271 defences2,023 crosswalks
D3FENDD3FEND defensive matrix
7 tactics · 271 defensive techniques · 2,023 defends_against crosswalks to MITRE ATT&CK. Authored by Adam Lundqvist.
ATT&CK coverage
0
1
2-3
4-5
6+
MODModel0 techniques
HARHarden0 techniques
DETDetect0 techniques
ISOIsolate31 techniques
D3-AMED
D3-AMED Access Mediation
Counters 166 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-APA
D3-APA Access Policy Administration
Counters 117 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CF
D3-CF Content Filtering
Counters 113 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-NRAM
D3-NRAM Network Resource Access Mediation
Counters 113 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CQ
D3-CQ Content Quarantine
Counters 112 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CV
D3-CV Content Validation
Counters 100 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-LFP
D3-LFP Local File Permissions
Counters 100 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CM
D3-CM Content Modification
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-NI
D3-NI Network Isolation
Counters 74 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-NTF
D3-NTF Network Traffic Filtering
Counters 74 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EI
D3-EI Execution Isolation
Counters 62 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-SCF
D3-SCF System Call Filtering
Counters 52 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EAL
D3-EAL Executable Allowlisting
Counters 51 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EDL
D3-EDL Executable Denylisting
Counters 51 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-HBPI
D3-HBPI Hardware-based Process Isolation
Counters 36 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CTS
D3-CTS Credential Transmission Scoping
Counters 19 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-UAP
D3-UAP User Account Permissions
Counters 17 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-ABPI
D3-ABPI Application-based Process Isolation
Counters 15 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-KBPI
D3-KBPI Kernel-based Process Isolation
Counters 14 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-IOPR
D3-IOPR IO Port Restriction
Counters 7 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-DNSAL
D3-DNSAL DNS Allowlisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-DNSDL
D3-DNSDL DNS Denylisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-DTP
D3-DTP Domain Trust Policy
Counters 1 ATT&CK technique
Tactic: Isolate · Level: technique · Click to inspect
D3-BDI
D3-BDI Broadcast Domain Isolation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-DNL
D3-DNL Directional Network Link
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-ET
D3-ET Encrypted Tunnels
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-NAM
D3-NAM Network Access Mediation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-OPR
D3-OPR Operating Mode Restriction
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-OVAR
D3-OVAR OT Variable Access Restriction
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-PAM
D3-PAM Physical Access Mediation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3F-UGPH
D3F-UGPH User Group Permissions
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
DECDeceive11 techniques
D3-DO
D3-DO Decoy Object
Counters 124 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
D3-DF
D3-DF Decoy File
Counters 99 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
D3-DUC
D3-DUC Decoy User Credential
Counters 19 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
D3-DNR
D3-DNR Decoy Network Resource
Counters 8 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
D3-CHN
D3-CHN Connected Honeynet
Counters 1 ATT&CK technique
Tactic: Deceive · Level: technique · Click to inspect
D3-DE
D3-DE Decoy Environment
Counters 1 ATT&CK technique
Tactic: Deceive · Level: technique · Click to inspect
D3-IHN
D3-IHN Integrated Honeynet
Counters 1 ATT&CK technique
Tactic: Deceive · Level: technique · Click to inspect
D3-SHN
D3-SHN Standalone Honeynet
Counters 1 ATT&CK technique
Tactic: Deceive · Level: technique · Click to inspect
D3-DP
D3-DP Decoy Persona
Counters 0 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
D3-DPR
D3-DPR Decoy Public Release
Counters 0 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
D3-DST
D3-DST Decoy Session Token
Counters 0 ATT&CK techniques
Tactic: Deceive · Level: technique · Click to inspect
EVIEvict15 techniques
D3-OE
D3-OE Object Eviction
Counters 104 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-FEV
D3-FEV File Eviction
Counters 101 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-CE
D3-CE Credential Eviction
Counters 36 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-PE
D3-PE Process Eviction
Counters 22 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-ANCI
D3-ANCI Authentication Cache Invalidation
Counters 19 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-CR
D3-CR Credential Revocation
Counters 19 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-AL
D3-AL Account Locking
Counters 17 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-HS
D3-HS Host Shutdown
Counters 14 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-PS
D3-PS Process Suspension
Counters 14 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-PT
D3-PT Process Termination
Counters 14 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-ST
D3-ST Session Termination
Counters 8 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-DKF
D3-DKF Disk Formatting
Counters 3 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-RKD
D3-RKD Registry Key Deletion
Counters 1 ATT&CK technique
Tactic: Evict · Level: technique · Click to inspect
D3-DNSCE
D3-DNSCE DNS Cache Eviction
Counters 0 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-DRT
D3-DRT Domain Registration Takedown
Counters 0 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect