Active Directory Configuration
Mitigation · ATTACK:enterprise:M1015
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:M1015",
"title": "Active Directory Configuration",
"type": "Mitigation",
"source_url": "https://attack.mitre.org/mitigations/M1015",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462",
"external_id": "M1015",
"domain": "enterprise",
"created": "2019-06-06T16:39:58.291Z",
"modified": "2024-12-10T15:57:59.336Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--037b851b-7ced-4322-a57a-9f744f9a1e76
STIG krbtgt resetATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14039b88-3e1f-4d21-a0a0-968a15451db1
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--147b8bb5-ca4e-455e-a5b9-f0ab118c67eb
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b36db33-4f97-4228-bcca-4f453d1bd533
Microsoft MS14-025ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1134.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ebbb8a5-a5f2-495d-bdf3-c49701edb26b
Microsoft Trust Considerations Nov 2014 · Microsoft SID Filtering Quarantining Jan 2009 · Microsoft Netdom Trust Sept 2012 · AdSecurity Kerberos GT Aug 2015ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3278a7a8-bf61-45bc-9553-872f222f699d
Mandiant Defend UNC2452 White PaperATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1649
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35228466-b834-474f-8657-a3492a3579b6
SpecterOps Certified Pre OwnedATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1003.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c1da818-6e35-4fa8-ad40-e45c2c90e016
Microsoft Protected Users Security GroupATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1003.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b641542-852b-47c0-a604-f13998adb892
ADSecurity Mimikatz DCSync · Microsoft Replication ACLATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--868a59bb-27ed-4c54-8de0-54fcc22e911e
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--918a7d67-faea-4a41-9ed3-e3558fca73db
ADSecurity Kerberos and KRBTGT · STIG krbtgt resetATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1552.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3a191f3-59be-4457-ad5c-085ea0391bfe
Microsoft MS14-025ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eed29e0f-59c1-4fab-8268-3f0571e90748
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1558.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6d6f916-ca2a-4c25-841f-02d71b31308c
STIG krbtgt resetATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc31837d-530f-45e5-b9f8-bf6268c3ef03
AdSecurity DCSync Sept 2015 · Microsoft Protected Users Security Group · Microsoft Replication ACL