MITRE D3FENDdefensive technique

D3-AM Access Modeling

Official page ↗
Tactic
Model

Definition

Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed, and shared across systems.

Related

Counters · MITRE ATT&CK (30)

  • T1556.009 Conditional Access Policies sub-technique
  • T1548.005 Temporary Elevated Cloud Access sub-technique
  • T1615 Group Policy Discovery technique
  • T0859 Valid Accounts technique
  • T1078.001 Default Accounts sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1087.001 Local Account sub-technique
  • T1087.002 Domain Account sub-technique
  • T1087.004 Cloud Account sub-technique
  • T1134.005 SID-History Injection sub-technique
  • T1552.006 Group Policy Preferences sub-technique
  • T1556 Modify Authentication Process technique
  • T1552 Unsecured Credentials technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.001 Setuid and Setgid sub-technique
  • T1136.003 Cloud Account sub-technique
  • T1136.001 Local Account sub-technique
  • T1136.002 Domain Account sub-technique
  • T1098.002 Additional Email Delegate Permissions sub-technique
  • T1098.003 Additional Cloud Roles sub-technique
  • T1531 Account Access Removal technique
  • T1484 Domain or Tenant Policy Modification technique
  • T1222 File and Directory Permissions Modification technique
  • T1134 Access Token Manipulation technique
  • T1136 Create Account technique
  • T1078 Valid Accounts technique
  • T1087 Account Discovery technique
  • T1098 Account Manipulation technique

Child of · MITRE D3FEND (1)

  • D3-OAM Operational Activity Mapping defensive technique

References