MITRE D3FENDdefensive technique

D3-OTF Outbound Traffic Filtering

Official page ↗
Tactic
Isolate

Definition

Restricting network traffic originating from a private host or enclave destined towards untrusted networks.

How it works

How it works Outbound traffic, in this context, is network traffic originating from a private host or enclave destined towards untrusted networks. For example: • An enterprise desktop intranet user connecting to www.example.com • An internal mail server connecting to an external mail server, mail.example.com Filtering is commonly implemented as firewall rulesets to limit outbound traffic permitted to egress a host or network. Firewalls are deployed either directly on hosts through kernel level software implementations or installed in-line directly on network links. There are benefits and disadvantages to each approach. There are various strategies for developing filtering rulesets: • Block everything by default • Limit destination hosts • Limit destination transport or application protocols • Restrict content outbound (Ex. strings formatted as social security numbers, or proprietary data) Considerations • Dynamic IP assignment creates challenges for Outbound Traffic Filtering because users are not necessarily associated with the same IP address. This can be addressed by linking IP address management information with the filtering logic. • Connections using non-standard transport layer ports may circumvent outbound traffic filtering technology which does not detect application protocol based on traffic content. • Business requirements typically drive the development of filtering rule sets. Implementations • iptables (Linux) • Windows Firewall • pf (BSD)

Related

Counters · MITRE ATT&CK (35)

  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.002 External Proxy sub-technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1090.004 Domain Fronting sub-technique
  • T1571 Non-Standard Port technique
  • T1204.001 Malicious Link sub-technique
  • T1568 Dynamic Resolution technique
  • T1567 Exfiltration Over Web Service technique
  • T1567.001 Exfiltration to Code Repository sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1197 BITS Jobs technique
  • T1204 User Execution technique
  • T1219 Remote Access Tools technique
  • T1001 Data Obfuscation technique
  • T1008 Fallback Channels technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1071 Application Layer Protocol technique
  • T1090 Proxy technique
Show all 35 ›

Child of · MITRE D3FEND (1)

  • D3-NTF Network Traffic Filtering defensive technique

References