MITRE D3FENDdefensive technique

D3-CF Content Filtering

Official page ↗
Tactic
Isolate

Definition

Content Filtering techniques aid in the process of analyzing an input file for malicious or erroneous content and outputting a sanitized version.

Related

Counters · MITRE ATT&CK (127)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T0893 Data from Local System technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T0888 Remote System Information Discovery technique
  • T1564.007 VBA Stomping sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T1556.003 Pluggable Authentication Modules sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T0851 Rootkit technique
  • T0865 Spearphishing Attachment technique
  • T0871 Execution through API technique
  • T1127.001 MSBuild sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573 Encrypted Channel technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1574.004 Dylib Hijacking sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1564.002 Hidden Users sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574 Hijack Execution Flow technique
  • T1204.002 Malicious File sub-technique
Show all 127 ›

Referenced by MITRE D3FEND · child of (3)

  • D3-CM Content Modification defensive technique
  • D3-CQ Content Quarantine defensive technique
  • D3-CV Content Validation defensive technique

References