MITRE ATT&CKmitigation

M0807 Network Allowlists

Published 2019-06-10 Modified 2026-05-12 Official page ↗
Domain
ics
Version
1.1
Created
2019-06-10

Description

Network allowlists can be implemented through either host-based files or system hosts files to specify what connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in Filter Network Traffic mitigation.

Related

Mitigates · MITRE ATT&CK (32)

  • T0843.001 Download All sub-technique
  • T0843.002 Online Edit sub-technique
  • T0843.003 Program Append sub-technique
  • T1691 Block Operational Technology Message technique
  • T1691.001 Command Message sub-technique
  • T1691.002 Reporting Message sub-technique
  • T1692 Unauthorized Message technique
  • T1692.001 Command Message sub-technique
  • T1692.002 Reporting Message sub-technique
  • T1693 Modify Firmware technique
  • T1693.001 System Firmware sub-technique
  • T1693.002 Module Firmware sub-technique
  • T1695 Block Communications technique
  • T1695.001 Serial COM sub-technique
  • T1695.002 Ethernet sub-technique
  • T1695.003 Wi-Fi sub-technique
  • T0886 Remote Services technique
  • T0800 Activate Firmware Update Mode technique
  • T0802 Automated Collection technique
  • T0806 Brute Force I/O technique
  • T0816 Device Restart/Shutdown technique
  • T0838 Modify Alarm Settings technique
  • T0843 Program Download technique
  • T0845 Program Upload technique
  • T0848 Rogue Master technique
  • T0858 Change Operating Mode technique
  • T0861 Point & Tag Identification technique
  • T0868 Detect Operating Mode technique
  • T0869 Standard Application Layer Protocol technique
  • T0878 Alarm Suppression technique
Show all 32 ›