IsolateD3-WSAM
Web Session Access Mediation
Definition
Web session access mediation secures user sessions in web applications by employing robust authentication and integrity validation, along with adaptive threat mitigation techniques, to ensure that access to web resources is authorized and protected from session-related attacks.
- D3FEND ID
- D3-WSAM
- Tactic
- Isolate
- Certification relevance
- Security+CISSPCCSP
Sub-techniques
ATT&CK techniques it counters
7 techniques, 23 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Across MITRE's defensive frameworks
Linked through the 7 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2016-04-004Successful Local Account Login1 shared
- CAR-2019-04-004Credential Dumping via Mimikatz1 shared
- CAR-2019-07-002Lsass Process Dump via Procdump1 shared
- CAR-2019-08-001Credential Dumping via Windows Task Manager1 shared
- CAR-2019-08-002Active Directory Dumping via NTDSUtil1 shared
- CAR-2020-05-001MiniDump of LSASS1 shared
- CAR-2021-02-001Webshell-Indicative Process Tree1 shared
- CAR-2021-05-011Create Remote Thread into LSASS1 shared
- CAR-2013-07-001Suspicious Arguments1 shared
- CAR-2016-03-001Host Discovery Commands1 shared