IsolateD3-NRAM
Network Resource Access Mediation
Also called: Remote Access Control
Definition
Control of access to organizational systems and services by users or processes over a network.
- D3FEND ID
- D3-NRAM
- Tactic
- Isolate
- Certification relevance
- Security+CISSPCCSP
Sub-techniques
ATT&CK techniques it counters
7 techniques, 13 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1037Boot or Logon Initialization Scripts
- T1039Data from Network Shared Drive
- T1070Indicator Removal
- T1074Data Staged
- T1080Taint Shared Content
- T1213Data from Information Repositories
- T1491Defacement
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 7 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2016-04-002User Activity from Clearing Event Logs1 shared
- CAR-2020-11-001Boot or Logon Initialization Scripts1 shared
- CAR-2020-11-005Clear Powershell Console Command History1 shared
- CAR-2020-11-007Network Share Connection Removal1 shared
- CAR-2021-01-003Clearing Windows Logs with Wevtutil1 shared
- CAR-2013-01-003SMB Events Monitoring1 shared
- CAR-2013-01-002Autorun Differences1 shared