Esc

Device Registration - T1098.005

(ATT&CK® Technique)

Definition

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1098005["Device Registration"] --> |modifies| UserAccount["User Account"]; class T1098005 OffensiveTechniqueNode;
        class UserAccount ArtifactNode; click UserAccount href "/dao/artifact/d3f:UserAccount";
        click T1098005 href "/offensive-technique/attack/T1098.005/"; click UserAccount href "/dao/artifact/d3f:UserAccount";AccountLocking["Account Locking"] -->
          | disables | UserAccount["User Account"];

          AccountLocking["Account Locking"] -.->
            | May Evict | T1098005["Device Registration"] ;
          class AccountLocking DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click AccountLocking href "/technique/d3f:AccountLocking"; BiometricAuthentication["Biometric Authentication"] -->
          | authenticates | UserAccount["User Account"];

          BiometricAuthentication["Biometric Authentication"] -.->
            | May Harden | T1098005["Device Registration"] ;
          class BiometricAuthentication DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click BiometricAuthentication href "/technique/d3f:BiometricAuthentication"; Multi-factorAuthentication["Multi-factor Authentication"] -->
          | authenticates | UserAccount["User Account"];

          Multi-factorAuthentication["Multi-factor Authentication"] -.->
            | May Harden | T1098005["Device Registration"] ;
          class Multi-factorAuthentication DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click Multi-factorAuthentication href "/technique/d3f:Multi-factorAuthentication"; One-timePassword["One-time Password"] -->
          | authenticates | UserAccount["User Account"];

          One-timePassword["One-time Password"] -.->
            | May Harden | T1098005["Device Registration"] ;
          class One-timePassword DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click One-timePassword href "/technique/d3f:One-timePassword"; StrongPasswordPolicy["Strong Password Policy"] -->
          | strengthens | UserAccount["User Account"];

          StrongPasswordPolicy["Strong Password Policy"] -.->
            | May Harden | T1098005["Device Registration"] ;
          class StrongPasswordPolicy DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click StrongPasswordPolicy href "/technique/d3f:StrongPasswordPolicy"; UserAccountPermissions["User Account Permissions"] -->
          | restricts | UserAccount["User Account"];

          UserAccountPermissions["User Account Permissions"] -.->
            | May Harden | T1098005["Device Registration"] ;
          class UserAccountPermissions DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click UserAccountPermissions href "/technique/d3f:UserAccountPermissions";  RestoreUserAccountAccess["Restore User Account Access"] -->
          | restores | UserAccount["User Account"];

          RestoreUserAccountAccess["Restore User Account Access"] -.->
            | May Restore | T1098005["Device Registration"] ;
          class RestoreUserAccountAccess DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click RestoreUserAccountAccess href "/technique/d3f:RestoreUserAccountAccess"; UnlockAccount["Unlock Account"] -->
          | restores | UserAccount["User Account"];

          UnlockAccount["Unlock Account"] -.->
            | May Restore | T1098005["Device Registration"] ;
          class UnlockAccount DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click UnlockAccount href "/technique/d3f:UnlockAccount";

json