MITRE D3FENDdefensive technique
D3-EF Email Filtering
- Tactic
- Isolate
Definition
Filtering incoming email traffic based on specific criteria.
How it works
How it works
Mail filters can be implemented to scan inbound email messages at the initial SMTP connection stage to detect and reject email containing spam and malware.
This technique is distinct from d3f:EmailDeletion because it prevents an email from reaching an user's inbox. This technique can also be used for outbound email traffic.
Considerations
• The effectiveness of mail filters depend on the completeness of the filter policies
Related
Counters · MITRE ATT&CK (7)
Child of · MITRE D3FEND (1)
- D3-ITF Inbound Traffic Filtering defensive technique
References
- https://patents.google.com/patent/JPH11161574A System and method for providing anonymous remailing and filtering of electronic mail