DetectD3-DAM
Domain Account Monitoring
Definition
Monitoring the existence of or changes to Domain User Accounts.
- D3FEND ID
- D3-DAM
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
4 techniques, 9 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 4 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2013-02-008Simultaneous Logins on a Host1 shared
- CAR-2013-02-012User Logged in to Multiple Hosts1 shared
- CAR-2021-05-010Create local admin accounts using net exe1 shared
- CAR-2013-10-001User Login Activity Monitoring1 shared
- CAR-2013-05-003SMB Write Request1 shared
- CAR-2013-05-005SMB Copy and Execution1 shared
- CAR-2016-03-001Host Discovery Commands1 shared