MITRE D3FENDdefensive technique

D3-CSPP Client-server Payload Profiling

Official page ↗
Tactic
Detect

Definition

Comparing client-server request and response payloads to a baseline profile to identify outliers.

How it works

How it works Profiling request and response payloads across multiple clients to a single server to develop a baseline of their characteristics. May take into account request/response sizes, entropy, frequency, and rhythm. Finally, identify outliers as they may indicate a malicious payload delivery and subsequent server exploitation. Considerations • Collecting metrics to establish a profile can be challenging since user behavior can change easily. • Employees may work different hours or inconsistent schedules which will cause false positives. • Collection of network activity to generate metrics is a computationally intensive process. • Users may log into different workstations which may cause false positives.

Related

Counters · MITRE ATT&CK (104)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1557.003 DHCP Spoofing sub-technique
  • T0888 Remote System Information Discovery technique
  • T0886 Remote Services technique
  • T1542.005 TFTP Boot sub-technique
  • T1205.001 Port Knocking sub-technique
  • T0814 Denial of Service technique
  • T0817 Drive-by Compromise technique
  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0830 Adversary-in-the-Middle technique
  • T0840 Network Connection Enumeration technique
  • T0842 Network Sniffing technique
  • T0846 Remote System Discovery technique
  • T0848 Rogue Master technique
  • T0865 Spearphishing Attachment technique
  • T0866 Exploitation of Remote Services technique
  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique
  • T0885 Commonly Used Port technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
Show all 104 ›

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

References