OpenCyber AcademyLesson map
Lesson 19. Map, example, EX065.
flowchart TD
N["T1078 Valid Accounts names the behaviour"] --> S["The tuple still holds 2 and 3"]
S --> P["Product 6"]
P --> K["The technique id is not a key field"]
A shared name helps defenders look up a behaviour. It is not a factor in the product.
Logical drawing
F3 prose
T1078 Valid Accounts
F3 tuple
likelihood 2
impact 3
product 6
absent from the tuple
the technique id
Learning outcomes
After this chapter, you should be able to:
- Say which finding the technique name is attached to.
- Show that the product uses 2 and 3.
- Refuse to treat the technique id as proof or as a score.
19.1 The name sits in the paragraph. The integers sit in the tuple.
F3 is the shared admin account on the grading system. The prose links that condition to T1078 Valid Accounts, because a shared credential lets a person act as a legitimate user without a separate name in the log. The tuple does not store T1078. It stores likelihood 2 and impact 3. The product is 6, from those two integers. The ranking lambda cannot see a technique id that is not in the tuple, so renaming the technique would not move F3 relative to F1.
The name is also not evidence that an intrusion occurred. It gives the detection team a public label to look up. Maya can write the label beside the finding. She cannot write it into the score, and she cannot treat it as a procedure for using the shared account. This course does not supply that procedure.
Lesson table; scroll horizontally to read all columns →
| Object | Holds T1078? | Holds the product? |
|---|---|---|
| The F3 paragraph | Yes, as a name | No |
| The F3 tuple | No | Yes, as 2 × 3 |
| The sort key | No | Yes, as -6 and then the id |
19.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered claim | Where the fact lives | Decision |
|---|---|---|
| "T1078 labels F3. The score is still 2 × 3." | Paragraph versus tuple | Keep |
| "The technique id is why F3 scores 6." | The integers are why | Refuse |
| "The label proves someone broke in." | A label is not an event | Refuse |
Synthetic case. One technique name, one product, no attack steps.
Errors and limits
Do not turn T1078 into a score or into a way to use the shared account.
Apply
- EX065 — Name versus product. What does T1078 do for F3, and what does it not do to the ranking?
Show marking criteria
Rubric: 3 = it names the shared-account behaviour; the product remains 2 × 3; the id is not in the tuple and is not proof of an intrusion;; 2 = the name and the product stay separate;; 1 = one label;; 0 = none.