271 defences4,160 crosswalks
D3FENDD3FEND defensive matrix
7 tactics · 271 defensive techniques · 4,160 defends_against crosswalks to MITRE ATT&CK. Authored by Adam Lundqvist.
ATT&CK coverage
0
1
2-3
4-5
6+
MODModel0 techniques
HARHarden55 techniques
D3-PH
D3-PH Platform Hardening
Counters 138 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-FE
D3-FE File Encryption
Counters 99 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-AA
D3-AA Agent Authentication
Counters 37 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-CH
D3-CH Credential Hardening
Counters 37 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-MFA
D3-MFA Multi-factor Authentication
Counters 36 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-SU
D3-SU Software Update
Counters 25 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-TBA
D3-TBA Token-based Authentication
Counters 24 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-CDP
D3-CDP Change Default Password
Counters 20 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-CERO
D3-CERO Certificate Rotation
Counters 20 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-CRO
D3-CRO Credential Rotation
Counters 20 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-PWA
D3-PWA Password Authentication
Counters 20 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-SPP
D3-SPP Strong Password Policy
Counters 20 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-OTP
D3-OTP One-time Password
Counters 19 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-PR
D3-PR Password Rotation
Counters 19 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-TB
D3-TB Token Binding
Counters 19 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-CBAN
D3-CBAN Certificate-based Authentication
Counters 18 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-BAN
D3-BAN Biometric Authentication
Counters 17 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-AH
D3-AH Application Hardening
Counters 16 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-SCP
D3-SCP System Configuration Permissions
Counters 13 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-PSEP
D3-PSEP Process Segment Execution Prevention
Counters 12 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-SAOR
D3-SAOR Segment Address Offset Randomization
Counters 12 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-EMH
D3-EMH Electromagnetic Radiation Hardening
Counters 11 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-RFS
D3-RFS RF Shielding
Counters 11 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-RH
D3-RH Radiation Hardening
Counters 11 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-SFCV
D3-SFCV Stack Frame Canary Validation
Counters 5 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-ACH
D3-ACH Application Configuration Hardening
Counters 4 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-DRA
D3-DRA Disable Remote Access
Counters 4 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-DENCR
D3-DENCR Disk Encryption
Counters 2 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-BA
D3-BA Bootloader Authentication
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-CP
D3-CP Certificate Pinning
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-CS
D3-CS Credential Scrubbing
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-DLV
D3-DLV Domain Logic Validation
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-HBWP
D3-HBWP Hardware-based Write Protection
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-SCH
D3-SCH Source Code Hardening
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-TL
D3-TL Trusted Library
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-VI
D3-VI Variable Initialization
Counters 1 ATT&CK technique
Tactic: Harden · Level: technique · Click to inspect
D3-BMA
D3-BMA Bus Message Authentication
Counters 0 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-CFI
D3-CFI Control Flow Integrity
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-DCE
D3-DCE Dead Code Elimination
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-DLIC
D3-DLIC Driver Load Integrity Checking
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-EHPV
D3-EHPV Exception Handler Pointer Validation
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-IRV
D3-IRV Integer Range Validation
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-MAN
D3-MAN Message Authentication
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-MBSV
D3-MBSV Memory Block Start Validation
Counters 0 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-MENCR
D3-MENCR Message Encryption
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-MH
D3-MH Message Hardening
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-NPC
D3-NPC Null Pointer Checking
Counters 0 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-OLV
D3-OLV Operational Logic Validation
Counters 0 ATT&CK techniques
Tactic: Harden · Level: subtechnique · Click to inspect
D3-PAN
D3-PAN Pointer Authentication
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-PEH
D3-PEH Physical Enclosure Hardening
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-PV
D3-PV Pointer Validation
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-RN
D3-RN Reference Nullification
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-TAAN
D3-TAAN Transfer Agent Authentication
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-TBI
D3-TBI TPM Boot Integrity
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
D3-VTV
D3-VTV Variable Type Validation
Counters 0 ATT&CK techniques
Tactic: Harden · Level: technique · Click to inspect
DETDetect0 techniques
ISOIsolate57 techniques
D3-AMED
D3-AMED Access Mediation
Counters 166 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-APA
D3-APA Access Policy Administration
Counters 117 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CF
D3-CF Content Filtering
Counters 113 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-NRAM
D3-NRAM Network Resource Access Mediation
Counters 113 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CQ
D3-CQ Content Quarantine
Counters 112 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CV
D3-CV Content Validation
Counters 100 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-FFV
D3-FFV File Format Verification
Counters 100 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-LFP
D3-LFP Local File Permissions
Counters 100 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CFC
D3-CFC Content Format Conversion
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-CM
D3-CM Content Modification
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-CNE
D3-CNE Content Excision
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-CNR
D3-CNR Content Rebuild
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-CNS
D3-CNS Content Substitution
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-FCDC
D3-FCDC File Content Decompression Checking
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-FISV
D3-FISV File Internal Structure Verification
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-FMBV
D3-FMBV File Magic Byte Verification
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-FMCV
D3-FMCV File Metadata Consistency Validation
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-FMVV
D3-FMVV File Metadata Value Verification
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-RFAM
D3-RFAM Remote File Access Mediation
Counters 99 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-NI
D3-NI Network Isolation
Counters 74 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-NTF
D3-NTF Network Traffic Filtering
Counters 74 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EI
D3-EI Execution Isolation
Counters 62 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-SCF
D3-SCF System Call Filtering
Counters 52 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EAL
D3-EAL Executable Allowlisting
Counters 51 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EDL
D3-EDL Executable Denylisting
Counters 51 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-HBPI
D3-HBPI Hardware-based Process Isolation
Counters 36 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-OTF
D3-OTF Outbound Traffic Filtering
Counters 31 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-CTS
D3-CTS Credential Transmission Scoping
Counters 19 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-UAP
D3-UAP User Account Permissions
Counters 17 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EBWSAM
D3-EBWSAM Endpoint-based Web Server Access Mediation
Counters 16 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-PBWSAM
D3-PBWSAM Proxy-based Web Server Access Mediation
Counters 16 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-ABPI
D3-ABPI Application-based Process Isolation
Counters 15 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-KBPI
D3-KBPI Kernel-based Process Isolation
Counters 14 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-LFAM
D3-LFAM Local File Access Mediation
Counters 14 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-ITF
D3-ITF Inbound Traffic Filtering
Counters 8 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-WSAM
D3-WSAM Web Session Access Mediation
Counters 8 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-IOPR
D3-IOPR IO Port Restriction
Counters 7 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EF
D3-EF Email Filtering
Counters 4 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-DNSAL
D3-DNSAL DNS Allowlisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-DNSDL
D3-DNSDL DNS Denylisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-FRDDL
D3-FRDDL Forward Resolution Domain Denylisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-HDDL
D3-HDDL Hierarchical Domain Denylisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-HDL
D3-HDL Homoglyph Denylisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-RRID
D3-RRID Reverse Resolution IP Denylisting
Counters 2 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-DTP
D3-DTP Domain Trust Policy
Counters 1 ATT&CK technique
Tactic: Isolate · Level: technique · Click to inspect
D3-BDI
D3-BDI Broadcast Domain Isolation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-DNL
D3-DNL Directional Network Link
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-EPL
D3-EPL Physical Locking
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-ET
D3-ET Encrypted Tunnels
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-FRIDL
D3-FRIDL Forward Resolution IP Denylisting
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-LAMED
D3-LAMED LAN Access Mediation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3-NAM
D3-NAM Network Access Mediation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-OPR
D3-OPR Operating Mode Restriction
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-OVAR
D3-OVAR OT Variable Access Restriction
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-PAM
D3-PAM Physical Access Mediation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
D3-RAM
D3-RAM Routing Access Mediation
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: subtechnique · Click to inspect
D3F-UGPH
D3F-UGPH User Group Permissions
Counters 0 ATT&CK techniques
Tactic: Isolate · Level: technique · Click to inspect
DECDeceive0 techniques
EVIEvict19 techniques
D3-OE
D3-OE Object Eviction
Counters 104 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-FEV
D3-FEV File Eviction
Counters 101 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-CE
D3-CE Credential Eviction
Counters 36 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-PE
D3-PE Process Eviction
Counters 22 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-ANCI
D3-ANCI Authentication Cache Invalidation
Counters 19 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-CR
D3-CR Credential Revocation
Counters 19 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-AL
D3-AL Account Locking
Counters 17 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-HR
D3-HR Host Reboot
Counters 14 ATT&CK techniques
Tactic: Evict · Level: subtechnique · Click to inspect
D3-HS
D3-HS Host Shutdown
Counters 14 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-PS
D3-PS Process Suspension
Counters 14 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-PT
D3-PT Process Termination
Counters 14 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-ST
D3-ST Session Termination
Counters 8 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-ER
D3-ER Email Removal
Counters 6 ATT&CK techniques
Tactic: Evict · Level: subtechnique · Click to inspect
D3-DKF
D3-DKF Disk Formatting
Counters 3 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-DKP
D3-DKP Disk Partitioning
Counters 3 ATT&CK techniques
Tactic: Evict · Level: subtechnique · Click to inspect
D3-DKE
D3-DKE Disk Erasure
Counters 1 ATT&CK technique
Tactic: Evict · Level: subtechnique · Click to inspect
D3-RKD
D3-RKD Registry Key Deletion
Counters 1 ATT&CK technique
Tactic: Evict · Level: technique · Click to inspect
D3-DNSCE
D3-DNSCE DNS Cache Eviction
Counters 0 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
D3-DRT
D3-DRT Domain Registration Takedown
Counters 0 ATT&CK techniques
Tactic: Evict · Level: technique · Click to inspect
RESRestore12 techniques
D3-RO
D3-RO Restore Object
Counters 171 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RF
D3-RF Restore File
Counters 99 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RC
D3-RC Restore Configuration
Counters 53 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RA
D3-RA Restore Access
Counters 42 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RS
D3-RS Restore Software
Counters 25 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RD
D3-RD Restore Database
Counters 22 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RIC
D3-RIC Reissue Credential
Counters 19 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RUAA
D3-RUAA Restore User Account Access
Counters 17 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-ULA
D3-ULA Unlock Account
Counters 17 ATT&CK techniques
Tactic: Restore · Level: subtechnique · Click to inspect
D3-RNA
D3-RNA Restore Network Access
Counters 6 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect
D3-RE
D3-RE Restore Email
Counters 4 ATT&CK techniques
Tactic: Restore · Level: subtechnique · Click to inspect
D3-RDI
D3-RDI Restore Disk Image
Counters 0 ATT&CK techniques
Tactic: Restore · Level: technique · Click to inspect