MITRE D3FENDdefensive technique

D3-CQ Content Quarantine

Official page ↗
Tactic
Isolate

Definition

Transfer content that does not comply with policy to a quarantine zone.

How it works

How it works Quarantining serves as a protective measure to isolate potentially harmful files or elements until they can be safely analyzed or processed.

Related

Counters · MITRE ATT&CK (141)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T0893 Data from Local System technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T0888 Remote System Information Discovery technique
  • T1564.007 VBA Stomping sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T1556.003 Pluggable Authentication Modules sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T0851 Rootkit technique
  • T0865 Spearphishing Attachment technique
  • T0871 Execution through API technique
  • T1127.001 MSBuild sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573 Encrypted Channel technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1574.004 Dylib Hijacking sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1564.002 Hidden Users sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574.011 Services Registry Permissions Weakness sub-technique
  • T1574 Hijack Execution Flow technique
Show all 141 ›

Child of · MITRE D3FEND (1)

  • D3-CF Content Filtering defensive technique

References