D3FEND 技术详情

D3-NTF

Network Traffic Filtering

隔离

定义

Restricting network traffic originating from any location.

父技术

D3-NINetwork Isolation

子技术

D3-ITFInbound Traffic Filtering D3-OTFOutbound Traffic Filtering

关联构件

NetworkTraffic

Network Traffic

Network traffic or data traffic is the data, or alternatively the amount of data, moving across a network at a given point of time. Network data in computer networks is mostly encapsulated in network packets, which provide the load in the network.

OTProtocolMessage

OT Protocol Message

Packets generated by an operational technology protocol contain an OT protocol message.

RemoteCommand

Remote Command

A remote command is an instruction or set of instructions issued from a geographically or logically distant location to control, configure, or elicit a response from a target system, device, or entity. The execution of a remote command does not require direct physical interaction with the target; instead, it relies on a communication link to transmit the instruction and receive any resulting feedback or data.

语义关系

出向filtersNetwork Traffic

出向filtersOT Protocol Message

出向filtersRemote Command

出向kb referenceReference - Active firewall system and methodology - McAfee LLC

出向kb referenceReference - Automatically generating rules for connection security - Microsoft

出向kb referenceReference - FWTK - Firewall Toolkit

出向kb referenceReference - Firewall for interent access - Secure Computing LLC

出向kb referenceReference - Firewall for processing a connectionless network packet - National Security Agency

出向kb referenceReference - Firewall for processing connection-oriented and connectionless datagrams over a connection-oriented network - National Security Agency

出向kb referenceReference - Firewalls that filter based upon protocol commands - Intel Corp

出向kb referenceReference - Method for controlling computer network security - Checkpoint Software Technologies Ltd

出向kb referenceReference - Network firewall with proxy - Secure Computing LLC

关联 ATT&CK

119

EX-0001.01Command Packets

Isolate · Network Isolation

OT Protocol Message produces OT Protocol Message · filters

EX-0005.02Malicious Use of Hardware Commands

Isolate · Network Isolation

OT Modify Device Configuration Command produces OT Protocol Message · filters

EX-0013.01Valid Commands

Isolate · Network Isolation

OT Protocol Message produces OT Protocol Message · filters

T0800Activate Firmware Update Mode

Isolate · Network Isolation

OT Device Firmware Command produces OT Protocol Message · filters

T0801Monitor Process State

Isolate · Network Isolation

OT Read Command produces OT Protocol Message · filters

T0802Automated Collection

Isolate · Network Isolation

OT Control Command produces OT Protocol Message · filters

T0803Block Command Message

Isolate · Network Isolation

OT Device Configuration Command blocks OT Protocol Message · filters

T0805Block Serial COM

Isolate · Network Isolation

OT Protocol Message blocks OT Protocol Message · filters

T0806Brute Force I/O

Isolate · Network Isolation

OT Change Data Command produces OT Protocol Message · filters

T0809Data Destruction

Isolate · Network Isolation

OT Delete Data Command produces OT Protocol Message · filters

T0811Data from Information Repositories

Isolate · Network Isolation

OT Read Command produces OT Protocol Message · filters

T0814Denial of Service

Isolate · Network Isolation

OT Network Traffic produces Network Traffic · filters

T0817Drive-by Compromise

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T0819Exploit Public-Facing Application

Isolate · Network Isolation

Inbound Internet Network Traffic produces Network Traffic · filters

T0821Modify controller Tasking

Isolate · Network Isolation

OT Modify Control Program Command produces OT Protocol Message · filters

T0822External Remote Services

Isolate · Network Isolation

Inbound Internet Network Traffic produces Network Traffic · filters

T0830Adversary-in-the-Middle

Isolate · Network Isolation

Network Traffic may-modify Network Traffic · filters

T0835Manipulate I/O Image

Isolate · Network Isolation

OT Change Data Command produces OT Protocol Message · filters

T0836Modify Parameter

Isolate · Network Isolation

OT Write Command produces OT Protocol Message · filters

T0838Modify Alarm Settings

Isolate · Network Isolation

OT Modify Device Configuration Command produces OT Protocol Message · filters

T0839Module Firmware

Isolate · Network Isolation

OT Device Firmware Command produces OT Protocol Message · filters

T0840Network Connection Enumeration

Isolate · Network Isolation

OT Device Identification Message may-produce OT Protocol Message · filters

Isolate · Network Isolation

Network Traffic monitors Network Traffic · filters

T0842Network Sniffing

Isolate · Network Isolation

Network Traffic monitors Network Traffic · filters

T0843Program Download

Isolate · Network Isolation

OT Download Control Program Command produces OT Protocol Message · filters

T0845Program Upload

Isolate · Network Isolation

OT Read Device Configuration Command produces OT Protocol Message · filters

T0846Remote System Discovery

Isolate · Network Isolation

Network Traffic monitors Network Traffic · filters

Isolate · Network Isolation

OT Device Identification Message may-produce OT Protocol Message · filters

T0848Rogue Master

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

Isolate · Network Isolation

Network Traffic monitors Network Traffic · filters

T0855Unauthorized Command Message

Isolate · Network Isolation

OT Control Command may-produce OT Protocol Message · filters

T0856Spoof Reporting Message

Isolate · Network Isolation

OT Diagnostics Message produces OT Protocol Message · filters

T0857System Firmware

Isolate · Network Isolation

OT Protocol Message may-produce OT Protocol Message · filters

T0858Change Operating Mode

Isolate · Network Isolation

OT Modify Device Operating Mode Command may-produce OT Protocol Message · filters

T0861Point & Tag Identification

Isolate · Network Isolation

OT Read Device Configuration Command may-produce OT Protocol Message · filters

T0865Spearphishing Attachment

Isolate · Network Isolation

Inbound Internet Mail Traffic produces Network Traffic · filters

T0866Exploitation of Remote Services

Isolate · Network Isolation

OT Protocol Message may-produce OT Protocol Message · filters

Isolate · Network Isolation

Intranet Network Traffic produces Network Traffic · filters

T0868Detect Operating Mode

Isolate · Network Isolation

OT Read Device Configuration Command may-produce OT Protocol Message · filters

T0869Standard Application Layer Protocol

Isolate · Network Isolation

OT Protocol Message produces OT Protocol Message · filters

Isolate · Network Isolation

Outbound Network Traffic produces Network Traffic · filters

T0873Project File Infection

Isolate · Network Isolation

OT Change Control Program Command produces OT Protocol Message · filters

T0877I/O Image

Isolate · Network Isolation

OT Read Value Command produces OT Protocol Message · filters

T0878Alarm Suppression

Isolate · Network Isolation

OT Diagnostics Message disables OT Protocol Message · filters

Isolate · Network Isolation

OT Diagnostics Message produces OT Protocol Message · filters

T0884Connection Proxy

Isolate · Network Isolation

Intranet Network Traffic may-produce Network Traffic · filters

Isolate · Network Isolation

Outbound Internet Network Traffic may-produce Network Traffic · filters

T0885Commonly Used Port

Isolate · Network Isolation

OT Protocol Message uses OT Protocol Message · filters

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

T0886Remote Services

Isolate · Network Isolation

Intranet Network Traffic produces Network Traffic · filters

T0888Remote System Information Discovery

Isolate · Network Isolation

OT Device Description Message may-produce OT Protocol Message · filters

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

T0889Modify Program

Isolate · Network Isolation

OT Modify Control Program Command produces OT Protocol Message · filters

T0893Data from Local System

Isolate · Network Isolation

OT Read Command may-produce OT Protocol Message · filters

T0894System Binary Proxy Execution

Isolate · Network Isolation

Network Traffic may-produce Network Traffic · filters

T0895Autorun Image

Isolate · Network Isolation

Network Traffic may-produce Network Traffic · filters

T1001Data Obfuscation

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1003.006DCSync

Isolate · Network Isolation

Intranet Administrative Network Traffic produces Network Traffic · filters

T1008Fallback Channels

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1011Exfiltration Over Other Network Medium

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1018Remote System Discovery

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

T1020Automated Exfiltration

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1021Remote Services

Isolate · Network Isolation

Intranet Network Traffic produces Network Traffic · filters

T1021.001Remote Desktop Protocol

Isolate · Network Isolation

Administrative Network Traffic produces Network Traffic · filters

T1021.004SSH

Isolate · Network Isolation

Administrative Network Traffic produces Network Traffic · filters

T1029Scheduled Transfer

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1030Data Transfer Size Limits

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1041Exfiltration Over C2 Channel

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1047Windows Management Instrumentation

Isolate · Network Isolation

Intranet Administrative Network Traffic may-create Network Traffic · filters

T1048Exfiltration Over Alternative Protocol

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Isolate · Network Isolation

Outbound Internet Encrypted Traffic produces Network Traffic · filters

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Isolate · Network Isolation

Outbound Internet Encrypted Traffic produces Network Traffic · filters

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1071Application Layer Protocol

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1071.001Web Protocols

Isolate · Network Isolation

Outbound Internet Web Traffic produces Network Traffic · filters

T1071.002File Transfer Protocols

Isolate · Network Isolation

Outbound Internet File Transfer Traffic produces Network Traffic · filters

T1071.003Mail Protocols

Isolate · Network Isolation

Outbound Internet Mail Traffic produces Network Traffic · filters

T1071.004DNS

Isolate · Network Isolation

Outbound Internet DNS Lookup Traffic produces Network Traffic · filters

T1090.001Internal Proxy

Isolate · Network Isolation

Intranet Network Traffic produces Network Traffic · filters

T1090.002External Proxy

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1090.003Multi-hop Proxy

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1090.004Domain Fronting

Isolate · Network Isolation

Outbound Internet Encrypted Web Traffic produces Network Traffic · filters

T1095Non-Application Layer Protocol

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1098.001Additional Cloud Credentials

Isolate · Network Isolation

Intranet Administrative Network Traffic produces Network Traffic · filters

T1102Web Service

Isolate · Network Isolation

Outbound Internet Web Traffic produces Network Traffic · filters

T1104Multi-Stage Channels

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1105Ingress Tool Transfer

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1110.003Password Spraying

Isolate · Network Isolation

Intranet Administrative Network Traffic may-create Network Traffic · filters

T1110.004Credential Stuffing

Isolate · Network Isolation

Intranet Administrative Network Traffic may-create Network Traffic · filters

T1132Data Encoding

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1185Browser Session Hijacking

Isolate · Network Isolation

Web Network Traffic produces Network Traffic · filters

T1189Drive-by Compromise

Isolate · Network Isolation

Internet Network Traffic produces Network Traffic · filters

T1190Exploit Public-Facing Application

Isolate · Network Isolation

Inbound Internet Network Traffic produces Network Traffic · filters

T1197BITS Jobs

Isolate · Network Isolation

Outbound Internet Web Traffic may-produce Network Traffic · filters

Isolate · Network Isolation

Intranet Web Network Traffic may-produce Network Traffic · filters

Isolate · Network Isolation

Intranet IPC Network Traffic may-produce Network Traffic · filters

T1199Trusted Relationship

Isolate · Network Isolation

Intranet Network Traffic produces Network Traffic · filters

T1204.001Malicious Link

Isolate · Network Isolation

Outbound Internet Web Traffic produces Network Traffic · filters

T1205Traffic Signaling

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

T1205.001Port Knocking

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

T1207Rogue Domain Controller

Isolate · Network Isolation

Intranet Administrative Network Traffic produces Network Traffic · filters

T1210Exploitation of Remote Services

Isolate · Network Isolation

Intranet Network Traffic produces Network Traffic · filters

T1218.003CMSTP

Isolate · Network Isolation

Network Traffic may-produce Network Traffic · filters

T1219Remote Access Tools

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1498.001Direct Network Flood

Isolate · Network Isolation

Inbound Internet Network Traffic creates Network Traffic · filters

T1498.002Reflection Amplification

Isolate · Network Isolation

Inbound Internet Network Traffic produces Network Traffic · filters

T1499.002Service Exhaustion Flood

Isolate · Network Isolation

Inbound Internet Network Traffic produces Network Traffic · filters

T1542.005TFTP Boot

Isolate · Network Isolation

TFTP Network Traffic creates Network Traffic · filters

T1546.003Windows Management Instrumentation Event Subscription

Isolate · Network Isolation

Intranet Administrative Network Traffic produces Network Traffic · filters

T1546.008Accessibility Features

Isolate · Network Isolation

Intranet Administrative Network Traffic may-create Network Traffic · filters

T1550.001Application Access Token

Isolate · Network Isolation

Network Traffic may-produce Network Traffic · filters

T1550.004Web Session Cookie

Isolate · Network Isolation

Web Network Traffic produces Network Traffic · filters

T1557Adversary-in-the-Middle

Isolate · Network Isolation

Network Traffic produces Network Traffic · filters

T1557.001Name Resolution Poisoning and SMB Relay

Isolate · Network Isolation

Intranet Multicast Network Traffic produces Network Traffic · filters

T1557.003DHCP Spoofing

Isolate · Network Isolation

DHCP Network Traffic creates Network Traffic · filters

T1558.003Kerberoasting

Isolate · Network Isolation

RPC Network Traffic may-produce Network Traffic · filters

T1563Remote Service Session Hijacking

Isolate · Network Isolation

Administrative Network Traffic produces Network Traffic · filters

T1565.002Transmitted Data Manipulation

Isolate · Network Isolation

Network Traffic may-modify Network Traffic · filters

T1566.001Spearphishing Attachment

Isolate · Network Isolation

Inbound Internet Mail Traffic produces Network Traffic · filters

T1566.002Spearphishing Link

Isolate · Network Isolation

Inbound Internet Mail Traffic produces Network Traffic · filters

T1567Exfiltration Over Web Service

Isolate · Network Isolation

Outbound Internet Web Traffic produces Network Traffic · filters

T1567.001Exfiltration to Code Repository

Isolate · Network Isolation

Outbound Internet Encrypted Remote Terminal Traffic may-produce Network Traffic · filters

Isolate · Network Isolation

Outbound Internet Encrypted Web Traffic may-produce Network Traffic · filters

T1567.002Exfiltration to Cloud Storage

Isolate · Network Isolation

Outbound Internet Encrypted Web Traffic produces Network Traffic · filters

T1568Dynamic Resolution

Isolate · Network Isolation

Outbound Internet DNS Lookup Traffic produces Network Traffic · filters

T1570Lateral Tool Transfer

Isolate · Network Isolation

Intranet File Transfer Traffic produces Network Traffic · filters

T1571Non-Standard Port

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1572Protocol Tunneling

Isolate · Network Isolation

Outbound Internet Network Traffic produces Network Traffic · filters

T1573Encrypted Channel

Isolate · Network Isolation

Outbound Internet Encrypted Traffic produces Network Traffic · filters

T1573.001Symmetric Cryptography

Isolate · Network Isolation

Outbound Internet Encrypted Traffic creates Network Traffic · filters

T1573.002Asymmetric Cryptography

Isolate · Network Isolation

Outbound Internet Encrypted Traffic creates Network Traffic · filters

查看关系图在矩阵中定位