DET-04 Baseline high-risk access activities
1 action under this Detect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour.
Quoted as published. Everything else on this page is written by Control Stack.
The action
- IT.DET-04.1Continuously Monitor Software Execution to Detect Malicious Use of Legitimate Tools
Keeps watching and analysing how software runs on systems, to catch attackers misusing legitimate tools and utilities, such as built-in admin tools.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.