D3-RFAM

Isolate

Remote File Access Mediation

Definition

Remote file access mediation is the process of managing and securing access to file systems over a network to ensure that only authorized users or processes can interact with remote files.

How it works

Remote File Access Mediation focuses on controlling how users or processes access file systems from remote locations. This involves ensuring secure connections, often through protocols like SFTP or SMB, and enforcing permissions to prevent unauthorized access or data breaches. Examples of enforcement areas include accessing shared drives or cloud storage from remote offices or home networks.

Artifact Relationships

This defensive technique relates to specific digital artifacts.

References

Reference - NIST Special Publication 800-53 Revision 5 - Security and Privacy Controls for Information Systems and Organizations

Counters ATT&CK (46)

T1003 OS Credential Dumping

T1005 Data from Local System

T1014 Rootkit

T1016 System Network Configuration Discovery

T1018 Remote System Discovery

T1027 Obfuscated Files or Information

T1033 System Owner/User Discovery

T1036 Masquerading

T1037 Boot or Logon Initialization Scripts

T1041 Exfiltration Over C2 Channel

T1048 Exfiltration Over Alternative Protocol

T1053 Scheduled Task/Job

T1055 Process Injection

T1059 Command and Scripting Interpreter

T1070 Indicator Removal

T1071 Application Layer Protocol

T1072 Software Deployment Tools

T1074 Data Staged

T1083 File and Directory Discovery

T1114 Email Collection

T1119 Automated Collection

T1127 Trusted Developer Utilities Proxy Execution

T1137 Office Application Startup

T1140 Deobfuscate/Decode Files or Information

T1187 Forced Authentication

T1204 User Execution

T1218 System Binary Proxy Execution

T1220 XSL Script Processing

T1486 Data Encrypted for Impact

T1505 Server Software Component

T1534 Internal Spearphishing

T1543 Create or Modify System Process

T1546 Event Triggered Execution

T1547 Boot or Logon Autostart Execution

T1548 Abuse Elevation Control Mechanism

T1552 Unsecured Credentials

T1555 Credentials from Password Stores

T1556 Modify Authentication Process

T1560 Archive Collected Data

T1562 Impair Defenses

T1564 Hide Artifacts

T1565 Data Manipulation

T1566 Phishing

T1573 Encrypted Channel

T1574 Hijack Execution Flow

T1649 Steal or Forge Authentication Certificates