MITRE D3FEND

Defensive techniques mapped against ATT&CK — know how to defend

All 19 techniques Model 27 Harden 55 Detect 90 Isolate 56 Deceive 11 Evict 19 Restore 12
D3-AL Evict
Account Locking
The process of temporarily disabling user accounts on a system or domain.
Counters 6 ATT&CK
D3-ANCI Evict
Authentication Cache Invalidation
Removing tokens or credentials from an authentication cache to prevent further user associated account accesses.
Counters 10 ATT&CK
D3-CE Evict
Credential Eviction
Credential Eviction techniques disable or remove compromised credentials from a computer network.
D3-CR Evict
Credential Revocation
Deleting a set of credentials permanently to prevent them from being used to authenticate.
Counters 10 ATT&CK
D3-DNSCE Evict
DNS Cache Eviction
Flushing DNS to clear any IP addresses or other DNS records from the cache.
D3-DKE Evict
Disk Erasure
Disk Erasure is the process of securely deleting all data on a disk to ensure that it cannot be recovered by any means.
Counters 1 ATT&CK
D3-DKF Evict
Disk Formatting
Disk Formatting is the process of preparing a data storage device, such as a hard drive, solid-state drive, or USB flash drive, for initial use.
Counters 1 ATT&CK
D3-DKP Evict
Disk Partitioning
Disk Partitioning is the process of dividing a disk into multiple distinct sections, known as partitions.
Counters 1 ATT&CK
D3-DRT Evict
Domain Registration Takedown
The process of performing a takedown of the attacker's domain registration infrastructure.
D3-ER Evict
Email Removal
The email removal technique deletes email files from system storage.
Counters 4 ATT&CK
D3-FEV Evict
File Eviction
File eviction techniques delete files from system storage.
Counters 46 ATT&CK
D3-HR Evict
Host Reboot
Initiating a host's reboot sequence to terminate all running processes.
Counters 10 ATT&CK
D3-HS Evict
Host Shutdown
Initiating a host's shutdown sequence to terminate all running processes.
Counters 10 ATT&CK
D3-OE Evict
Object Eviction
Terminate or remove an object from a host machine. This is the broadest class for object eviction.
D3-PE Evict
Process Eviction
Process eviction techniques terminate or remove running process.
D3-PS Evict
Process Suspension
Suspending a running process on a computer system.
Counters 10 ATT&CK
D3-PT Evict
Process Termination
Terminating a running application process on a computer system.
Counters 10 ATT&CK
D3-RKD Evict
Registry Key Deletion
Delete a registry key.
Counters 1 ATT&CK
D3-ST Evict
Session Termination
Forcefully end all active sessions associated with compromised accounts or devices.
Counters 5 ATT&CK