Access Modeling
Description
Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed, and shared across systems.
Mapped SPARTA techniques
2 techniques
Derived by composition, not from a source that names this pair. D3FEND publishes that Access Modeling counters T1078 Valid Accounts; SafeMode's curated mapping records IA-0007 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Access Modeling counters T1078 Valid Accounts; SafeMode's curated mapping records PER-0003 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Counters 24 in MITRE ATT&CK Enterprise
- T1078Valid Accounts
- T1078.001Default Accounts
- T1078.002Domain Accounts
- T1078.003Local Accounts
- T1078.004Cloud Accounts
- T1087.001Local Account
- T1087.002Domain Account
- T1087.004Cloud Account
- T1098Account Manipulation
- T1098.002Additional Email Delegate Permissions
- T1098.003Additional Cloud Roles
- T1134.005SID-History Injection
- T1136Create Account
- T1136.001Local Account
- T1136.002Domain Account
- T1136.003Cloud Account
- T1222File and Directory Permissions Modification
- T1484Domain or Tenant Policy Modification
- T1531Account Access Removal
- T1548.001Setuid and Setgid
- T1548.005Temporary Elevated Cloud Access
- T1552.006Group Policy Preferences
- T1556.009Conditional Access Policies
- T1615Group Policy Discovery
Cite as SafeMode Space, d3fend D3-AM.