D3FEND 技术详情

D3-CI

Configuration Inventory

定义

Configuration inventory identifies and records the configuration of software and hardware and their components throughout the organization.

父技术

D3-AIAsset Inventory

子技术

无

关联构件

ConfigurationResource

Configuration Resource

A resource used to configure a system including software and hardware.

语义关系

出向inventoriesConfiguration Resource

出向kb referenceReference - Web-Based Enterprise Management

出向kb referenceReference - Windows Management Infrastructure (MI)

出向kb referenceReference - Windows Management Instrumentation (WMI)

关联 ATT&CK

DE-0006Modify Whitelist

Model · Asset Inventory

Access Control Configuration modifies Configuration Resource · inventories

EX-0012.02Internal Routing Tables

Model · Asset Inventory

Application Configuration may-modify Configuration Resource · inventories

EX-0012.04App/Subscriber Tables

Model · Asset Inventory

Application Configuration may-modify Configuration Resource · inventories

EX-0012.05Scheduling Algorithm

Model · Asset Inventory

Operating System Configuration may-modify Configuration Resource · inventories

Model · Asset Inventory

Application Configuration may-modify Configuration Resource · inventories

EX-0012.10Command & Data Handling Subsystem

Model · Asset Inventory

Application Configuration may-modify Configuration Resource · inventories

EXF-0006.01Software Defined Radio

Model · Asset Inventory

Software-defined Radio Configuration may-modify Configuration Resource · inventories

IA-0002Compromise Software Defined Radio

Model · Asset Inventory

Software-defined Radio Configuration may-modify Configuration Resource · inventories

T0858Change Operating Mode

Model · Asset Inventory

OT Mode Switch may-invoke Configuration Resource · inventories

T0868Detect Operating Mode

Model · Asset Inventory

OT Mode Switch may-evaluate Configuration Resource · inventories

T1037.004RC Scripts

Model · Asset Inventory

System Init Script modifies Configuration Resource · inventories

T1037.005Startup Items

Model · Asset Inventory

System Startup Directory modifies Configuration Resource · inventories

T1114.003Email Forwarding Rule

Model · Asset Inventory

Application Configuration modifies Configuration Resource · inventories

T1134.005SID-History Injection

Model · Asset Inventory

Access Control Configuration modifies Configuration Resource · inventories

T1137.001Office Template Macros

Model · Asset Inventory

System Configuration Database Record may-modify Configuration Resource · inventories

T1137.002Office Test

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1137.004Outlook Home Page

Model · Asset Inventory

Application Configuration Database modifies Configuration Resource · inventories

T1137.005Outlook Rules

Model · Asset Inventory

Application Configuration Database modifies Configuration Resource · inventories

T1218.002Control Panel

Model · Asset Inventory

System Configuration Database Record may-modify Configuration Resource · inventories

T1222File and Directory Permissions Modification

Model · Asset Inventory

Access Control Configuration modifies Configuration Resource · inventories

T1484Domain or Tenant Policy Modification

Model · Asset Inventory

Group Policy modifies Configuration Resource · inventories

T1490Inhibit System Recovery

Model · Asset Inventory

Operating System Configuration modifies Configuration Resource · inventories

T1518.001Security Software Discovery

Model · Asset Inventory

System Firewall Configuration may-access Configuration Resource · inventories

Model · Asset Inventory

System Configuration Database Record may-access Configuration Resource · inventories

T1526Cloud Service Discovery

Model · Asset Inventory

Cloud Configuration reads Configuration Resource · inventories

T1538Cloud Service Dashboard

Model · Asset Inventory

Cloud Configuration accesses Configuration Resource · inventories

T1546.001Change Default File Association

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1546.002Screensaver

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1546.007Netsh Helper DLL

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1546.008Accessibility Features

Model · Asset Inventory

System Configuration Database Record may-modify Configuration Resource · inventories

T1546.009AppCert DLLs

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1546.010AppInit DLLs

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1546.011Application Shimming

Model · Asset Inventory

Shim Database modifies Configuration Resource · inventories

T1546.014Emond

Model · Asset Inventory

Configuration Resource modifies Configuration Resource · inventories

T1547.001Registry Run Keys / Startup Folder

Model · Asset Inventory

System Configuration Init Database Record may-modify Configuration Resource · inventories

T1547.002Authentication Package

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1547.003Time Providers

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1547.004Winlogon Helper DLL

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1547.005Security Support Provider

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1547.010Port Monitors

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1548.001Setuid and Setgid

Model · Asset Inventory

Access Control Configuration modifies Configuration Resource · inventories

T1548.002Bypass User Account Control

Model · Asset Inventory

System Configuration Database Record may-modify Configuration Resource · inventories

T1548.005Temporary Elevated Cloud Access

Model · Asset Inventory

Access Control Configuration abuses Configuration Resource · inventories

T1552.005Cloud Instance Metadata API

Model · Asset Inventory

Cloud Instance Metadata accesses Configuration Resource · inventories

T1552.006Group Policy Preferences

Model · Asset Inventory

Group Policy accesses Configuration Resource · inventories

T1553.003SIP and Trust Provider Hijacking

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1556.002Password Filter DLL

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1556.009Conditional Access Policies

Model · Asset Inventory

Access Control Configuration modifies Configuration Resource · inventories

T1562.002Disable Windows Event Logging

Model · Asset Inventory

Application Configuration may-modify Configuration Resource · inventories

Model · Asset Inventory

Operating System Configuration Component may-modify Configuration Resource · inventories

T1562.003Impair Command History Logging

Model · Asset Inventory

Windows Registry Key may-modify Configuration Resource · inventories

Model · Asset Inventory

Process Environment Variable modifies Configuration Resource · inventories

T1562.004Disable or Modify System Firewall

Model · Asset Inventory

System Firewall Configuration modifies Configuration Resource · inventories

T1562.007Disable or Modify Cloud Firewall

Model · Asset Inventory

Cloud Configuration modifies Configuration Resource · inventories

T1562.008Disable or Modify Cloud Logs

Model · Asset Inventory

Cloud Configuration modifies Configuration Resource · inventories

T1562.009Safe Mode Boot

Model · Asset Inventory

System Configuration Init Database Record disables Configuration Resource · inventories

T1564.008Email Hiding Rules

Model · Asset Inventory

Application Configuration modifies Configuration Resource · inventories

Model · Asset Inventory

Email Rule may-create Configuration Resource · inventories

Model · Asset Inventory

Email Rule may-modify Configuration Resource · inventories

T1574.011Services Registry Permissions Weakness

Model · Asset Inventory

System Configuration Init Database Record modifies Configuration Resource · inventories

T1574.012COR_PROFILER

Model · Asset Inventory

System Configuration Database Record modifies Configuration Resource · inventories

T1578.002Create Cloud Instance

Model · Asset Inventory

Cloud Instance Metadata creates Configuration Resource · inventories

T1578.003Delete Cloud Instance

Model · Asset Inventory

Cloud Instance Metadata deletes Configuration Resource · inventories

T1578.004Revert Cloud Instance

Model · Asset Inventory

Cloud Instance Metadata modifies Configuration Resource · inventories

T1578.005Modify Cloud Compute Configurations

Model · Asset Inventory

Cloud Configuration modifies Configuration Resource · inventories

T1614System Location Discovery

Model · Asset Inventory

Configuration Resource accesses Configuration Resource · inventories

T1615Group Policy Discovery

Model · Asset Inventory

Group Policy reads Configuration Resource · inventories

T1666Modify Cloud Resource Hierarchy

Model · Asset Inventory

Cloud Configuration modifies Configuration Resource · inventories

查看关系图在矩阵中定位