DetectD3-ANAA
Administrative Network Activity Analysis
Definition
Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline.
- D3FEND ID
- D3-ANAA
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
6 techniques, 12 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Across MITRE's defensive frameworks
Linked through the 6 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-007Remote Windows Management Instrumentation (WMI) over RPC1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2014-12-001Remotely Launched Executables via WMI1 shared
- CAR-2016-03-002Create Remote Process via WMIC1 shared
- CAR-2019-04-004Credential Dumping via Mimikatz1 shared
- CAR-2019-07-002Lsass Process Dump via Procdump1 shared
- CAR-2019-08-001Credential Dumping via Windows Task Manager1 shared
- CAR-2019-08-002Active Directory Dumping via NTDSUtil1 shared
- CAR-2020-05-001MiniDump of LSASS1 shared
- CAR-2020-09-002Component Object Model Hijacking1 shared