Esc
Access Policy Administration
Definition
Access policy administration is the systematic process of defining, implementing, and managing access control policies that dictate user permissions to resources.
Synonyms: Access Control Administration.Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 5 techniques in this category, Access Policy Administration.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Access Policy Administration | D3-APA | Access policy administration is the systematic process of defining, implementing, and managing access control policies that dictate user permissions to resources. | Access Control Administration |
| - Local File Permissions | D3-LFP | Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the configuration of operating system functionality. | |
| - User Account Permissions | D3-UAP | Restricting a user account's access to resources. | |
| - User Group Permissions | D3-UGPH | Access control where access is determined based on attributes associated with users and the objects being accessed. | Role Based Access Controls |
| - Domain Trust Policy | D3-DTP | Restricting inter-domain trust by modifying domain configuration. |
Related Offensive Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Persistence
Boot or Logon Autostart Execution
Office Application Startup
Event Triggered Execution
Modify Authentication Process
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Server Software Component
Valid Accounts
Account Manipulation
Create Account
Stealth
Hide Artifacts
XSL Script Processing
Process Injection
System Binary Proxy Execution
Hijack Execution Flow
Rootkit
Masquerading
Obfuscated Files or Information
Impair Defenses
Trusted Developer Utilities Proxy Execution
Deobfuscate/Decode Files or Information
Indicator Removal
Valid Accounts
Discovery
System Network Configuration Discovery
System Owner/User Discovery
File and Directory Discovery
Remote System Discovery
Account Discovery
Execution
Command and Scripting Interpreter
Hijack Execution Flow
Scheduled Task/Job
Trusted Developer Utilities Proxy Execution
User Execution
Software Deployment Tools
Privilege Escalation
Event Triggered Execution
Process Injection
Boot or Logon Autostart Execution
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Abuse Elevation Control Mechanism
Valid Accounts
Account Manipulation
Credential Access
Modify Authentication Process
Credentials from Password Stores
OS Credential Dumping
Forced Authentication
Unsecured Credentials
Steal or Forge Authentication Certificates
Defense Impairment
Modify Authentication Process
Collection
Archive Collected Data
Data from Local System
Email Collection
Automated Collection
Data Staged
Command and Control
Encrypted Channel
Application Layer Protocol
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Initial Access
Phishing
Valid Accounts
Lateral Movement
Internal Spearphishing
Software Deployment Tools
Impact
Data Manipulation
Data Encrypted for Impact
Account Access Removal