HardenD3-DRA
Disable Remote Access
Definition
Limiting access to a computing device which is not required through or from a non-organization-controlled network.
- D3FEND ID
- D3-DRA
- Tactic
- Harden
- Certification relevance
- Security+CISSPCCSP
ATT&CK techniques it counters
3 techniques, 7 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Across MITRE's defensive frameworks
Linked through the 3 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2020-08-001NTFS Alternate Data Stream Execution - System Utilities1 shared
- CAR-2020-08-002NTFS Alternate Data Stream Execution - LOLBAS1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared