D3FEND 防御知识库
技术列表 · 只读官方知识数据
D3FEND 标识技术名称战术父技术子技术ATT&CK
D3-RPARelay Pattern AnalysisThe detection of an internal host relaying traffic between the internal network and the external network.DetectNetworkTrafficAnalysis031D3-RFAMRemote File Access MediationRemote file access mediation is the process of managing and securing access to file systems over a network to ensure that only authorized users or processes can interact with remote files.IsolateNetworkResourceAccessMediation0110D3-RFUMRemote Firmware Update MonitoringMonitoring of remote firmware update commands to identify unauthorized software installations.DetectApplicationProtocolCommandAnalysis03D3-RTSDRemote Terminal Session DetectionDetection of an unauthorized remote live terminal console session by examining network traffic to a network host.DetectNetworkTrafficAnalysis090D3-RAPAResource Access Pattern AnalysisAnalyzing the resources accessed by a user to identify unauthorized activity.DetectUserBehaviorAnalysis00D3-RARestore AccessRestoring an entity's access to resources.Restore--30D3-RCRestore ConfigurationRestoring an software configuration.RestoreRestoreObject062D3-RDRestore DatabaseRestoring the data in a database.RestoreRestoreObject023D3-RDIRestore Disk ImageRestoring a previously captured disk image a hard drive.RestoreRestoreObject00D3-RERestore EmailRestoring an email for an entity to access.RestoreRestoreFile05D3-RFRestore FileRestoring a file for an entity to access.RestoreRestoreObject1110D3-RNARestore Network AccessRestoring a entity's access to a computer network.RestoreRestoreAccess016D3-RORestore ObjectRestoring an object for an entity to access. This is the broadest class for object restoral.Restore--50D3-RSRestore SoftwareRestoring software to a host.RestoreRestoreObject045D3-RUAARestore User Account AccessRestoring a user account's access to resources.RestoreRestoreAccess119D3-RRIDReverse Resolution IP DenylistingBlocking a reverse lookup based on the query's IP address value.IsolateDNSDenylisting02D3-RAMRouting Access MediationRouting access mediation is a network security approach that manages and controls access at the network layer using VPNs, tunneling protocols, firewall rules, and traffic inspection to ensure secure and efficient data routing.IsolateNetworkAccessMediation00D3-SJAScheduled Job AnalysisAnalysis of source files, processes, destination files, or destination servers associated with a scheduled job to detect unauthorized use of job scheduling.DetectOperatingSystemMonitoring02D3-SEAScript Execution AnalysisAnalyzing the execution of a script to detect unauthorized user activity.DetectProcessAnalysis00D3-SAORSegment Address Offset RandomizationRandomizing the base (start) address of one or more segments of memory during the initialization of a process.HardenApplicationHardening017D3-SMRASender MTA Reputation AnalysisCharacterizing the reputation of mail transfer agents (MTA) to determine the security risk in emails.DetectMessageAnalysis05D3-SRASender Reputation AnalysisAscertaining sender reputation based on information associated with a message (e.g. email/instant messaging).DetectMessageAnalysis05D3-SBVService Binary VerificationAnalyzing changes in service binary files by comparing to a source of truth.DetectSystemFileAnalysis013D3-SVCDMService Dependency MappingService dependency mapping determines the services on which each given service relies.ModelSystemMapping00D3-SDASession Duration AnalysisAnalyzing the duration of user sessions in order to detect unauthorized activity.DetectUserBehaviorAnalysis00D3-STSession TerminationForcefully end all active sessions associated with compromised accounts or devices.EvictProcessEviction010D3-SSCShadow Stack ComparisonsComparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.DetectProcessAnalysis08D3-SWISoftware InventorySoftware inventorying identifies and records the software items in the organization's architecture.ModelAssetInventory045D3-SUSoftware UpdateReplacing old software on a computer system component.HardenPlatformHardening045D3-SCHSource Code HardeningHardening source code with the intention of making it more difficult to exploit and less error prone.Harden--80