Asset Inventory

Also called: Asset Discovery, Asset Inventorying

Definition

Asset inventorying identifies and records the organization's assets and enriches each inventory item with knowledge about their vulnerabilities.

D3FEND ID: D3-AI
Tactic: Model
Certification relevance: CISSPCISMSecurity+

Sub-techniques

D3-HCIHardware Component Inventory
D3-CIConfiguration Inventory
D3-SWISoftware Inventory
D3-AVEAsset Vulnerability Enumeration
D3-DIData Inventory
D3-NNINetwork Node Inventory

ATT&CK techniques it counters

D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.

57 techniques, 156 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1003OS Credential Dumping
.002 Security Account Manager .004 LSA Secrets .008 /etc/passwd and /etc/shadow
T1012Query Registry
T1014Rootkit
T1025Data from Removable Media
T1033System Owner/User Discovery
T1037Boot or Logon Initialization Scripts
.004 RC Scripts .005 Startup Items
T1052Exfiltration Over Physical Medium
.001 Exfiltration over USB
T1056Input Capture
.001 Keylogging .003 Web Portal Capture
T1072Software Deployment Tools
T1091Replication Through Removable Media
T1092Communication Through Removable Media
T1111Multi-Factor Authentication Interception
T1112Modify Registry
T1114Email Collection
.001 Local Email Collection .002 Remote Email Collection .003 Email Forwarding Rule
T1123Audio Capture
T1125Video Capture
T1127Trusted Developer Utilities Proxy Execution
.001 MSBuild
T1134Access Token Manipulation
.005 SID-History Injection
T1137Office Application Startup
.001 Office Template Macros .002 Office Test .003 Outlook Forms .004 Outlook Home Page .005 Outlook Rules .006 Add-ins
T1176Software Extensions
.001 Browser Extensions .002 IDE Extensions
T1195Supply Chain Compromise
.001 Compromise Software Dependencies and Development Tools .002 Compromise Software Supply Chain .003 Compromise Hardware Supply Chain
T1200Hardware Additions
T1207Rogue Domain Controller
T1212Exploitation for Credential Access
T1213Data from Information Repositories
.003 Code Repositories
T1218System Binary Proxy Execution
.002 Control Panel .005 Mshta .014 MMC
T1222File and Directory Permissions Modification
.001 Windows Permissions .002 Linux and Mac Permissions
T1484Domain or Tenant Policy Modification
.001 Group Policy Modification .002 Trust Modification
T1489Service Stop
T1490Inhibit System Recovery
T1497Virtualization/Sandbox Evasion
.003 Time Based Checks
T1505Server Software Component
.001 SQL Stored Procedures .002 Transport Agent .003 Web Shell .004 IIS Components
T1518Software Discovery
.001 Security Software Discovery
T1525Implant Internal Image
T1526Cloud Service Discovery
T1534Internal Spearphishing
T1538Cloud Service Dashboard
T1542Pre-OS Boot
.001 System Firmware .002 Component Firmware .003 Bootkit .004 ROMMONkit
T1543Create or Modify System Process
.003 Windows Service
T1546Event Triggered Execution
.001 Change Default File Association .002 Screensaver .007 Netsh Helper DLL .008 Accessibility Features .009 AppCert DLLs .010 AppInit DLLs .011 Application Shimming .012 Image File Execution Options Injection .014 Emond .015 Component Object Model Hijacking
T1547Boot or Logon Autostart Execution
.001 Registry Run Keys / Startup Folder .002 Authentication Package .003 Time Providers .004 Winlogon Helper DLL .005 Security Support Provider .008 LSASS Driver .010 Port Monitors
T1548Abuse Elevation Control Mechanism
.001 Setuid and Setgid .002 Bypass User Account Control .004 Elevated Execution with Prompt .005 Temporary Elevated Cloud Access
T1552Unsecured Credentials
.002 Credentials in Registry .005 Cloud Instance Metadata API .006 Group Policy Preferences
T1553Subvert Trust Controls
.003 SIP and Trust Provider Hijacking
T1554Compromise Host Software Binary
T1555Credentials from Password Stores
.001 Keychain .002 Securityd Memory .003 Credentials from Web Browsers .004 Windows Credential Manager .005 Password Managers .006 Cloud Secrets Management Stores
T1556Modify Authentication Process
.002 Password Filter DLL .009 Conditional Access Policies
T1562Impair Defenses
.002 Disable Windows Event Logging .003 Impair Command History Logging .004 Disable or Modify System Firewall .007 Disable or Modify Cloud Firewall .008 Disable or Modify Cloud Logs .009 Safe Mode Boot .013 Disable or Modify Network Device Firewall
T1564Hide Artifacts
.003 Hidden Window .005 Hidden File System .006 Run Virtual Instance .007 VBA Stomping .008 Email Hiding Rules
T1566Phishing
.001 Spearphishing Attachment .002 Spearphishing Link
T1574Hijack Execution Flow
.005 Executable Installer File Permissions Weakness .010 Services File Permissions Weakness .011 Services Registry Permissions Weakness .012 COR_PROFILER
T1578Modify Cloud Compute Infrastructure
.002 Create Cloud Instance .003 Delete Cloud Instance .004 Revert Cloud Instance .005 Modify Cloud Compute Configurations
T1614System Location Discovery
.001 System Language Discovery
T1615Group Policy Discovery
T1619Cloud Storage Object Discovery
T1649Steal or Forge Authentication Certificates
T1666Modify Cloud Resource Hierarchy

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 57 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

CAR-2013-04-002Quick execution of a series of suspicious commands8 shared
CAR-2013-01-002Autorun Differences6 shared
CAR-2013-03-001Reg.exe called from Command Shell4 shared
CAR-2020-05-003Rare LolBAS Command Lines4 shared
CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 02 shared
CAR-2021-11-002Registry Edit with Modification of Userinit, Shell or Notify2 shared
CAR-2021-12-002Modification of Default Startup Folder in the Registry Key 'Common Startup'2 shared
CAR-2014-02-001Service Binary Modifications2 shared
CAR-2013-09-005Service Outlier Executables1 shared
CAR-2014-03-006RunDLL32.exe monitoring1 shared
CAR-2014-05-002Services launching Cmd1 shared
CAR-2014-07-001Service Search Path Interception1 shared

37 more in the full list