漏洞情报分析系统

系统在线只读模式数据管理

D3FEND 技术详情

D3-UGLPA

D3-UGLPA

User Geolocation Logon Pattern Analysis

定义

Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location.

父技术

D3-UBAUser Behavior Analysis

子技术

无

关联构件

NetworkTraffic

Network Traffic

Network traffic or data traffic is the data, or alternatively the amount of data, moving across a network at a given point of time. Network data in computer networks is mostly encapsulated in network packets, which provide the load in the network.

语义关系

出向analyzesNetwork Traffic

出向kb referenceReference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC

出向kb referenceReference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc

关联 ATT&CK

90

T0814Denial of Service

Detect · User Behavior Analysis

OT Network Traffic produces Network Traffic · analyzes

T0817Drive-by Compromise

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T0819Exploit Public-Facing Application

Detect · User Behavior Analysis

Inbound Internet Network Traffic produces Network Traffic · analyzes

T0822External Remote Services

Detect · User Behavior Analysis

Inbound Internet Network Traffic produces Network Traffic · analyzes

T0830Adversary-in-the-Middle

Detect · User Behavior Analysis

Network Traffic may-modify Network Traffic · analyzes

T0840Network Connection Enumeration

Detect · User Behavior Analysis

Network Traffic monitors Network Traffic · analyzes

T0842Network Sniffing

Detect · User Behavior Analysis

Network Traffic monitors Network Traffic · analyzes

T0846Remote System Discovery

Detect · User Behavior Analysis

Network Traffic monitors Network Traffic · analyzes

T0848Rogue Master

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

Detect · User Behavior Analysis

Network Traffic monitors Network Traffic · analyzes

T0865Spearphishing Attachment

Detect · User Behavior Analysis

Inbound Internet Mail Traffic produces Network Traffic · analyzes

T0866Exploitation of Remote Services

Detect · User Behavior Analysis

Intranet Network Traffic produces Network Traffic · analyzes

T0869Standard Application Layer Protocol

Detect · User Behavior Analysis

Outbound Network Traffic produces Network Traffic · analyzes

T0884Connection Proxy

Detect · User Behavior Analysis

Intranet Network Traffic may-produce Network Traffic · analyzes

Detect · User Behavior Analysis

Outbound Internet Network Traffic may-produce Network Traffic · analyzes

T0885Commonly Used Port

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

T0886Remote Services

Detect · User Behavior Analysis

Intranet Network Traffic produces Network Traffic · analyzes

T0888Remote System Information Discovery

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

T0894System Binary Proxy Execution

Detect · User Behavior Analysis

Network Traffic may-produce Network Traffic · analyzes

T0895Autorun Image

Detect · User Behavior Analysis

Network Traffic may-produce Network Traffic · analyzes

T1001Data Obfuscation

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1003.006DCSync

Detect · User Behavior Analysis

Intranet Administrative Network Traffic produces Network Traffic · analyzes

T1008Fallback Channels

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1011Exfiltration Over Other Network Medium

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1018Remote System Discovery

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

T1020Automated Exfiltration

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1021Remote Services

Detect · User Behavior Analysis

Intranet Network Traffic produces Network Traffic · analyzes

T1021.001Remote Desktop Protocol

Detect · User Behavior Analysis

Administrative Network Traffic produces Network Traffic · analyzes

Detect · User Behavior Analysis

Administrative Network Traffic produces Network Traffic · analyzes

T1029Scheduled Transfer

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1030Data Transfer Size Limits

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1041Exfiltration Over C2 Channel

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1047Windows Management Instrumentation

Detect · User Behavior Analysis

Intranet Administrative Network Traffic may-create Network Traffic · analyzes

T1048Exfiltration Over Alternative Protocol

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Detect · User Behavior Analysis

Outbound Internet Encrypted Traffic produces Network Traffic · analyzes

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Detect · User Behavior Analysis

Outbound Internet Encrypted Traffic produces Network Traffic · analyzes

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1071Application Layer Protocol

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1071.001Web Protocols

Detect · User Behavior Analysis

Outbound Internet Web Traffic produces Network Traffic · analyzes

T1071.002File Transfer Protocols

Detect · User Behavior Analysis

Outbound Internet File Transfer Traffic produces Network Traffic · analyzes

T1071.003Mail Protocols

Detect · User Behavior Analysis

Outbound Internet Mail Traffic produces Network Traffic · analyzes

Detect · User Behavior Analysis

Outbound Internet DNS Lookup Traffic produces Network Traffic · analyzes

T1090.001Internal Proxy

Detect · User Behavior Analysis

Intranet Network Traffic produces Network Traffic · analyzes

T1090.002External Proxy

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1090.003Multi-hop Proxy

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1090.004Domain Fronting

Detect · User Behavior Analysis

Outbound Internet Encrypted Web Traffic produces Network Traffic · analyzes

T1095Non-Application Layer Protocol

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1098.001Additional Cloud Credentials

Detect · User Behavior Analysis

Intranet Administrative Network Traffic produces Network Traffic · analyzes

T1102Web Service

Detect · User Behavior Analysis

Outbound Internet Web Traffic produces Network Traffic · analyzes

T1104Multi-Stage Channels

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1105Ingress Tool Transfer

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1110.003Password Spraying

Detect · User Behavior Analysis

Intranet Administrative Network Traffic may-create Network Traffic · analyzes

T1110.004Credential Stuffing

Detect · User Behavior Analysis

Intranet Administrative Network Traffic may-create Network Traffic · analyzes

T1132Data Encoding

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1185Browser Session Hijacking

Detect · User Behavior Analysis

Web Network Traffic produces Network Traffic · analyzes

T1189Drive-by Compromise

Detect · User Behavior Analysis

Internet Network Traffic produces Network Traffic · analyzes

T1190Exploit Public-Facing Application

Detect · User Behavior Analysis

Inbound Internet Network Traffic produces Network Traffic · analyzes

T1197BITS Jobs

Detect · User Behavior Analysis

Intranet Web Network Traffic may-produce Network Traffic · analyzes

Detect · User Behavior Analysis

Outbound Internet Web Traffic may-produce Network Traffic · analyzes

Detect · User Behavior Analysis

Intranet IPC Network Traffic may-produce Network Traffic · analyzes

T1199Trusted Relationship

Detect · User Behavior Analysis

Intranet Network Traffic produces Network Traffic · analyzes

T1204.001Malicious Link

Detect · User Behavior Analysis

Outbound Internet Web Traffic produces Network Traffic · analyzes

T1205Traffic Signaling

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

T1205.001Port Knocking

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

T1207Rogue Domain Controller

Detect · User Behavior Analysis

Intranet Administrative Network Traffic produces Network Traffic · analyzes

T1210Exploitation of Remote Services

Detect · User Behavior Analysis

Intranet Network Traffic produces Network Traffic · analyzes

Detect · User Behavior Analysis

Network Traffic may-produce Network Traffic · analyzes

T1219Remote Access Tools

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1498.001Direct Network Flood

Detect · User Behavior Analysis

Inbound Internet Network Traffic creates Network Traffic · analyzes

T1498.002Reflection Amplification

Detect · User Behavior Analysis

Inbound Internet Network Traffic produces Network Traffic · analyzes

T1499.002Service Exhaustion Flood

Detect · User Behavior Analysis

Inbound Internet Network Traffic produces Network Traffic · analyzes

T1542.005TFTP Boot

Detect · User Behavior Analysis

TFTP Network Traffic creates Network Traffic · analyzes

T1546.003Windows Management Instrumentation Event Subscription

Detect · User Behavior Analysis

Intranet Administrative Network Traffic produces Network Traffic · analyzes

T1546.008Accessibility Features

Detect · User Behavior Analysis

Intranet Administrative Network Traffic may-create Network Traffic · analyzes

T1550.001Application Access Token

Detect · User Behavior Analysis

Network Traffic may-produce Network Traffic · analyzes

T1550.004Web Session Cookie

Detect · User Behavior Analysis

Web Network Traffic produces Network Traffic · analyzes

T1557Adversary-in-the-Middle

Detect · User Behavior Analysis

Network Traffic produces Network Traffic · analyzes

T1557.001Name Resolution Poisoning and SMB Relay

Detect · User Behavior Analysis

Intranet Multicast Network Traffic produces Network Traffic · analyzes

T1557.003DHCP Spoofing

Detect · User Behavior Analysis

DHCP Network Traffic creates Network Traffic · analyzes

T1558.003Kerberoasting

Detect · User Behavior Analysis

RPC Network Traffic may-produce Network Traffic · analyzes

T1563Remote Service Session Hijacking

Detect · User Behavior Analysis

Administrative Network Traffic produces Network Traffic · analyzes

T1565.002Transmitted Data Manipulation

Detect · User Behavior Analysis

Network Traffic may-modify Network Traffic · analyzes

T1566.001Spearphishing Attachment

Detect · User Behavior Analysis

Inbound Internet Mail Traffic produces Network Traffic · analyzes

T1566.002Spearphishing Link

Detect · User Behavior Analysis

Inbound Internet Mail Traffic produces Network Traffic · analyzes

T1567Exfiltration Over Web Service

Detect · User Behavior Analysis

Outbound Internet Web Traffic produces Network Traffic · analyzes

T1567.001Exfiltration to Code Repository

Detect · User Behavior Analysis

Outbound Internet Encrypted Web Traffic may-produce Network Traffic · analyzes

Detect · User Behavior Analysis

Outbound Internet Encrypted Remote Terminal Traffic may-produce Network Traffic · analyzes

T1567.002Exfiltration to Cloud Storage

Detect · User Behavior Analysis

Outbound Internet Encrypted Web Traffic produces Network Traffic · analyzes

T1568Dynamic Resolution

Detect · User Behavior Analysis

Outbound Internet DNS Lookup Traffic produces Network Traffic · analyzes

T1570Lateral Tool Transfer

Detect · User Behavior Analysis

Intranet File Transfer Traffic produces Network Traffic · analyzes

T1571Non-Standard Port

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1572Protocol Tunneling

Detect · User Behavior Analysis

Outbound Internet Network Traffic produces Network Traffic · analyzes

T1573Encrypted Channel

Detect · User Behavior Analysis

Outbound Internet Encrypted Traffic produces Network Traffic · analyzes

T1573.001Symmetric Cryptography

Detect · User Behavior Analysis

Outbound Internet Encrypted Traffic creates Network Traffic · analyzes

T1573.002Asymmetric Cryptography

Detect · User Behavior Analysis

Outbound Internet Encrypted Traffic creates Network Traffic · analyzes

查看关系图在矩阵中定位