MITRE D3FENDdefensive technique

D3-EF Email Filtering

Official page ↗
Tactic
Isolate

Definition

Filtering incoming email traffic based on specific criteria.

How it works

How it works Mail filters can be implemented to scan inbound email messages at the initial SMTP connection stage to detect and reject email containing spam and malware. This technique is distinct from d3f:EmailDeletion because it prevents an email from reaching an user's inbox. This technique can also be used for outbound email traffic. Considerations • The effectiveness of mail filters depend on the completeness of the filter policies

Related

Counters · MITRE ATT&CK (7)

  • T0865 Spearphishing Attachment technique
  • T1566 Phishing technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1534 Internal Spearphishing technique
  • T1114 Email Collection technique

Child of · MITRE D3FEND (1)

  • D3-ITF Inbound Traffic Filtering defensive technique

References