MITRE D3FENDdefensive technique
D3-ST Session Termination
- Tactic
- Evict
Definition
Forcefully end all active sessions associated with compromised accounts or devices.
How it works
Defined in NIST 800-53 as AC-12.
Related
Counters · MITRE ATT&CK (11)
- T0822 External Remote Services technique
- T1563 Remote Service Session Hijacking technique
- T1563.001 SSH Hijacking sub-technique
- T1563.002 RDP Hijacking sub-technique
- T1134.003 Make and Impersonate Token sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.004 SSH sub-technique
- T1199 Trusted Relationship technique
- T1134 Access Token Manipulation technique
- T1021 Remote Services technique
- T1133 External Remote Services technique
Child of · MITRE D3FEND (1)
- D3-PE Process Eviction defensive technique
References
- https://doi.org/10.6028/NIST.SP.800-53Ar5 NIST Special Publication 800-53A Revision 5 - Assessing Security and Privacy Controls in Information Systems and Organizations