ModelD3-NM
Network Mapping
Definition
Network mapping encompasses the techniques to identify and model the physical layer, network layer, and data exchange layers of the organization's network and their physical location, and determine allowed pathways through that network.
- D3FEND ID
- D3-NM
- Tactic
- Model
- Certification relevance
- CISSPCISMSecurity+
Sub-techniques
ATT&CK techniques it counters
D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.
11 techniques, 27 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1114Email Collection
- T1134Access Token Manipulation
- T1222File and Directory Permissions Modification
- T1484Domain or Tenant Policy Modification
- T1505Server Software Component
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1556Modify Authentication Process
- T1562Impair Defenses
- T1578Modify Cloud Compute Infrastructure
- T1615Group Policy Discovery
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 11 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2019-04-001UAC Bypass1 shared
- CAR-2019-07-001Access Permission Modification1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2020-09-004Credentials in Files & Registry1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2021-01-008Disable UAC1 shared
- CAR-2021-02-001Webshell-Indicative Process Tree1 shared
- CAR-2021-02-002Get System Elevation1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2013-10-002DLL Injection via Load Library1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared