ModelD3-AM
Access Modeling
Definition
Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed, and shared across systems.
- D3FEND ID
- D3-AM
- Tactic
- Model
- Certification relevance
- CISSPCISMSecurity+
ATT&CK techniques it counters
12 techniques, 38 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1078Valid Accounts
- T1087Account Discovery
- T1098Account Manipulation
- T1134Access Token Manipulation
- T1136Create Account
- T1222File and Directory Permissions Modification
- T1484Domain or Tenant Policy Modification
- T1531Account Access Removal
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1556Modify Authentication Process
- T1615Group Policy Discovery
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 12 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2013-02-008Simultaneous Logins on a Host1 shared
- CAR-2013-02-012User Logged in to Multiple Hosts1 shared
- CAR-2019-04-001UAC Bypass1 shared
- CAR-2019-07-001Access Permission Modification1 shared
- CAR-2020-09-004Credentials in Files & Registry1 shared
- CAR-2021-01-008Disable UAC1 shared
- CAR-2021-02-002Get System Elevation1 shared
- CAR-2021-05-010Create local admin accounts using net exe1 shared
- CAR-2013-10-001User Login Activity Monitoring1 shared
- CAR-2013-10-002DLL Injection via Load Library1 shared
- CAR-2013-05-003SMB Write Request1 shared