MITRE D3FENDdefensive technique

D3-APCA Application Protocol Command Analysis

Official page ↗
Tactic
Detect

Definition

Analyzing application protocol level remote commands to detect unauthorized activity.

How it works

How it works This technique requires the ability to parse application layer protocols to understand the commands being sent to a remote service. Signature-based or statistical analysis may be employed to identify unauthorized commands being sent. These commands can be observed by monitoring network traffic or application logs.

Related

Counters · MITRE ATT&CK (104)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1557.003 DHCP Spoofing sub-technique
  • T0888 Remote System Information Discovery technique
  • T0886 Remote Services technique
  • T1542.005 TFTP Boot sub-technique
  • T1205.001 Port Knocking sub-technique
  • T0814 Denial of Service technique
  • T0817 Drive-by Compromise technique
  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0830 Adversary-in-the-Middle technique
  • T0840 Network Connection Enumeration technique
  • T0842 Network Sniffing technique
  • T0846 Remote System Discovery technique
  • T0848 Rogue Master technique
  • T0865 Spearphishing Attachment technique
  • T0866 Exploitation of Remote Services technique
  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique
  • T0885 Commonly Used Port technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
Show all 104 ›

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

Referenced by MITRE D3FEND · child of (1)

  • D3-RFUM Remote Firmware Update Monitoring defensive technique

References