MITRE D3FENDdefensive technique

D3-ITF Inbound Traffic Filtering

Official page ↗
Tactic
Isolate

Definition

Restricting network traffic originating from untrusted networks destined towards a private host or enclave.

How it works

How it works Inbound Traffic, in this context, is network traffic originating from an untrusted network towards a private host or enclave. For example: • An untrusted network host connecting to a internal commercial portal, shopping.example.com • An external mail server connecting to an internal mail server, mail.example.com Filtering policies are developed by administrators to meet business requirements and limit connectivity. These policies are implemented on edge devices such as firewalls, routers, and intrusion prevention systems. Examples of filters: • Blocking incoming traffic from spoofed internally facing IP addresses • Blocking specific ports and services from establishing connections • Limiting specific IP ranges from connecting to the network • Dynamic inbound filtering (Hole punching, STUN, NAT-T) Considerations • Business requirements typically drive the development of filtering rulesets • Protocols using non-standard ports may circumvent filtering technology, which does not detect application protocol based on traffic content Implementations • OpenWRT (Embedded) • Netfilter (Linux) • Windows Firewall • pf(BSD)

Related

Counters · MITRE ATT&CK (12)

  • T0819 Exploit Public-Facing Application technique
  • T0822 External Remote Services technique
  • T0865 Spearphishing Attachment technique
  • T1498.001 Direct Network Flood sub-technique
  • T1498.002 Reflection Amplification sub-technique
  • T1566 Phishing technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1499.002 Service Exhaustion Flood sub-technique
  • T1499 Endpoint Denial of Service technique
  • T1498 Network Denial of Service technique
  • T1190 Exploit Public-Facing Application technique

Child of · MITRE D3FEND (1)

  • D3-NTF Network Traffic Filtering defensive technique

Referenced by MITRE D3FEND · child of (1)

  • D3-EF Email Filtering defensive technique

References