D3-AEM
enhancement
Application Exception Monitoring
Parent: D3-PM
Description
Monitoring the failures of system counters and timers.
Mapped SPARTA techniques
No techniques mapped to this control.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Counters 14 in MITRE ATT&CK Enterprise
- T1003.005Cached Domain Credentials
- T1003.006DCSync
- T1070.001Clear Windows Event Logs
- T1070.003Clear Command History
- T1110.001Password Guessing
- T1110.003Password Spraying
- T1110.004Credential Stuffing
- T1134.002Create Process with Token
- T1134.003Make and Impersonate Token
- T1140Deobfuscate/Decode Files or Information
- T1187Forced Authentication
- T1546.003Windows Management Instrumentation Event Subscription
- T1546.005Trap
- T1548.003Sudo and Sudo Caching
Cite as SafeMode Space, d3fend D3-AEM.