M1036Account Use Policies
Reduce brute-force and abuse with account lockout, logon time/location restrictions, and concurrent session limits.
Account Lockout / Logon PolicyWindowsLinuxIdentity
TA0006Defense Plan
Credential Access
Credential theft
Techniques in this tactic (7)
T1528Azure / Entra ID Kimlik Saldırıları: Token Hırsızlığından Golden SAML'e Bulut Kimlik GüvenliğiT1649Active Directory Sertifika Servisleri (AD CS) Saldırıları: ESC1–ESC16 Domain YükseltmeT1558Gelişmiş Kerberos Delegasyon İstismarı: Unconstrained, Constrained, RBCD ve Zorlamalı Kimlik DoğrulamaT1557.001NTLM Kimlik Doğrulama Saldırıları: Pass-the-Hash, NTLM Relay ve Zorlamalı Kimlik Doğrulamadan LLMNR/NBT-NS ZehirlemesineT1528Microsoft Graph API ve İzin Suistimali: Illicit Consent, Uygulama Rolleri ve OAuth SaldırılarıT1558Kerberos Bilet Saldırıları: Kerberoasting'ten Bilet SahteciliğineT1003.001LSASS Bellek Kimlik Bilgisi Dökümü: Mimikatz, Alternatif Araçlar ve Koruma Teknolojileri
M1047Audit
Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.
ZT: verify explicitlyLogging & Audit PolicyWindowsLinuxmacOSCloudIdentity
Source:Active Directory Sertifika Servisleri (AD CS) Saldırıları: ESC1–ESC16 Domain YükseltmeGelişmiş Kerberos Delegasyon İstismarı: Unconstrained, Constrained, RBCD ve Zorlamalı Kimlik DoğrulamaKerberos Bilet Saldırıları: Kerberoasting'ten Bilet SahteciliğineAzure / Entra ID Kimlik Saldırıları: Token Hırsızlığından Golden SAML'e Bulut Kimlik GüvenliğiMicrosoft Graph API ve İzin Suistimali: Illicit Consent, Uygulama Rolleri ve OAuth Saldırıları
M1040Behavior Prevention on Endpoint
Block common attack behaviors using Defender ASR rules and Office macro restrictions.
ZT: assume breachEDR / Attack Surface ReductionWindowsLinuxmacOS
Cloud Access Security Broker (CASB)
Visibility and control over SaaS/cloud application usage; OAuth application and data flow monitoring (Defender for Cloud Apps).
ZT: verify explicitlyCASB / SaaS SecurityCloudWindowsmacOS
M1043Credential Access Protection
Layered platform protections that reduce theft of in-memory and on-disk credentials (LSASS, Protected Users, WDigest, cache).
ZT: assume breachCredential Guard / LSASS ProtectionWindows
Source:NTLM Kimlik Doğrulama Saldırıları: Pass-the-Hash, NTLM Relay ve Zorlamalı Kimlik Doğrulamadan LLMNR/NBT-NS ZehirlemesineGelişmiş Kerberos Delegasyon İstismarı: Unconstrained, Constrained, RBCD ve Zorlamalı Kimlik DoğrulamaKerberos Bilet Saldırıları: Kerberoasting'ten Bilet SahteciliğineLSASS Bellek Kimlik Bilgisi Dökümü: Mimikatz, Alternatif Araçlar ve Koruma Teknolojileri
Credential Exposure Monitoring (Dark Web)
Monitoring credential exposure in breach databases, paste sites, and dark web forums; over 30% of initial accesses use previously stolen credentials.
ZT: assume breachThreat Intel / Credential MonitoringCloudIdentity
M1041Encrypt Sensitive Information
Encrypting sensitive data at rest and in transit so it cannot be used even if stolen.
ZT: assume breachEncryption PolicyWindowsLinuxmacOSCloudNetwork
Source:Active Directory Sertifika Servisleri (AD CS) Saldırıları: ESC1–ESC16 Domain YükseltmeNTLM Kimlik Doğrulama Saldırıları: Pass-the-Hash, NTLM Relay ve Zorlamalı Kimlik Doğrulamadan LLMNR/NBT-NS ZehirlemesineGelişmiş Kerberos Delegasyon İstismarı: Unconstrained, Constrained, RBCD ve Zorlamalı Kimlik DoğrulamaKerberos Bilet Saldırıları: Kerberoasting'ten Bilet SahteciliğineLSASS Bellek Kimlik Bilgisi Dökümü: Mimikatz, Alternatif Araçlar ve Koruma Teknolojileri
M1037Filter Network Traffic
Restricting inbound/outbound traffic with default-deny filtering, egress control, and anti-spoofing (uRPF/BCP38).
ZT: verify explicitlyFirewall / Egress FilteringNetworkCloud
Identity Governance and Access Certification
Identity governance (Access Reviews, entitlement, cross-tenant) that prevents privilege creep and unmonitored external access.
ZT: least privilegeIGA / Access ReviewWindowsCloudIdentity
Just-in-Time Privileged Access (PIM/JIT)
PIM that makes privileged roles eligible rather than permanent, used via approved and time-limited activation.
ZT: least privilegePIM / JITWindowsLinuxCloudIdentity
M1032Multi-factor Authentication
Multi-factor authentication that stops the vast majority of password-based attacks; enforced in Entra via Conditional Access.
ZT: verify explicitlyConditional Access / IAMWindowsIdentity
M1031Network Intrusion Prevention
IDS/IPS that detects and blocks known malicious patterns and anomalies in network traffic, with proper sensor placement.
ZT: assume breachIDS/IPSNetwork
M1027Password Policies
Long passwords + breach/dictionary checks + MFA; reversible encryption disabled.
ZT: least privilegePassword PolicyWindowsLinuxmacOSIdentity
M1026Privileged Account Management
Keep the number and use of privileged accounts to a minimum: Domain Admins hygiene, LAPS, JIT/PIM.
ZT: least privilegePAM / Tiered AdminWindowsLinuxIdentityCloud
M1021Restrict Web-Based Content
Narrows egress channels with DNS hardening (protective DNS/RPZ + sinkhole) and web proxy/filtering.
ZT: verify explicitlyWeb/DNS FilteringWindowsLinuxmacOSNetwork
M1018User Account Management
Account lifecycle management: proper creation, assignment with least privilege, timely disabling, and periodic access reviews.
ZT: least privilegeIAM / Joiner-Mover-LeaverWindowsLinuxmacOSIdentityCloud
M1017User Training
Reducing human-originated risk by training users on phishing, social engineering, and secure behavior.
Security Awareness ProgramWindowsLinuxmacOSIdentityCloud
Source:NTLM Kimlik Doğrulama Saldırıları: Pass-the-Hash, NTLM Relay ve Zorlamalı Kimlik Doğrulamadan LLMNR/NBT-NS ZehirlemesineAzure / Entra ID Kimlik Saldırıları: Token Hırsızlığından Golden SAML'e Bulut Kimlik GüvenliğiMicrosoft Graph API ve İzin Suistimali: Illicit Consent, Uygulama Rolleri ve OAuth SaldırılarıLSASS Bellek Kimlik Bilgisi Dökümü: Mimikatz, Alternatif Araçlar ve Koruma Teknolojileri
Zero Trust Architecture
A least-privilege architecture that rejects the assumption of a trusted internal network and verifies every access request by identity, device, and context.
ZT: verify explicitlyZero Trust / ZTNAWindowsLinuxmacOSCloudIdentity