monitors

T1021.001Remote Desktop Protocol

Detect · Network Traffic Analysis

Administrative Network Traffic produces Network Traffic · monitors

Detect · Network Traffic Analysis

Administrative Network Traffic produces Network Traffic · monitors

T1029Scheduled Transfer

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1030Data Transfer Size Limits

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1041Exfiltration Over C2 Channel

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1047Windows Management Instrumentation

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Network Traffic · monitors

T1048Exfiltration Over Alternative Protocol

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic produces Network Traffic · monitors

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic produces Network Traffic · monitors

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1071Application Layer Protocol

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1071.001Web Protocols

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Network Traffic · monitors

T1071.002File Transfer Protocols

Detect · Network Traffic Analysis

Outbound Internet File Transfer Traffic produces Network Traffic · monitors

T1071.003Mail Protocols

Detect · Network Traffic Analysis

Outbound Internet Mail Traffic produces Network Traffic · monitors

Detect · Network Traffic Analysis

Outbound Internet DNS Lookup Traffic produces Network Traffic · monitors

T1090.001Internal Proxy

Detect · Network Traffic Analysis

Intranet Network Traffic produces Network Traffic · monitors

T1090.002External Proxy

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1090.003Multi-hop Proxy

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1090.004Domain Fronting

Detect · Network Traffic Analysis

Outbound Internet Encrypted Web Traffic produces Network Traffic · monitors

T1095Non-Application Layer Protocol

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1098.001Additional Cloud Credentials

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Network Traffic · monitors

T1102Web Service

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Network Traffic · monitors

T1104Multi-Stage Channels

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1105Ingress Tool Transfer

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1110.003Password Spraying

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Network Traffic · monitors

T1110.004Credential Stuffing

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Network Traffic · monitors

T1132Data Encoding

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1185Browser Session Hijacking

Detect · Network Traffic Analysis

Web Network Traffic produces Network Traffic · monitors

T1189Drive-by Compromise

Detect · Network Traffic Analysis

Internet Network Traffic produces Network Traffic · monitors

T1190Exploit Public-Facing Application

Detect · Network Traffic Analysis

Inbound Internet Network Traffic produces Network Traffic · monitors

T1197BITS Jobs

Detect · Network Traffic Analysis

Outbound Internet Web Traffic may-produce Network Traffic · monitors

Detect · Network Traffic Analysis

Intranet IPC Network Traffic may-produce Network Traffic · monitors

Detect · Network Traffic Analysis

Intranet Web Network Traffic may-produce Network Traffic · monitors

T1199Trusted Relationship

Detect · Network Traffic Analysis

Intranet Network Traffic produces Network Traffic · monitors

T1204.001Malicious Link

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Network Traffic · monitors

T1205Traffic Signaling

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

T1205.001Port Knocking

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

T1207Rogue Domain Controller

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Network Traffic · monitors

T1210Exploitation of Remote Services

Detect · Network Traffic Analysis

Intranet Network Traffic produces Network Traffic · monitors

Detect · Network Traffic Analysis

Network Traffic may-produce Network Traffic · monitors

T1219Remote Access Tools

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1498.001Direct Network Flood

Detect · Network Traffic Analysis

Inbound Internet Network Traffic creates Network Traffic · monitors

T1498.002Reflection Amplification

Detect · Network Traffic Analysis

Inbound Internet Network Traffic produces Network Traffic · monitors

T1499.002Service Exhaustion Flood

Detect · Network Traffic Analysis

Inbound Internet Network Traffic produces Network Traffic · monitors

T1542.005TFTP Boot

Detect · Network Traffic Analysis

TFTP Network Traffic creates Network Traffic · monitors

T1546.003Windows Management Instrumentation Event Subscription

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic produces Network Traffic · monitors

T1546.008Accessibility Features

Detect · Network Traffic Analysis

Intranet Administrative Network Traffic may-create Network Traffic · monitors

T1550.001Application Access Token

Detect · Network Traffic Analysis

Network Traffic may-produce Network Traffic · monitors

T1550.004Web Session Cookie

Detect · Network Traffic Analysis

Web Network Traffic produces Network Traffic · monitors

T1557Adversary-in-the-Middle

Detect · Network Traffic Analysis

Network Traffic produces Network Traffic · monitors

T1557.001Name Resolution Poisoning and SMB Relay

Detect · Network Traffic Analysis

Intranet Multicast Network Traffic produces Network Traffic · monitors

T1557.003DHCP Spoofing

Detect · Network Traffic Analysis

DHCP Network Traffic creates Network Traffic · monitors

T1558.003Kerberoasting

Detect · Network Traffic Analysis

RPC Network Traffic may-produce Network Traffic · monitors

T1563Remote Service Session Hijacking

Detect · Network Traffic Analysis

Administrative Network Traffic produces Network Traffic · monitors

T1565.002Transmitted Data Manipulation

Detect · Network Traffic Analysis

Network Traffic may-modify Network Traffic · monitors

T1566.001Spearphishing Attachment

Detect · Network Traffic Analysis

Inbound Internet Mail Traffic produces Network Traffic · monitors

T1566.002Spearphishing Link

Detect · Network Traffic Analysis

Inbound Internet Mail Traffic produces Network Traffic · monitors

T1567Exfiltration Over Web Service

Detect · Network Traffic Analysis

Outbound Internet Web Traffic produces Network Traffic · monitors

T1567.001Exfiltration to Code Repository

Detect · Network Traffic Analysis

Outbound Internet Encrypted Remote Terminal Traffic may-produce Network Traffic · monitors

Detect · Network Traffic Analysis

Outbound Internet Encrypted Web Traffic may-produce Network Traffic · monitors

T1567.002Exfiltration to Cloud Storage

Detect · Network Traffic Analysis

Outbound Internet Encrypted Web Traffic produces Network Traffic · monitors

T1568Dynamic Resolution

Detect · Network Traffic Analysis

Outbound Internet DNS Lookup Traffic produces Network Traffic · monitors

T1570Lateral Tool Transfer

Detect · Network Traffic Analysis

Intranet File Transfer Traffic produces Network Traffic · monitors

T1571Non-Standard Port

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1572Protocol Tunneling

Detect · Network Traffic Analysis

Outbound Internet Network Traffic produces Network Traffic · monitors

T1573Encrypted Channel

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic produces Network Traffic · monitors

T1573.001Symmetric Cryptography

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic creates Network Traffic · monitors

T1573.002Asymmetric Cryptography

Detect · Network Traffic Analysis

Outbound Internet Encrypted Traffic creates Network Traffic · monitors

查看关系图在矩阵中定位