-
Notifications
You must be signed in to change notification settings - Fork 293
/
Copy pathd3fend.yaml
2224 lines (1791 loc) · 77 KB
/
d3fend.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:mitre-d3fend
locale: en
ref_id: d3fend
name: Mitre D3FEND
description: 'A cybersecurity ontology designed to standardize vocabulary for employing
techniques to counter malicious cyber threats.
Version - 1.0.0 - 2024-12-20
https://d3fend.mitre.org/resources/'
copyright: "Terms of Use\nLICENSE\nThe MITRE Corporation (MITRE) hereby grants you\
\ a non-exclusive, royalty-free license to use D3FEND for research, development,\
\ and commercial purposes. Any copy you make for such purposes is authorized provided\
\ that you reproduce MITRE\u2019s copyright designation and this license in any\
\ such copy.\nDISCLAIMERS\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE\
\ PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS\
\ OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\
\ AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING\
\ BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT\
\ INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR\
\ A PARTICULAR PURPOSE.\n"
version: 1
publication_date: '2025-01-22'
provider: Mitre D3FEND
packager: intuitem
objects:
reference_controls:
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-om
ref_id: D3-OM
name: Organization Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Organization Mapping
definition: Organization mapping identifies and models the people, roles, and
groups with an organization and the relations between them.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ora
ref_id: D3-ORA
name: Operational Risk Assessment
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Operational Risk Assessment
definition: Operational risk assessment identifies and models the vulnerabilities
of, and risks to, an organization''s activities individually and as a whole.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-odm
ref_id: D3-ODM
name: Operational Dependency Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Operational Dependency Mapping
definition: Operational dependency mapping identifies and models the dependencies
of the organization''s activities on each other and on the organization''s performers
(people, systems, and services.) This may include modeling the higher- and
lower-level activities of an organization forming a hierarchy, or layering,
of the dependencies in an organization''s activities.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-am
ref_id: D3-AM
name: Access Modeling
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Access Modeling
definition: Access modeling identifies and records the access permissions granted
to administrators, users, groups, and systems.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-plm
ref_id: D3-PLM
name: Physical Link Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Physical Link Mapping
definition: Physical link mapping identifies and models the link connectivity
of the network devices within a physical network.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dplm
ref_id: D3-DPLM
name: Direct Physical Link Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Physical Link Mapping
technique level 2: Direct Physical Link Mapping
definition: Direct physical link mapping creates a physical link map by direct
observation and recording of the physical network links.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-aplm
ref_id: D3-APLM
name: Active Physical Link Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Physical Link Mapping
technique level 2: Active Physical Link Mapping
definition: Active physical link mapping sends and receives network traffic
as a means to map the physical layer.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-nva
ref_id: D3-NVA
name: Network Vulnerability Assessment
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Network Vulnerability Assessment
definition: Network vulnerability assessment relates all the vulnerabilities
of a network''s components in the context of their configuration and interdependencies
and can also include assessing risk emerging from the network''s design as a
whole, not just the sum of individual network node or network segment vulnerabilities.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ntpm
ref_id: D3-NTPM
name: Network Traffic Policy Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Network Traffic Policy Mapping
definition: Network traffic policy mapping identifies and models the allowed
pathways of data at the network, tranport, and/or application levels.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-llm
ref_id: D3-LLM
name: Logical Link Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Logical Link Mapping
definition: Logical link mapping creates a model of existing or previous node-to-node
connections using network-layer data or metadata.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pllm
ref_id: D3-PLLM
name: Passive Logical Link Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Logical Link Mapping
technique level 2: Passive Logical Link Mapping
definition: Passive logical link mapping only listens to network traffic as
a means to map the the whole data link layer, where the links represent logical
data flows rather than physical connections.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-allm
ref_id: D3-ALLM
name: Active Logical Link Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Logical Link Mapping
technique level 2: Active Logical Link Mapping
definition: Active logical link mapping sends and receives network traffic as
a means to map the whole data link layer, where the links represent logical
data flows rather than physical connection'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-swi
ref_id: D3-SWI
name: Software Inventory
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Software Inventory
definition: Software inventorying identifies and records the software items
in the organization''s architecture.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-nni
ref_id: D3-NNI
name: Network Node Inventory
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Network Node Inventory
definition: Network node inventorying identifies and records all the network
nodes (hosts, routers, switches, firewalls, etc.) in the organization''s architecture.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-hci
ref_id: D3-HCI
name: Hardware Component Inventory
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Hardware Component Inventory
definition: Hardware component inventorying identifies and records the hardware
items in the organization''s architecture.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-di
ref_id: D3-DI
name: Data Inventory
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Data Inventory
definition: Data inventorying identifies and records the schemas, formats, volumes,
and locations of data stored and used on the organization''s architecture.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ci
ref_id: D3-CI
name: Configuration Inventory
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Configuration Inventory
definition: Configuration inventory identifies and records the configuration
of software and hardware and their components throughout the organization.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ave
ref_id: D3-AVE
name: Asset Vulnerability Enumeration
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Asset Vulnerability Enumeration
definition: Asset vulnerability enumeration enriches inventory items with knowledge
identifying their vulnerabilities.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cia
ref_id: D3-CIA
name: Container Image Analysis
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Asset Vulnerability Enumeration
technique level 2: Container Image Analysis
definition: Analyzing a Container Image with respect to a set of policies.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-sysva
ref_id: D3-SYSVA
name: System Vulnerability Assessment
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: System Vulnerability Assessment
definition: System vulnerability assessment relates all the vulnerabilities
of a system''s components in the context of their configuration and internal
dependencies and can also include assessing risk emerging from the system''s
design as a whole, not just the sum of individual component vulnerabilities.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-sysdm
ref_id: D3-SYSDM
name: System Dependency Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: System Dependency Mapping
definition: System dependency mapping identifies and models the dependencies
of system components on each other to carry out their function.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-svcdm
ref_id: D3-SVCDM
name: Service Dependency Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Service Dependency Mapping
definition: Service dependency mapping determines the services on which each
given service relies.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dem
ref_id: D3-DEM
name: Data Exchange Mapping
category: technical
csf_function: identify
description: 'tactic: Model
technique level 1: Data Exchange Mapping
definition: Data exchange mapping identifies and models the organization''s
intended design for the flows of the data types, formats, and volumes between
systems at the application layer.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-vtv
ref_id: D3-VTV
name: Variable Type Validation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Variable Type Validation
definition: Ensuring that a variable has the correct type.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-vi
ref_id: D3-VI
name: Variable Initialization
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Variable Initialization
definition: Setting variables to a known value before use.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-tl
ref_id: D3-TL
name: Trusted Library
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Trusted Library
definition: A trusted library is a collection of pre-verified and secure code
modules or components that are used within software applications to perform
specific functions. These libraries are considered reliable and have been vetted
for security vulnerabilities, ensuring they do not introduce risks into the
application.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-rn
ref_id: D3-RN
name: Reference Nullification
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Reference Nullification
definition: Invalidating all pointers that reference a specific memory block,
ensuring that the block cannot be accessed or modified after deallocation.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pv
ref_id: D3-PV
name: Pointer Validation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Pointer Validation
definition: Ensuring that a pointer variable has the required properties for
use.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-npc
ref_id: D3-NPC
name: Null Pointer Checking
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Pointer Validation
technique level 2: Null Pointer Checking
definition: Checking if a pointer is NULL.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-mbsv
ref_id: D3-MBSV
name: Memory Block Start Validation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Pointer Validation
technique level 2: Memory Block Start Validation
definition: Ensuring that a pointer accurately references the beginning of a
designated memory block.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-irv
ref_id: D3-IRV
name: Integer Range Validation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Integer Range Validation
definition: Ensuring that an integer is within a valid range.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cs
ref_id: D3-CS
name: Credential Scrubbing
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Credential Scrubbing
definition: The systematic removal of hard-coded credentials from source code
to prevent accidental exposure and unauthorized access.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-tba
ref_id: D3-TBA
name: Token-based Authentication
category: technical
csf_function: protect
description: "tactic: Harden\ntechnique level 1: Token-based Authentication\n\
definition: Token-based authentication is an authentication protocol where users\
\ verify their identity in exchange for a\_unique access token. Users can then\
\ access the website, application, or resource for the life of the token without\
\ having to re-enter their credentials."
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pwa
ref_id: D3-PWA
name: Password Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Password Authentication
definition: Password authentication is a security mechanism used to verify the
identity of a user or entity attempting to access a system or resource by requiring
the input of a secret string of characters, known as a password, that is associated
with the user or entity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-mfa
ref_id: D3-MFA
name: Multi-factor Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Multi-factor Authentication
definition: Requiring proof of two or more pieces of evidence in order to authenticate
a user.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cban
ref_id: D3-CBAN
name: Certificate-based Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Certificate-based Authentication
definition: Requiring a digital certificate in order to authenticate a user.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ban
ref_id: D3-BAN
name: Biometric Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Biometric Authentication
definition: Using biological measures in order to authenticate a user.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-taan
ref_id: D3-TAAN
name: Transfer Agent Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Transfer Agent Authentication
definition: Validating that server components of a messaging infrastructure
are authorized to send a particular message.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-mencr
ref_id: D3-MENCR
name: Message Encryption
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Message Encryption
definition: Encrypting a message body using a cryptographic key.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-man
ref_id: D3-MAN
name: Message Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Message Authentication
definition: Authenticating the sender of a message and ensuring message integrity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-tb
ref_id: D3-TB
name: Token Binding
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Token Binding
definition: Token binding is a security mechanism used to enhance the protection
of tokens, such as cookies or OAuth tokens, by binding them to a specific connection.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-spp
ref_id: D3-SPP
name: Strong Password Policy
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Strong Password Policy
definition: Modifying system configuration to increase password strength.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cro
ref_id: D3-CRO
name: Credential Rotation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Credential Rotation
definition: Credential rotation is a security procedure in which authentication
credentials, such as passwords, API keys, or certificates, are regularly changed
or replaced to minimize the risk of unauthorized access.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pr
ref_id: D3-PR
name: Password Rotation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Credential Rotation
technique level 2: Password Rotation
definition: Password rotation is a security policy that mandates the periodic
change of user account passwords to mitigate the risk of unauthorized access
due to compromised credentials.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-otp
ref_id: D3-OTP
name: One-time Password
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Credential Rotation
technique level 2: One-time Password
definition: A one-time password is valid for only one user authentication.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cero
ref_id: D3-CERO
name: Certificate Rotation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Credential Rotation
technique level 2: Certificate Rotation
definition: Certificate rotation involves replacing digital certificates and
their private keys to maintain cryptographic integrity and trust, mitigating
key compromise risks and ensuring continuous secure communications.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cp
ref_id: D3-CP
name: Certificate Pinning
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Certificate Pinning
definition: Persisting either a server''s X.509 certificate or their public
key and comparing that to server''s presented identity to allow for greater
client confidence in the remote server''s identity for SSL connections.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dencr
ref_id: D3-DENCR
name: Disk Encryption
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Disk Encryption
definition: Encrypting a hard disk partition to prevent cleartext access to
a file system.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-tbi
ref_id: D3-TBI
name: TPM Boot Integrity
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: TPM Boot Integrity
definition: Assuring the integrity of a platform by demonstrating that the boot
process starts from a trusted combination of hardware and software and continues
until the operating system has fully booted and applications are running. Sometimes
called Static Root of Trust Measurement (STRM).'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-rfs
ref_id: D3-RFS
name: RF Shielding
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: RF Shielding
definition: Adding physical barriers to a platform to prevent undesired radio
interference.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ba
ref_id: D3-BA
name: Bootloader Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Bootloader Authentication
definition: Cryptographically authenticating the bootloader software before
system boot.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-scp
ref_id: D3-SCP
name: System Configuration Permissions
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: System Configuration Permissions
definition: Restricting system configuration modifications to a specific user
or group of users.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-fe
ref_id: D3-FE
name: File Encryption
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: File Encryption
definition: Encrypting a file using a cryptographic key.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-su
ref_id: D3-SU
name: Software Update
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Software Update
definition: Replacing old software on a computer system component.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dlic
ref_id: D3-DLIC
name: Driver Load Integrity Checking
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Driver Load Integrity Checking
definition: Ensuring the integrity of drivers loaded during initialization of
the operating system.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-sfcv
ref_id: D3-SFCV
name: Stack Frame Canary Validation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Stack Frame Canary Validation
definition: Comparing a value stored in a stack frame with a known good value
in order to prevent or detect a memory segment overwrite.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-saor
ref_id: D3-SAOR
name: Segment Address Offset Randomization
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Segment Address Offset Randomization
definition: Randomizing the base (start) address of one or more segments of
memory during the initialization of a process.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-psep
ref_id: D3-PSEP
name: Process Segment Execution Prevention
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Process Segment Execution Prevention
definition: Preventing execution of any address in a memory region other than
the code segment.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pan
ref_id: D3-PAN
name: Pointer Authentication
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Pointer Authentication
definition: Comparing the cryptographic hash or derivative of a pointer''s value
to an expected value.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ehpv
ref_id: D3-EHPV
name: Exception Handler Pointer Validation
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Exception Handler Pointer Validation
definition: Validates that a referenced exception handler pointer is a valid
exception handler.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dce
ref_id: D3-DCE
name: Dead Code Elimination
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Dead Code Elimination
definition: Removing unreachable or "dead code" from compiled source code.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ach
ref_id: D3-ACH
name: Application Configuration Hardening
category: technical
csf_function: protect
description: 'tactic: Harden
technique level 1: Application Configuration Hardening
definition: Modifying an application''s configuration to reduce its attack surface.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-rta
ref_id: D3-RTA
name: RPC Traffic Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: RPC Traffic Analysis
definition: Monitoring the activity of remote procedure calls in communication
traffic to establish standard protocol operations and potential attacker activities.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ipcta
ref_id: D3-IPCTA
name: IPC Traffic Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: IPC Traffic Analysis
definition: Analyzing standard inter process communication (IPC) protocols to
detect deviations from normal protocol activity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-rtsd
ref_id: D3-RTSD
name: Remote Terminal Session Detection
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Remote Terminal Session Detection
definition: Detection of an unauthorized remote live terminal console session
by examining network traffic to a network host.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-rpa
ref_id: D3-RPA
name: Relay Pattern Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Relay Pattern Analysis
definition: The detection of an internal host relaying traffic between the internal
network and the external network.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pmad
ref_id: D3-PMAD
name: Protocol Metadata Anomaly Detection
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Protocol Metadata Anomaly Detection
definition: Collecting network communication protocol metadata and identifying
statistical outliers.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-phdura
ref_id: D3-PHDURA
name: Per Host Download-Upload Ratio Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Per Host Download-Upload Ratio Analysis
definition: Detecting anomalies that indicate malicious activity by comparing
the amount of data downloaded versus data uploaded by a host.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dnsta
ref_id: D3-DNSTA
name: DNS Traffic Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: DNS Traffic Analysis
definition: Analysis of domain name metadata, including name and DNS records,
to determine whether the domain is likely to resolve to an undesirable host.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-fc
ref_id: D3-FC
name: File Carving
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: File Carving
definition: Identifying and extracting files from network application protocols
through the use of network stream reassembly software.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-isva
ref_id: D3-ISVA
name: Inbound Session Volume Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Inbound Session Volume Analysis
definition: Analyzing inbound network session or connection attempt volume.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ntcd
ref_id: D3-NTCD
name: Network Traffic Community Deviation
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Network Traffic Community Deviation
definition: Establishing baseline communities of network hosts and identifying
statistically divergent inter-community communication.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-cspp
ref_id: D3-CSPP
name: Client-server Payload Profiling
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Client-server Payload Profiling
definition: Comparing client-server request and response payloads to a baseline
profile to identify outliers.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-anaa
ref_id: D3-ANAA
name: Administrative Network Activity Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Administrative Network Activity Analysis
definition: Detection of unauthorized use of administrative network protocols
by analyzing network activity against a baseline.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-caa
ref_id: D3-CAA
name: Connection Attempt Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Connection Attempt Analysis
definition: Analyzing failed connections in a network to detect unauthorized
activity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ntsa
ref_id: D3-NTSA
name: Network Traffic Signature Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Network Traffic Signature Analysis
definition: Analyzing network traffic and compares it to known signatures'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-bse
ref_id: D3-BSE
name: Byte Sequence Emulation
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Byte Sequence Emulation
definition: Analyzing sequences of bytes and determining if they likely represent
malicious shellcode.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ca
ref_id: D3-CA
name: Certificate Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Certificate Analysis
definition: Analyzing Public Key Infrastructure certificates to detect if they
have been misconfigured or spoofed using both network traffic, certificate fields
and third-party logs.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-pca
ref_id: D3-PCA
name: Passive Certificate Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Certificate Analysis
technique level 2: Passive Certificate Analysis
definition: Collecting host certificates from network traffic or other passive
sources like a certificate transparency log and analyzing them for unauthorized
activity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-aca
ref_id: D3-ACA
name: Active Certificate Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Certificate Analysis
technique level 2: Active Certificate Analysis
definition: Actively collecting PKI certificates by connecting to the server
and downloading its server certificates for analysis.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-sra
ref_id: D3-SRA
name: Sender Reputation Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Sender Reputation Analysis
definition: Ascertaining sender reputation based on information associated with
a message (e.g. email/instant messaging).'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-smra
ref_id: D3-SMRA
name: Sender MTA Reputation Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Sender MTA Reputation Analysis
definition: Characterizing the reputation of mail transfer agents (MTA) to determine
the security risk in emails.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-fapa
ref_id: D3-FAPA
name: File Access Pattern Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: File Access Pattern Analysis
definition: Analyzing the files accessed by a process to identify unauthorized
activity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-dqsa
ref_id: D3-DQSA
name: Database Query String Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Database Query String Analysis
definition: Analyzing database queries to detect [SQL Injection](https://capec.mitre.org/data/definitions/66.html).'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-ssc
ref_id: D3-SSC
name: Shadow Stack Comparisons
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Shadow Stack Comparisons
definition: Comparing a call stack in system memory with a shadow call stack
maintained by the processor to determine unauthorized shellcode activity.'
- urn: urn:intuitem:risk:reference-controls:mitre-d3fend:d3-sea
ref_id: D3-SEA
name: Script Execution Analysis
category: technical
csf_function: detect
description: 'tactic: Detect
technique level 1: Script Execution Analysis
definition: Analyzing the execution of a script to detect unauthorized user