Administrative Network Traffic

Access Control Configuration

Access Control Group

Access Control List

Access Mediator

Access Process

Access Token

Activity Dependency

Actuator

Address Space

Administrative Network Traffic

Alias

Allocate Memory

Anonymous Pipe

Application

Application Configuration

Application Configuration Database

Application Configuration Database Record

Application Configuration File

Application Installer

Application Inventory Sensor

Application Layer Firewall

Application Layer Link

Application Process

Application Process Configuration

Application Rule

Application Shim

Archive File

Artifact Server

Asset Inventory Agent

Asymmetric Key

Audio Input Device

Authenticate User

Authentication Function

Authentication Log

Authentication Server

Authentication Service

Authorization Log

Authorization Service

Barcode Scanner Input Device

Binary Large Object

Binary Segment

Block Device

Boot Loader

Boot Record

Boot Sector

Browser

Browser Extension

Build Tool

Business Communication Platform Client

CA Certificate File

Processor Cache Memory

Call Stack

Central Processing Unit

Certificate

Certificate File

Certificate Trust Store

Chatroom Client

Child Process

Client Application

Client Computer

Clipboard

Cloud Configuration

Cloud Instance Metadata

Cloud Service Sensor

Cloud Storage

Cloud User Account

Code Analyzer

Code Repository

Collaborative Software

Network Agent

Command

Command History Log

Command History Log File

Command Line Interface

Compiler

Compiler Configuration File

Computer Network Node

Computer Platform

Computing Image

Computing Server

Computing Snapshot

Configuration Database

Configuration Database Record

Configuration File

Configuration Management Database

Configuration Resource

Connect Socket

Console Output Function

Container Build Tool

Container Image

Container Orchestration Software

Container Process

Container Runtime

Copy Memory Function

Copy Token

Create File

Create Process

Create Socket

Create Thread

Credential

Credential Management System

Cryptographic Key

Custom Archive File

Cyber Sensor

DHCP Network Traffic

DHCP Server

DNS Lookup

DNS Network Traffic

DNS Record

DNS Server

Data Artifact Server

Data Dependency

Data Link Link

Database

Database File

Database Query

Database Server

Decoy Artifact

Default User Account

Delete File

Dependency

Deserialization Function

Desktop Computer

Developer Application

Dial Up Modem

Differential Volume Snapshot

Digital Artifact

Digital Event Record

Digital Fingerprint

Digital Identity

Digital Information

Digital Information Bearer

Digital System

Properties

id: d3f:AdministrativeNetworkTraffic

name: Administrative Network Traffic
definition: Administrative network traffic is network traffic related to the remote administration or control of hosts or devices through a standard remote administrative protocol. Remote shells, terminals, RDP, and VNC are examples of these protocols, which are typically only used by administrators.
see also: http://dbpedia.org/resource/Remote_administration

json

Neighbors

        graph LR;

    d3f:NetworkTraffic["Network Traffic"] --> | may-contain | d3f:DomainName["Domain Name"];
            class d3f:NetworkTraffic inbound_node;
            style d3f:NetworkTraffic fill:#fff4dd;
             d3f:AdministrativeNetworkTraffic["Administrative Network Traffic"] -.-> | may-contain | d3f:DomainName["Domain Name"];
              class d3f:DomainName inbound_node;
              style d3f:DomainName fill:#fff4dd;

            click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
            click d3f:DomainName href "/dao/artifact/d3f:DomainName";d3f:NetworkTraffic["Network Traffic"] --> | contains | d3f:NetworkPackets["Network Packet"];
            class d3f:NetworkTraffic inbound_node;
            style d3f:NetworkTraffic fill:#fff4dd;
             d3f:AdministrativeNetworkTraffic["Administrative Network Traffic"] -.-> | contains | d3f:NetworkPackets["Network Packet"];
              class d3f:NetworkPackets inbound_node;
              style d3f:NetworkPackets fill:#fff4dd;

            click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
            click d3f:NetworkPackets href "/dao/artifact/d3f:NetworkPackets";d3f:NetworkTraffic["Network Traffic"] --> | originates-from | d3f:PhysicalLocation["Physical Location"];
            class d3f:NetworkTraffic inbound_node;
            style d3f:NetworkTraffic fill:#fff4dd;
             d3f:AdministrativeNetworkTraffic["Administrative Network Traffic"] -.-> | originates-from | d3f:PhysicalLocation["Physical Location"];
              class d3f:PhysicalLocation inbound_node;
              style d3f:PhysicalLocation fill:#fff4dd;

            click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
            click d3f:PhysicalLocation href "/dao/artifact/d3f:PhysicalLocation";   d3f:AdministrativeNetworkTraffic["Administrative Network Traffic"] --> | subClassOf | d3f:NetworkTraffic["Network Traffic"];

          class d3f:NetworkTraffic inbound_node;
          style d3f:NetworkTraffic fill:#fff4dd;

          class d3f:AdministrativeNetworkTraffic RootArtifactNode;
          style d3f:AdministrativeNetworkTraffic fill:#fff4dd;

          click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
          click d3f:AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";

Inferred Relationships

This page is experimental and may change significantly in future releases.

Hierarchy

(filtered)

Related Countermeasure Techniques

        graph LR;

      AdministrativeNetworkActivityAnalysis["Administrative Network Activity Analysis"] -->
          | analyzes | IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class AdministrativeNetworkActivityAnalysis DefensiveTechniqueNode; class IntranetAdministrativeNetworkTraffic ArtifactNode; click AdministrativeNetworkActivityAnalysis href "/technique/d3f:AdministrativeNetworkActivityAnalysis"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class Client-serverPayloadProfiling DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | NetworkTraffic["Network Traffic"]; class NetworkTrafficFiltering DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";

Related Weaknesses

AdministrativeNetworkTraffic has no related weaknesses in this release.

Related Offensive Techniques

        graph LR;

    T1563["Remote Service Session Hijacking"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1563 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click T1563 href "/offensive-technique/attack/T1563/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";T1021001["Remote Desktop Protocol"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021001 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click T1021001 href "/offensive-technique/attack/T1021.001/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";T1021004["SSH"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021004 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click T1021004 href "/offensive-technique/attack/T1021.004/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";T1546003["Windows Management Instrumentation Event Subscription"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1546003 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1546003 href "/offensive-technique/attack/T1546.003/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1546008["Accessibility Features"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1546008 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1546008 href "/offensive-technique/attack/T1546.008/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1207["Rogue Domain Controller"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1207 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1207 href "/offensive-technique/attack/T1207/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1047["Windows Management Instrumentation"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1047 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1047 href "/offensive-technique/attack/T1047/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1098001["Additional Cloud Credentials"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1098001 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1098001 href "/offensive-technique/attack/T1098.001/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1003006["DCSync"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1003006 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1003006 href "/offensive-technique/attack/T1003.006/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1110003["Password Spraying"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1110003 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1110003 href "/offensive-technique/attack/T1110.003/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1110004["Credential Stuffing"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1110004 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1110004 href "/offensive-technique/attack/T1110.004/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";