DetectD3-CAA
Connection Attempt Analysis
Also called: Network Scan Detection
Definition
Analyzing failed connections in a network to detect unauthorized activity.
- D3FEND ID
- D3-CAA
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
13 techniques, 29 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1003OS Credential Dumping
- T1021Remote Services
- T1047Windows Management Instrumentation
- T1090Proxy
- T1098Account Manipulation
- T1110Brute Force
- T1197BITS Jobs
- T1199Trusted Relationship
- T1207Rogue Domain Controller
- T1210Exploitation of Remote Services
- T1546Event Triggered Execution
- T1557Adversary-in-the-Middle
- T1570Lateral Tool Transfer
Across MITRE's defensive frameworks
Linked through the 13 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands3 shared
- CAR-2013-05-003SMB Write Request2 shared
- CAR-2013-05-005SMB Copy and Execution2 shared
- CAR-2013-07-001Suspicious Arguments2 shared
- CAR-2013-07-002RDP Connection Detection1 shared
- CAR-2014-03-001SMB Write Request - NamedPipes1 shared
- CAR-2014-05-001RPC Activity1 shared
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-006Windows Remote Management (WinRM)1 shared
- CAR-2014-11-007Remote Windows Management Instrumentation (WMI) over RPC1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2014-12-001Remotely Launched Executables via WMI1 shared