ModelD3-OAM
Operational Activity Mapping
Also called: Mission Mapping
Definition
Operational activity mapping identifies activities of the organization and the organization's suborganizations, groups, roles, and individuals that carry out the activities and then establishes the dependencies of the activities on the systems and people that perform those activities.
- D3FEND ID
- D3-OAM
- Tactic
- Model
- Certification relevance
- CISSPCISMSecurity+
Sub-techniques
ATT&CK techniques it counters
D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.
12 techniques, 38 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1078Valid Accounts
- T1087Account Discovery
- T1098Account Manipulation
- T1134Access Token Manipulation
- T1136Create Account
- T1222File and Directory Permissions Modification
- T1484Domain or Tenant Policy Modification
- T1531Account Access Removal
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1556Modify Authentication Process
- T1615Group Policy Discovery
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 12 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2013-02-008Simultaneous Logins on a Host1 shared
- CAR-2013-02-012User Logged in to Multiple Hosts1 shared
- CAR-2019-04-001UAC Bypass1 shared
- CAR-2019-07-001Access Permission Modification1 shared
- CAR-2020-09-004Credentials in Files & Registry1 shared
- CAR-2021-01-008Disable UAC1 shared
- CAR-2021-02-002Get System Elevation1 shared
- CAR-2021-05-010Create local admin accounts using net exe1 shared
- CAR-2013-10-001User Login Activity Monitoring1 shared
- CAR-2013-10-002DLL Injection via Load Library1 shared
- CAR-2013-05-003SMB Write Request1 shared