Esc
Network Mapping
Definition
Network mapping encompasses the techniques to identify and model the physical layer, network layer, and data exchange layers of the organization's network and their physical location, and determine allowed pathways through that network.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 9 techniques in this category, Network Mapping.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Network Mapping | D3-NM | Network mapping encompasses the techniques to identify and model the physical layer, network layer, and data exchange layers of the organization's network and their physical location, and determine allowed pathways through that network. | |
| - Passive Logical Link Mapping | D3-PLLM | Passive logical link mapping only listens to network traffic as a means to map the the whole data link layer, where the links represent logical data flows rather than physical connections. | Passive Logical Layer Mapping |
| - Active Logical Link Mapping | D3-ALLM | Active logical link mapping sends and receives network traffic as a means to map the whole data link layer, where the links represent logical data flows rather than physical connection | |
| - Network Traffic Policy Mapping | D3-NTPM | Network traffic policy mapping identifies and models the allowed pathways of data at the network, transport, and/or application levels. | IPS Policy Mapping , Web Security Gateway Policy Mapping Firewall Mapping , and DLP Policy Mapping |
| - Direct Physical Link Mapping | D3-DPLM | Direct physical link mapping creates a physical link map by direct observation and recording of the physical network links. | Manual Physical Link Mapping |
| - Physical Link Mapping | D3-PLM | Physical link mapping identifies and models the link connectivity of the network devices within a physical network. | Layer 1 Mapping |
| - Network Vulnerability Assessment | D3-NVA | Network vulnerability assessment relates all the vulnerabilities of a network's components in the context of their configuration and interdependencies and can also include assessing risk emerging from the network's design as a whole, not just the sum of individual network node or network segment vulnerabilities. | |
| - Active Physical Link Mapping | D3-APLM | Active physical link mapping sends and receives network traffic as a means to map the physical layer. | Active Physical Layer Mapping |
| - Logical Link Mapping | D3-LLM | Logical link mapping creates a model of existing or previous node-to-node connections using network-layer data or metadata. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Privilege Escalation
Abuse Elevation Control Mechanism
Access Token Manipulation
Domain or Tenant Policy Modification
Discovery
Group Policy Discovery
Persistence
Server Software Component
Modify Authentication Process
Credential Access
Modify Authentication Process
Unsecured Credentials
Defense Evasion
Abuse Elevation Control Mechanism
Access Token Manipulation
Modify Cloud Compute Infrastructure
Modify Authentication Process
Impair Defenses
File and Directory Permissions Modification
Domain or Tenant Policy Modification