Defensive Tactics: Model, Harden, Detect, Isolate, Deceive, Evict, Restore, Other
[d3f-model] Model
- D3-AM Access Modeling
A Model defensive technique. Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-am-access-modeling
- D3-AVE Asset Vulnerability Enumeration
A Model defensive technique. Asset vulnerability enumeration enriches inventory items with knowledge identifying their vulnerabilities. In the D3FEND model it evaluates the physical artifact; evaluates the software; identifies the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ave-asset-vulnerability-enumeration
- D3-CI Configuration Inventory
A Model defensive technique. In the D3FEND model it inventories Configuration Resource. It is part of the Asset Inventory D3FEND parent category and counters ATT&CK techniques T1548.002, T1547.003, T1548.001, T1134.005, T1548.005,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ci-configuration-inventory
- D3-CIA Container Image Analysis
A Model defensive technique. Analyzing a Container Image with respect to a set of policies. Container images are standalone collections of the executable code and content that are used to populate a container environment. They are...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cia-container-image-analysis
- D3-DI Data Inventory
A defensive technique that enumerates and tracks data assets - structured databases, unstructured file shares, SaaS data, regulated personal data, secrets, and intellectual property - to enable risk-aligned protection and breach scope...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-di-data-inventory
- D3-HCI Hardware Component Inventory
A Model defensive technique. In the D3FEND model it inventories Hardware Device. It is part of the Asset Inventory D3FEND parent category and counters ATT&CK techniques T1091, T1092, T1123, T1125, T1025, T1056.001, T1619, T1195.003,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-hci-hardware-component-inventory
- D3-LLM Logical Link Mapping
A Model defensive technique. Logical link mapping creates a model of existing or previous node-to-node connections using network-layer data or metadata. In the D3FEND model it maps the logical link; maps the network; maps the network...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-llm-logical-link-mapping
- D3-NNI Network Node Inventory
A Model defensive technique. In the D3FEND model it inventories Network Node. It is part of the Asset Inventory D3FEND parent category and counters ATT&CK techniques T1114.002, T1505.002, T1505.003, T1578.002, T1562.013, T1578.003,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-nni-network-node-inventory
- D3-NTPM Network Traffic Policy Mapping
A Model defensive technique. Network traffic policy mapping identifies and models the allowed pathways of data at the network, transport, and/or application levels. In the D3FEND model it queries the network agent; maps the access...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ntpm-network-traffic-policy-mapping
- D3-PLM Physical Link Mapping
A Model defensive technique. Physical link mapping identifies and models the link connectivity of the network devices within a physical network. In the D3FEND model it maps the network node; maps the physical link. It counters ATT&CK...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-plm-physical-link-mapping
- D3-SYSVA System Vulnerability Assessment
A Model defensive technique. System vulnerability assessment relates all the vulnerabilities of a system's components in the context of their configuration and internal dependencies and can also include assessing risk emerging from the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sysva-system-vulnerability-assessment
[d3f-harden] Harden
- D3-AA Agent Authentication
A Harden defensive technique. Agent authentication is the process of verifying the identities of agents to ensure they are authorized and trustworthy participants within a system. In the D3FEND model it authenticates the agent;...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-aa-agent-authentication
- D3-ACH Application Configuration Hardening
A defensive technique that secures application-layer settings - feature flags, security headers, session cookie attributes, CORS policies, rate limiting, error verbosity, debug endpoints - to reduce attack surface. ACH spans web...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ach-application-configuration-hardening
- D3-BA Bootloader Authentication
A Harden defensive technique. Cryptographically authenticating the bootloader software before system boot. In the D3FEND model it authenticates the boot loader. It counters ATT&CK technique T1542.003. Via the Center for Threat-Informed...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ba-bootloader-authentication
- D3-CDP Change Default Password
A Harden defensive technique. Changing the default password means replacing the factory-set credentials with a strong, unique password before the device is deployed, preventing unauthorized access. Change the default password as soon as...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cdp-change-default-password
- D3-CERO Certificate Rotation
A Harden defensive technique. Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cero-certificate-rotation
- D3-CH Credential Hardening
The foundational Harden-tactic technique that strengthens user, service, and machine credentials against theft, brute-force, replay, and unauthorised use. CH encompasses MFA enforcement, strong password policy, credential rotation,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ch-credential-hardening
- D3-CP Certificate Pinning
A defensive technique that persists a server X.509 certificate or public key and compares against the server presented identity to allow greater client confidence in remote server identity for SSL/TLS connections. Counters certificate...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cp-certificate-pinning
- D3-CRO Credential Rotation
A defensive technique that regularly changes or replaces authentication credentials (passwords, API keys, certificates) to minimise risk of unauthorised access. Counters ATT&CK T1110 (Brute Force), T1003 (OS Credential Dumping), T1078...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cro-credential-rotation
- D3-CS Credential Scrubbing
A Harden defensive technique. The systematic removal of hard-coded credentials from source code to prevent accidental exposure and unauthorized access. Credential Scrubbing involves identifying and eliminating hard-coded credentials...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cs-credential-scrubbing
- D3-DENCR Disk Encryption
A defensive technique that protects data at rest by encrypting block-level storage volumes. DENCR counters ATT&CK techniques T1486 (Data Encrypted for Impact - prevents extortion leverage from offline storage seizure), T1565 (Data...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dencr-disk-encryption
- D3-DLV Domain Logic Validation
A Harden defensive technique. Validation of variable state in the context of the domain application. Validates the type, value, and/or range of an variable taking into context the current application in the business domain. In the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dlv-domain-logic-validation
- D3-DRA Disable Remote Access
A Harden defensive technique. Limiting access to a computing device which is not required through or from a non-organization-controlled network. There are several different methods of achieving remote access restriction. This could...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dra-disable-remote-access
- D3-FE File Encryption
A Harden defensive technique. Encrypting a file using a cryptographic key. Files are encrypted using either a single key for both encryption and decryption or separate keys. Single key encryption is symmetric encryption and using two...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fe-file-encryption
- D3-HBWP Hardware-based Write Protection
A Harden defensive technique. Physical methods of preventing data from being written to computer storage. In the D3FEND model it hardens the secondary storage. It counters ATT&CK technique T1619. Via the Center for Threat-Informed...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-hbwp-hardware-based-write-protection
- D3-MFA Multi-factor Authentication
A defensive technique that requires authentication through two or more independent factors (knowledge, possession, inherence) to verify user identity. MFA counters ATT&CK techniques T1078 (Valid Accounts), T1110 (Brute Force), T1556...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-mfa-multi-factor-authentication
- D3-OTP One-time Password
A Harden defensive technique. In the D3FEND model it use-limits Password. It is part of the Credential Hardening D3FEND parent category and counters ATT&CK techniques T1110.001, T1110.003, T1110.002. Via the Center for Threat-Informed...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-otp-one-time-password
- D3-PR Password Rotation
A Harden defensive technique. Password rotation is a security policy that mandates the periodic change of user account passwords to mitigate the risk of unauthorized access due to compromised credentials. Users may be requested to...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pr-password-rotation
- D3-PSEP Process Segment Execution Prevention
A Harden defensive technique. Preventing execution of any address in a memory region other than the code segment. During execution of a process, the instruction pointer register should only point to addresses in a code segment (also...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-psep-process-segment-execution-prevention
- D3-RH Radiation Hardening
A Harden defensive technique. Radiation hardening is the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation. There are three core radiation hardening...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rh-radiation-hardening
- D3-SAOR Segment Address Offset Randomization
A Harden defensive technique. Randomizing the base (start) address of one or more segments of memory during the initialization of a process. Many application exploits rely on an attacker specifying a location in memory, which points to...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-saor-segment-address-offset-randomization
- D3-SCP System Configuration Permissions
A Harden defensive technique. Restricting system configuration modifications to a specific user or group of users. In the D3FEND model it restricts the system configuration database. It counters ATT&CK techniques T1012, T1112,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-scp-system-configuration-permissions
- D3-SFCV Stack Frame Canary Validation
A Harden defensive technique. Comparing a value stored in a stack frame with a known good value in order to prevent or detect a memory segment overwrite. This defense must be applied at compile-time, or via a patch to the program...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sfcv-stack-frame-canary-validation
- D3-SPP Strong Password Policy
A defensive technique that enforces password complexity, length, breach-corpus screening, and reuse prevention to defeat brute-force, dictionary, and credential-stuffing attacks. SPP aligns with modern NIST SP 800-63B guidance: minimum...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-spp-strong-password-policy
- D3-SU Software Update
A Harden defensive technique. Replacing old software on a computer system component. In the D3FEND model it updates the software. It counters ATT&CK techniques T1014, T1056.003, T1072, T1127.001, T1137.006, T1176, T1195.001, T1195.002,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-su-software-update
- D3-TB Token Binding
A Harden defensive technique. Token binding is a security mechanism used to enhance the protection of tokens, such as cookies or OAuth tokens, by binding them to a specific connection. When issuing a security token to a client that...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-tb-token-binding
- D3-TBA Token-based Authentication
A Harden defensive technique. In the D3FEND model it uses Access Token. It is part of the Agent Authentication D3FEND parent category and counters ATT&CK techniques T1550.001, T1134.001, T1134.002, T1134.003, T1558.001, T1558, T1528....
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-tba-token-based-authentication
- D3-TL Trusted Library
A Harden defensive technique. A trusted library is a collection of pre-verified and secure code modules or components that are used within software applications to perform specific functions. These libraries are considered reliable and...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-tl-trusted-library
- D3-VI Variable Initialization
A Harden defensive technique. Setting variables to a known value before use. Initializing variables upon declaration ensures that the variable has a known quantity before use. In the D3FEND model it hardens the subroutine. It counters...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-vi-variable-initialization
[d3f-detect] Detect
- D3-AEM Application Exception Monitoring
A Detect defensive technique. Monitoring the failures of system counters and timers. Monitoring timer and counter failures or exceedances can reveal issues with the program or platform, and is important for both safety and security. It...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-aem-application-exception-monitoring
- D3-ANAA Administrative Network Activity Analysis
A Detect defensive technique. Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline. Network protocols such as RDP, IPMI, SSH, SNMP, VNC, MOSH, NX, TeamViewer, SPICE, PCoIP,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-anaa-administrative-network-activity-analysis
- D3-APCA Application Protocol Command Analysis
A Detect defensive technique. Analyzing application protocol level remote commands to detect unauthorized activity. This technique requires the ability to parse application layer protocols to understand the commands being sent to a...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-apca-application-protocol-command-analysis
- D3-CA Certificate Analysis
A Detect defensive technique. Analyzing Public Key Infrastructure certificates to detect if they have been misconfigured or spoofed using both network traffic, certificate fields and third-party logs. Certificate Analysis ensures that...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ca-certificate-analysis
- D3-CAA Connection Attempt Analysis
A Detect defensive technique. Analyzing failed connections in a network to detect unauthorized activity. Connection Attempt Analysis in multiple ways. In the D3FEND model it analyzes the intranet network traffic. It counters ATT&CK...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-caa-connection-attempt-analysis
- D3-CCSA Credential Compromise Scope Analysis
A Detect defensive technique. Determining which credentials may have been compromised by analyzing the user logon history of a particular system. Memory Credentials may be stored in memory for a variety of reasons; on Windows, they may...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ccsa-credential-compromise-scope-analysis
- D3-CSPP Client-server Payload Profiling
A Detect defensive technique. Comparing client-server request and response payloads to a baseline profile to identify outliers. Profiling request and response payloads across multiple clients to a single server to develop a baseline of...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cspp-client-server-payload-profiling
- D3-DA Dynamic Analysis
A Detect defensive technique. Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader. Analyzing the interaction...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-da-dynamic-analysis
- D3-DAM Domain Account Monitoring
A Detect defensive technique. Monitoring the existence of or changes to Domain User Accounts. In the D3FEND model it monitors the domain user account. It counters ATT&CK techniques T1078.002, T1087.002, T1098.002, T1098.003, T1136.002....
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dam-domain-account-monitoring
- D3-DNSTA DNS Traffic Analysis
A Detect defensive technique. Analysis of domain name metadata, including name and DNS records, to determine whether the domain is likely to resolve to an undesirable host. This technique can be accomplished in a number of ways. One...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dnsta-dns-traffic-analysis
- D3-DQSA Database Query String Analysis
A Detect defensive technique. Analyzing database queries to detect SQL Injection. Some implementations use software hooks to intercept function calls related to database query operations. Other implementations might intercept or collect...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dqsa-database-query-string-analysis
- D3-EFA Emulated File Analysis
A Detect defensive technique. Emulating instructions in a file looking for specific patterns. In the D3FEND model it analyzes the document file; analyzes the executable file. It counters ATT&CK techniques T1016, T1027.001, T1027.002,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-efa-emulated-file-analysis
- D3-EHB Endpoint Health Beacon
A defensive technique that monitors endpoint security status by sending periodic health-status messages; absence of response may indicate compromise. Counters ATT&CK T1114.002 (Remote Email Collection), T1505.002 (Transport Agent),...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ehb-endpoint-health-beacon
- D3-FA File Analysis
A Detect defensive technique. File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc. Technique Overview Some techniques use file...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fa-file-analysis
- D3-FBA Firmware Behavior Analysis
A Detect defensive technique. Analyzing the behavior of embedded code in firmware and looking for anomalous behavior and suspicious activity. Firmware behavior analysis provides protections by ensuring that installed firmware has not...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fba-firmware-behavior-analysis
- D3-FC File Carving
A Detect defensive technique. Identifying and extracting files from network application protocols through the use of network stream reassembly software. Protocol stream reassembly software recreates a directional byte stream by...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fc-file-carving
- D3-FCA File Creation Analysis
A Detect defensive technique. Analyzing the properties of file create system call invocations. In the D3FEND model it analyzes the create file. It counters ATT&CK techniques T1074.001, T1218.001. Via the Center for Threat-Informed...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fca-file-creation-analysis
- D3-FEMC Firmware Embedded Monitoring Code
A Detect defensive technique. Monitoring code is injected into firmware for integrity monitoring of firmware and firmware data. Firmware in deployed network devices is typically not monitored for malicious changes. This technique...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-femc-firmware-embedded-monitoring-code
- D3-FIM File Integrity Monitoring
A defensive technique that detects unauthorised modification of files by computing and comparing cryptographic hashes against a baseline. FIM counters ATT&CK techniques T1070 (Indicator Removal), T1027 (Obfuscated Files), T1485 (Data...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fim-file-integrity-monitoring
- D3-FV Firmware Verification
A Detect defensive technique. Cryptographically verifying firmware integrity. Cryptographic hash values are computed for system and peripheral firmware. The hash values are compared against precomputed hash values for the identified...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fv-firmware-verification
- D3-HD Homoglyph Detection
A Detect defensive technique. Comparing strings using a variety of techniques to determine if a deceptive or malicious string is being presented to a user. A homoglyph, in this context, is a deceptive string or word which looks like a...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-hd-homoglyph-detection
- D3-IAA Identifier Activity Analysis
A Detect defensive technique. Taking known malicious identifiers and determining if they are present in a system. Identifier activity analysis is the process of taking identifiers--typically known malicious identifiers--and determining...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-iaa-identifier-activity-analysis
- D3-IDA Input Device Analysis
A Detect defensive technique. Operating system level mechanisms to prevent abusive input device exploitation. Input Device Hardening techniques filter certain commands, or disable related operating system functionality. In the D3FEND...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ida-input-device-analysis
- D3-IPCTA IPC Traffic Analysis
A Detect defensive technique. Analyzing standard inter process communication (IPC) protocols to detect deviations from normal protocol activity. Inter process communication enables applications or threads to share data. This can involve...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ipcta-ipc-traffic-analysis
- D3-ISVA Inbound Session Volume Analysis
A Detect defensive technique. Analyzing inbound network session or connection attempt volume. Network appliances are configured to alert on certain packets that typically are involved in DoS attacks. Typical packets include ICMP packets...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-isva-inbound-session-volume-analysis
- D3-LAM Local Account Monitoring
A Detect defensive technique. Analyzing local user accounts to detect unauthorized activity. In the D3FEND model it analyzes the local user account. It counters ATT&CK techniques T1078.003, T1087.001, T1136.001. Via the Center for...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-lam-local-account-monitoring
- D3-MBT Memory Boundary Tracking
A Detect defensive technique. Analyzing a call stack for return addresses which point to unexpected memory locations. This technique monitors for indicators of whether a return address is outside memory previously allocated for an...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-mbt-memory-boundary-tracking
- D3-NTCD Network Traffic Community Deviation
A Detect defensive technique. Establishing baseline communities of network hosts and identifying statistically divergent inter-community communication. Hosts/users within a computer network are analyzed to identify communities of hosts...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ntcd-network-traffic-community-deviation
- D3-NTSA Network Traffic Signature Analysis
A Detect defensive technique. Analyzing network traffic and compares it to known signatures Network signature analysis relies on predefined patterns, or signatures, to identify malicious network activity. These signatures typically...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ntsa-network-traffic-signature-analysis
- D3-OPM Operational Process Monitoring
A Detect defensive technique. Monitoring physical parameters and operator actions related to an operational environment. While some Operational Technology systems are designed to operate without human intervention, most systems are...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-opm-operational-process-monitoring
- D3-PCSV Process Code Segment Verification
A Detect defensive technique. Comparing the "text" or "code" memory segments to a source of truth. A process code segment is an executable portion of computer memory allocated to a particular process. Process Code Segment Verification...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pcsv-process-code-segment-verification
- D3-PHDURA Per Host Download-Upload Ratio Analysis
A Detect defensive technique. Detecting anomalies that indicate malicious activity by comparing the amount of data downloaded versus data uploaded by a host. Aggregate pull vs. push ratios from metadata are used to develop a baseline...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-phdura-per-host-download-upload-ratio-analysis
- D3-PLA Process Lineage Analysis
A Detect defensive technique. Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pla-process-lineage-analysis
- D3-PMAD Protocol Metadata Anomaly Detection
A Detect defensive technique. Collecting network communication protocol metadata and identifying statistical outliers. Network protocol metadata is first collected and processed in real-time or post-facto. Metadata may include packet...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pmad-protocol-metadata-anomaly-detection
- D3-PSA Process Spawn Analysis
A defensive technique that analyses parent-child process relationships to identify suspicious execution chains. PSA counters ATT&CK techniques T1059 (Command and Scripting Interpreter - flags powershell.exe spawned from winword.exe),...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-psa-process-spawn-analysis
- D3-PSMD Process Self-Modification Detection
A Detect defensive technique. Detects processes that modify, change, or replace their own code at runtime. A security agent installed on the host machine intercepts API calls between a process and operating system. Intercepted API calls...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-psmd-process-self-modification-detection
- D3-RPA Relay Pattern Analysis
A Detect defensive technique. The detection of an internal host relaying traffic between the internal network and the external network. A relay may use a variety of proxying, forwarding, or routing technologies to bridge a protected...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rpa-relay-pattern-analysis
- D3-RTA RPC Traffic Analysis
A Detect defensive technique. Monitoring the activity of remote procedure calls in communication traffic to establish standard protocol operations and potential attacker activities. A remote procedure call (RPC) enables one computer to...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rta-rpc-traffic-analysis
- D3-RTSD Remote Terminal Session Detection
A Detect defensive technique. Detection of an unauthorized remote live terminal console session by examining network traffic to a network host. An external attacker takes remote control of a host inside a company or organization's...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rtsd-remote-terminal-session-detection
- D3-SBV Service Binary Verification
A Detect defensive technique. Analyzing changes in service binary files by comparing to a source of truth. System service applications may originate from the operating system installation or third-party applications installed with...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sbv-service-binary-verification
- D3-SCA System Call Analysis
A Detect defensive technique. Analyzing system calls to determine whether a process is exhibiting unauthorized behavior. System calls are APIs between a user application and the operating system [1]. By analyzing a process's use of...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sca-system-call-analysis
- D3-SDM System Daemon Monitoring
A Detect defensive technique. Tracking changes to the state or configuration of critical system level processes. Attackers may manipulate system settings or services to disable system logging or monitoring of security tools and events....
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sdm-system-daemon-monitoring
- D3-SFA System File Analysis
A Detect defensive technique. Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering. This technique ensures the integrity of system owned file...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sfa-system-file-analysis
- D3-SFV System Firmware Verification
A Detect defensive technique. Cryptographically verifying installed system firmware integrity. Cryptographic hash values are computed for system firmware. The hash values are compared against precomputed firmware hash values to...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sfv-system-firmware-verification
- D3-SICA System Init Config Analysis
A Detect defensive technique. Analysis of any system process startup configuration. In the D3FEND model it analyzes the system init configuration. It counters ATT&CK techniques T1037.004, T1037.005, T1547.001, T1562.009, T1574.011. Via...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sica-system-init-config-analysis
- D3-SJA Scheduled Job Analysis
A Detect defensive technique. Analysis of source files, processes, destination files, or destination servers associated with a scheduled job to detect unauthorized use of job scheduling. Scheduled job execution can be utilized by...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sja-scheduled-job-analysis
- D3-SMRA Sender MTA Reputation Analysis
A Detect defensive technique. Characterizing the reputation of mail transfer agents (MTA) to determine the security risk in emails. The sender message transfer agent (MTA) trust rating can be considered an indicator of the level of...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-smra-sender-mta-reputation-analysis
- D3-SRA Sender Reputation Analysis
A Detect defensive technique. Ascertaining sender reputation based on information associated with a message (e.g. email/instant messaging). Sender trust rating can be considered an indicator of the level of security risk and/or a trust...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sra-sender-reputation-analysis
- D3-SSC Shadow Stack Comparisons
A Detect defensive technique. Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity. This technique compares the call stack stored in system memory with...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ssc-shadow-stack-comparisons
- D3-UA URL Analysis
A Detect defensive technique. Determining if a URL is benign or malicious by analyzing the URL or its components. URLs may contain components, for example: scheme userinfo host name port path query fragment These components are used as...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ua-url-analysis
- D3-UGLPA User Geolocation Logon Pattern Analysis
A Detect defensive technique. Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location. Geolocation data for each user logon attempt is collected and...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-uglpa-user-geolocation-logon-pattern-analysis
- D3-URA URL Reputation Analysis
A Detect defensive technique. Analyzing the reputation of a URL. In the D3FEND model it analyzes the url. It counters ATT&CK techniques T1189, T1204.001, T1566.002, T1566.003. Via the Center for Threat-Informed Defense mapping of the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ura-url-reputation-analysis
- D3-USICA User Session Init Config Analysis
A Detect defensive technique. Analyzing modifications to user session config files such as .bashrc or .bash_profile. In the D3FEND model it analyzes the user init configuration file. It counters ATT&CK techniques T1546.004, T1564.002....
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-usica-user-session-init-config-analysis
- D3-VS Video Surveillance
A Detect defensive technique. Monitoring of physical areas via camera video feeds to deter, detect, and investigate unauthorized access and related security events. Video surveillance uses digital cameras that stream to a video...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-vs-video-surveillance
[d3f-isolate] Isolate
- D3-ABPI Application-based Process Isolation
A Isolate defensive technique. Application code which prevents its own subroutines from accessing intra-process / internal memory space. Some applications implement logic to permit or deny a particular subroutine access to other data...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-abpi-application-based-process-isolation
- D3-CF Content Filtering
A Isolate defensive technique. Content Filtering techniques aid in the process of analyzing an input file for malicious or erroneous content and outputing a sanitized version. In the D3FEND model it filters the file; enforces the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cf-content-filtering
- D3-CM Content Modification
A Isolate defensive technique. Modify content that does not comply with policy. When content is found to not comply with it's content policy, it may be transformed to a safer state by modifying it. In the D3FEND model it filters the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cm-content-modification
- D3-CQ Content Quarantine
A Isolate defensive technique. Transfer content that does not comply with policy to a quarantine zone. Quarantining serves as a protective measure to isolate potentially harmful files or elements until they can be safely analyzed or...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cq-content-quarantine
- D3-CTS Credential Transmission Scoping
A Isolate defensive technique. Limiting the transmission of a credential to a scoped set of relying parties. In the D3FEND model it isolates the credential. It counters ATT&CK techniques T1003.003, T1003.005, T1003.008, T1098.001,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cts-credential-transmission-scoping
- D3-DNSAL DNS Allowlisting
A Isolate defensive technique. Permitting only approved domains and their subdomains to be resolved. In the D3FEND model it blocks the outbound internet dns lookup traffic. It counters ATT&CK techniques T1071.004, T1568. Via the Center...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dnsal-dns-allowlisting
- D3-DNSDL DNS Denylisting
A defensive technique that blocks DNS resolution of known-malicious domains to prevent C2 communication, phishing, malware distribution, and data exfiltration. DNSDL counters ATT&CK techniques T1071.004 (DNS C2), T1568 (Dynamic...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dnsdl-dns-denylisting
- D3-DTP Domain Trust Policy
A Isolate defensive technique. Restricting inter-domain trust by modifying domain configuration. In the D3FEND model it restricts the directory service; restricts the t1087.002. It counters ATT&CK technique T1033.
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dtp-domain-trust-policy
- D3-EAL Executable Allowlisting
A Isolate defensive technique. Using a digital signature to authenticate a file before opening. This technique is generic and there are numerous ways to compute and authenticate digital signatures. A digital certificate is generated...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-eal-executable-allowlisting
- D3-EDL Executable Denylisting
A Isolate defensive technique. Blocking the execution of files on a host in accordance with defined application policy rules. Criteria A policy-enforcing application can register an application for denylisting based on conditions...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-edl-executable-denylisting
- D3-EF Email Filtering
A Isolate defensive technique. Filtering incoming email traffic based on specific criteria. Mail filters can be implemented to scan inbound email messages at the initial SMTP connection stage to detect and reject email containing spam...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ef-email-filtering
- D3-FFV File Format Verification
A Isolate defensive technique. Verifying that a file conforms to its expected format specifications In the D3FEND model it analyzes the file section. It counters ATT&CK technique T1564.009. Via the Center for Threat-Informed Defense...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ffv-file-format-verification
- D3-FRDDL Forward Resolution Domain Denylisting
A Isolate defensive technique. Blocking a lookup based on the query's domain name value. Policies are created that filter DNS queries using fully qualified domain name (FQDN) of record in the query. A DNS policy can be created for...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-frddl-forward-resolution-domain-denylisting
- D3-HBPI Hardware-based Process Isolation
A Isolate defensive technique. Preventing one process from writing to the memory space of another process through hardware based address manager implementations. Process isolation, in this context, is address space separation controlled...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-hbpi-hardware-based-process-isolation
- D3-IOPR IO Port Restriction
A Isolate defensive technique. Limiting access to computer input/output (IO) ports to restrict unauthorized devices. Software-based restriction uses agent software installed on a computer system. The agent software monitors all IO port...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-iopr-io-port-restriction
- D3-ITF Inbound Traffic Filtering
A defensive technique that filters inbound network connections based on source identifier, application protocol, and request content to block adversary access before exploitation. ITF counters ATT&CK techniques T1190 (Exploit...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-itf-inbound-traffic-filtering
- D3-KBPI Kernel-based Process Isolation
A Isolate defensive technique. Using kernel-level capabilities to isolate processes. In the D3FEND model it isolates the process. It counters ATT&CK techniques T1003.001, T1003.002, T1003.004, T1033, T1053, T1053.005, T1212, T1505.002,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-kbpi-kernel-based-process-isolation
- D3-LFP Local File Permissions
A Isolate defensive technique. Local file permissions is the systematic process of defining, implementing, and managing access control policies that dictate user permissions for accessing files on a local system through the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-lfp-local-file-permissions
- D3-NRAM Network Resource Access Mediation
A Isolate defensive technique. Control of access to organizational systems and services by users or processes over a network. Network Resource Access Control involves managing and regulating access to resources within an organization's...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-nram-network-resource-access-mediation
- D3-NTF Network Traffic Filtering
A Isolate defensive technique. Restricting network traffic originating from any location. In the D3FEND model it filters the network traffic; filters the ot protocol message; filters the remote command. It counters ATT&CK techniques...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ntf-network-traffic-filtering
- D3-OTF Outbound Traffic Filtering
A Isolate defensive technique. Restricting network traffic originating from a private host or enclave destined towards untrusted networks. Outbound traffic, in this context, is network traffic originating from a private host or enclave...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-otf-outbound-traffic-filtering
- D3-RFAM Remote File Access Mediation
A Isolate defensive technique. Remote file access mediation is the process of managing and securing access to file systems over a network to ensure that only authorized users or processes can interact with remote files. Remote File...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rfam-remote-file-access-mediation
- D3-RRID Reverse Resolution IP Denylisting
A Isolate defensive technique. Blocking a reverse lookup based on the query's IP address value. This technique prevents a client from learning domains deemed to be potentially malicious, which would have been delivered via reverse...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rrid-reverse-resolution-ip-denylisting
- D3-SCF System Call Filtering
A Isolate defensive technique. Controlling access to local computer system resources with kernel-level capabilities. System call filtering uses a mandatory access control paradigm (that is, a non-discretionary access control) system...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-scf-system-call-filtering
- D3-UAP User Account Permissions
A Isolate defensive technique. Restricting a user account's access to resources. In the D3FEND model it restricts the user account. It counters ATT&CK techniques T1078, T1078.001, T1078.002, T1078.003, T1078.004, T1087.001, T1087.002,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-uap-user-account-permissions
- D3-WSAM Web Session Access Mediation
A Isolate defensive technique. Web session access mediation secures user sessions in web applications by employing robust authentication and integrity validation, along with adaptive threat mitigation techniques, to ensure that access...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-wsam-web-session-access-mediation
[d3f-deceive] Deceive
- D3-DE Decoy Environment
A defensive technique that deploys realistic but fake systems, networks, or cloud environments to attract adversary engagement, generate threat intelligence, and detect lateral movement. Modern implementations span on-premise honeypots...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-de-decoy-environment
- D3-DF Decoy File
A defensive technique that places enticing fake files (canary tokens, decoy documents, fake credential stores, fake backup archives, fake source code) in locations where legitimate users would not access them, generating high-fidelity...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-df-decoy-file
- D3-DNR Decoy Network Resource
A defensive technique that creates fake network services (decoy DNS records, fake SSH/RDP/SMB shares, decoy web services, decoy directory listings) to detect adversary scanning, enumeration, and lateral movement attempts. DNR targets...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dnr-decoy-network-resource
- D3-DUC Decoy User Credential
A defensive technique that plants fake credentials, honey accounts, and canary tokens to detect adversary credential theft and lateral movement. DUC counters ATT&CK techniques T1003 (OS Credential Dumping), T1110 (Brute Force), T1555...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-duc-decoy-user-credential
[d3f-evict] Evict
- D3-AL Account Locking
A defensive technique that disables identity accounts after a configured number of failed authentication attempts to defeat brute force, password spray, and credential stuffing. AL counters ATT&CK techniques T1110 (Brute Force), T1078...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-al-account-locking
- D3-ANCI Authentication Cache Invalidation
A defensive technique that revokes cached credentials and active sessions to force renewed authentication. ANCI counters ATT&CK techniques T1078 (Valid Accounts), T1098 (Account Manipulation), T1550 (Use Alternate Authentication...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-anci-authentication-cache-invalidation
- D3-CR Credential Revocation
A Evict defensive technique. Deleting a set of credentials permanently to prevent them from being used to authenticate. Management servers with enterprise policies for account management provide the ability remove permissions, accounts,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cr-credential-revocation
- D3-DKE Disk Erasure
A Evict defensive technique. Disk Erasure is the process of securely deleting all data on a disk to ensure that it cannot be recovered by any means. Disk Erasure involves overwriting the existing data with random or specific patterns...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dke-disk-erasure
- D3-DKF Disk Formatting
A Evict defensive technique. Disk Formatting is the process of preparing a data storage device, such as a hard drive, solid-state drive, or USB flash drive, for initial use. This process involves setting up an empty file system on the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dkf-disk-formatting
- D3-ER Email Removal
A Evict defensive technique. The email removal technique deletes email files from system storage. Email removal is a technique that can be used to prevent a user from executing malware or responding to phishing attempts. Security...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-er-email-removal
- D3-FEV File Eviction
A Evict defensive technique. File eviction techniques delete files from system storage. Adversaries may place files or programs into a computer's file system to perform malicious actions. As part of the eviction process, these files and...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fev-file-eviction
- D3-HR Host Reboot
A Evict defensive technique. Initiating a host's reboot sequence to terminate all running processes. Host reboot can either be initiated in the physical presence of the device using the power functions or remotely using the provided...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-hr-host-reboot
- D3-HS Host Shutdown
A Evict defensive technique. Initiating a host's shutdown sequence to terminate all running processes. Host shutdown can either be initiated in the physical presence of the device using the power functions or remotely using the provided...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-hs-host-shutdown
- D3-PS Process Suspension
A Evict defensive technique. Suspending a running process on a computer system. A running process might be suspended to mitigate its immediate effects if it is exhibiting anomalous, unauthorized, or malicious behavior. Defenders may...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ps-process-suspension
- D3-PT Process Termination
A defensive technique that terminates running application processes via OS kernel APIs to stop processes exhibiting malicious or anomalous behavior. Counters ATT&CK T1053 (Scheduled Task), T1505.002/.003 (Transport Agent/Web Shell),...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pt-process-termination
- D3-RKD Registry Key Deletion
A Evict defensive technique. Delete a registry key. In the D3FEND model it deletes the windows registry key. It counters ATT&CK technique T1562.003. Via the Center for Threat-Informed Defense mapping of the countered techniques, it...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rkd-registry-key-deletion
- D3-ST Session Termination
A Evict defensive technique. Forcefully end all active sessions associated with compromised accounts or devices. In the D3FEND model it deletes the session. It counters ATT&CK techniques T1021.001, T1021.004, T1133, T1134.003, T1199,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-st-session-termination
[d3f-restore] Restore
- D3-RC Restore Configuration
A Restore defensive technique. Restoring an software configuration. In the D3FEND model it restores the configuration resource. It counters ATT&CK techniques T1037.004, T1037.005, T1114.003, T1134.005, T1137.001, T1137.002, T1137.004,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rc-restore-configuration
- D3-RD Restore Database
A Restore defensive technique. Restoring the data in a database. In the D3FEND model it restores the database. It counters ATT&CK techniques T1003.002, T1003.004, T1003.008, T1012, T1033, T1112, T1137.006, T1207, T1213.003, T1218.014,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rd-restore-database
- D3-RE Restore Email
A Restore defensive technique. Restoring an email for an entity to access. In the D3FEND model it restores the email. It counters ATT&CK techniques T1114.001, T1534, T1566.001, T1566.002. Via the Center for Threat-Informed Defense...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-re-restore-email
- D3-RF Restore File
A defensive technique that recovers individual files or directories from a known-good backup after corruption, encryption, deletion, or unauthorised modification. RF counters ATT&CK techniques T1486 (Data Encrypted for Impact -...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rf-restore-file
- D3-RIC Reissue Credential
A Restore defensive technique. Issue a new credential to a user which supercedes their old credential. In the D3FEND model it restores the credential. It counters ATT&CK techniques T1003.003, T1003.005, T1003.008, T1098.001, T1110.001,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ric-reissue-credential
- D3-RNA Restore Network Access
A Restore defensive technique. Restoring a entity's access to a computer network. In the D3FEND model it restores the host. It counters ATT&CK techniques T1114.002, T1505.002, T1505.003, T1578.002, T1578.003, T1578.004. Via the Center...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rna-restore-network-access
- D3-RS Restore Software
A Restore defensive technique. Restoring software to a host. In the D3FEND model it restores the software. It counters ATT&CK techniques T1014, T1056.003, T1072, T1127.001, T1137.006, T1176, T1195.001, T1195.002, T1212, T1218.014, and...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-rs-restore-software
- D3-RUAA Restore User Account Access
A Restore defensive technique. Restoring a user account's access to resources. In the D3FEND model it restores the user account. It counters ATT&CK techniques T1078, T1078.001, T1078.002, T1078.003, T1078.004, T1087.001, T1087.002,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ruaa-restore-user-account-access
- D3-ULA Unlock Account
A Restore defensive technique. Restoring a user account's access to resources by unlocking a locked User Account. In the D3FEND model it restores the user account. It counters ATT&CK techniques T1078, T1078.001, T1078.002, T1078.003,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ula-unlock-account
[d3f-other] Other
- D3-AI Asset Inventory
A foundational defensive technique that enumerates and tracks digital assets (hardware, software, services, accounts, data) to enable downstream defence. Without complete asset inventory, organisations cannot harden, detect, isolate, or...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ai-asset-inventory
- D3-CBA Certificate-based Authentication
A Harden defensive technique. In the D3FEND model it reads Certificate. It is part of the Agent Authentication D3FEND parent category and counters ATT&CK techniques T1649. Via the Center for Threat-Informed Defense mapping of the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-cba-certificate-based-authentication
- D3-CE Credential Eviction
A defensive technique that disables or removes compromised credentials from a computer network. Distinct from D3-CRO Credential Rotation (CE removes; CRO replaces). Counters ATT&CK T1078 (Valid Accounts) all sub-techniques, T1098...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ce-credential-eviction
- D3-DP Decoy Persona
A Evict defensive technique. In the D3FEND model it creates Partition Table. It is part of the Object Eviction D3FEND parent category and counters ATT&CK techniques T1561.002, T1561.001. Via the Center for Threat-Informed Defense...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-dp-disk-partitioning
- D3-EI Execution Isolation
A defensive technique that confines code execution to isolated boundaries (sandboxes, containers, VMs, application guard browsers, virtualization-based security) so that exploitation does not compromise the host. EI counters ATT&CK...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ei-execution-isolation
- D3-FH File Hashing
A defensive technique that uses file hash comparisons to detect known malware. Requires a database of malicious hashes to compare against environment files. Counters ATT&CK T1204 (User Execution), T1055 (Process Injection), T1547 (Boot...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-fh-file-hashing
- D3-IRA Identifier Reputation Analysis
A defensive technique that analyses the reputation of identifiers (IP addresses, file hashes, domain names, URLs) to detect malicious activity. Five sub-classes per page. Counters ATT&CK T1566.002 (Spearphishing Link), T1566.003...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ira-identifier-reputation-analysis
- D3-MENCR Message Encryption
A defensive technique that protects message content in transit using cryptography to prevent eavesdropping, tampering, and replay. MENCR covers TLS for web and API traffic, IPsec for site-to-site VPN, S/MIME and PGP for email, signed...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-mencr-message-encryption
- D3-NI Network Isolation
A defensive technique that prevents network communication between systems through segmentation, microsegmentation, and dynamic isolation. NI counters ATT&CK techniques T1021 (Remote Services), T1570 (Lateral Tool Transfer), T1210...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ni-network-isolation
- D3-NM Network Mapping
A defensive technique that enumerates and visualises network topology, segmentation boundaries, communication paths, and inter-zone trust relationships to enable network-isolation defence design and lateral-movement detection. NM is the...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-nm-network-mapping
- D3-NTA Network Traffic Analysis
A defensive technique that inspects network communications to identify malicious or unauthorised behaviour. NTA counters ATT&CK techniques T1071 (Application Layer Protocol), T1573 (Encrypted Channel), T1041 (Exfiltration Over C2...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-nta-network-traffic-analysis
- D3-OAM Operational Activity Mapping
A defensive technique that enumerates and documents legitimate operational activities - business processes, automated workflows, scheduled jobs, batch processing windows, and authorised administrative actions - to enable detection of...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-oam-operational-activity-mapping
- D3-PA Process Analysis
A Harden defensive technique. In the D3FEND model it uses Password. It is part of the Agent Authentication D3FEND parent category and counters ATT&CK techniques T1110.001, T1110.003, T1110.002. Via the Center for Threat-Informed Defense...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pa-password-authentication
- D3-PAN Pointer Authentication
A defensive technique that uses cryptographic hashes or derivatives of pointer values to detect tampering. Defends against memory corruption attacks, ROP, control-flow hijacking, code injection. Hardware implementations: ARM Pointer...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pan-pointer-authentication
- D3-PE Process Eviction
A defensive technique that forcibly terminates malicious processes from compromised systems as a containment action. PE counters post-compromise execution under ATT&CK techniques T1059 (Command and Scripting Interpreter), T1055 (Process...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-pe-process-eviction
- D3-RO Restore Object
A defensive technique that recovers system state from a known-good backup or golden image after compromise. RO counters ATT&CK techniques T1486 (Data Encrypted for Impact / ransomware), T1485 (Data Destruction / wiper), T1491...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-ro-restore-object
- D3-SCH Source Code Hardening
A defensive technique that hardens source code to make it more difficult to exploit and less error-prone. Covers safer subroutines, pointer/memory validation, mathematical operation safety. Counters ATT&CK T1505 (Server Software...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sch-source-code-hardening
- D3-SI Software Inventory
A Model defensive technique. In the D3FEND model it inventories Software. It is part of the Asset Inventory D3FEND parent category and counters ATT&CK techniques T1072, T1547.008, T1546.011, T1574.010, T1574.005, T1490, T1056.003,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-si-software-inventory
- D3-SYSM System Mapping
A defensive technique that enumerates and documents system architecture - components, interfaces, trust boundaries, software stacks, and configuration baselines - to enable hardening, vulnerability management, and detection-coverage...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-sysm-system-mapping
- D3-UBA User Behavior Analysis
A defensive technique that uses patterns of human behavior and statistical analysis to detect meaningful anomalies indicating insider threats, targeted attacks, and fraud. UBA examines user patterns (login frequency from single IPs,...
Bidda node: https://bidda.com/intelligence/mitre-d3fend-d3-uba-user-behavior-analysis
Full interactive matrix: https://bidda.com/d3fend
MITRE source: https://d3fend.mitre.org/