MITRE D3FENDdefensive technique

D3-NTCD Network Traffic Community Deviation

Official page ↗
Tactic
Detect

Definition

Establishing baseline communities of network hosts and identifying statistically divergent inter-community communication.

How it works

How it works Hosts/users within a computer network are analyzed to identify communities of hosts which frequently communicate. Future communications between communities that don't usually communicate can then be detected. For example, if a community of hosts that communicate in support of a company's finance division suddenly starts to access the code server usually accessed only by engineers, this may indicate unauthorized activity. Considerations • Potential for false positives in very dynamic network environments. • Attackers that move low and slow may not differentiate their behavior enough to trigger an alert.

Related

Counters · MITRE ATT&CK (104)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1557.003 DHCP Spoofing sub-technique
  • T0888 Remote System Information Discovery technique
  • T0886 Remote Services technique
  • T1542.005 TFTP Boot sub-technique
  • T1205.001 Port Knocking sub-technique
  • T0814 Denial of Service technique
  • T0817 Drive-by Compromise technique
  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0830 Adversary-in-the-Middle technique
  • T0840 Network Connection Enumeration technique
  • T0842 Network Sniffing technique
  • T0846 Remote System Discovery technique
  • T0848 Rogue Master technique
  • T0865 Spearphishing Attachment technique
  • T0866 Exploitation of Remote Services technique
  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique
  • T0885 Commonly Used Port technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
Show all 104 ›

Child of · MITRE D3FEND (1)

  • D3-NTA Network Traffic Analysis defensive technique

References