MITRE D3FENDdefensive technique
D3-UDTA User Data Transfer Analysis
- Tactic
- Detect
Definition
Analyzing the amount of data transferred by a user.
How it works
How it works
Unusual data transfer activity may indicate unauthorized activity. Data transfers can be analyzed by collecting network traffic or application logs.
Considerations
• There is a potential for false positives from anomalies that are not associated with unauthorized activity.
• Attackers that move low and slow may not differentiate their data transfer behavior enough for an alert to trigger.
Related
Child of · MITRE D3FEND (1)
- D3-UBA User Behavior Analysis defensive technique
References
- https://patents.google.com/patent/US20160142424A1 System and method thereof for identifying and responding to security incidents based on preemptive forensics
- https://patents.google.com/patent/US20160191559A1 System for implementing threat detection using threat and risk assessment of asset-actor interactions