MITRE D3FENDdefensive technique

D3-RFAM Remote File Access Mediation

Official page ↗
Tactic
Isolate
Synonyms
File Share Access Mediation

Definition

Remote file access mediation is the process of managing and securing access to file systems over a network to ensure that only authorized users or processes can interact with remote files.

How it works

How it works Remote File Access Mediation focuses on controlling how users or processes access file systems from remote locations. This involves ensuring secure connections, often through protocols like SFTP or SMB, and enforcing permissions to prevent unauthorized access or data breaches. Examples of enforcement areas include accessing shared drives or cloud storage from remote offices or home networks.

Related

Counters · MITRE ATT&CK (127)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T0893 Data from Local System technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T0888 Remote System Information Discovery technique
  • T1564.007 VBA Stomping sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T1556.003 Pluggable Authentication Modules sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T0851 Rootkit technique
  • T0865 Spearphishing Attachment technique
  • T0871 Execution through API technique
  • T1127.001 MSBuild sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573 Encrypted Channel technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1574.004 Dylib Hijacking sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1564.002 Hidden Users sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574 Hijack Execution Flow technique
  • T1204.002 Malicious File sub-technique
Show all 127 ›

Child of · MITRE D3FEND (1)

  • D3-NRAM Network Resource Access Mediation defensive technique

References