The process of temporarily disabling user accounts on a system or domain.
Actively collecting PKI certif ...... ver certificates for analysis.
Detection of unauthorized use ...... k activity against a baseline.
Modifying an application's configuration to reduce its attack surface.
Application Hardening makes an ...... e or on an application binary.
Removing tokens or credentials ...... r associated account accesses.
Collecting authentication even ...... ent with the baseline profile.
Collecting authorization event ...... ent with the baseline profile.
Using biological measures in order to authenticate a user.
Cryptographically authenticating the bootloader software before system boot.
Broadcast isolation restricts the number of computers a host can contact on their LAN.
Analyzing sequences of bytes a ...... represent malicious shellcode.
Analyzing Public Key Infrastru ...... e fields and third-party logs.
Persisting either a server's X ...... identity for SSL connections.
Comparing client-server reques ...... profile to identify outliers.
A decoy service, system, or en ...... access to a production system.
Analyzing failed connections in a network to detect unauthorized activity.
Determining which credentials ...... istory of a particular system.
Credential Eviction techniques ...... tials from a computer network.
Credential Hardening technique ...... or network/domain credentials.
Limiting the transmission of a credential to a scoped set of relying parties.
Permitting only approved domains and their subdomains to be resolved.
Blocking DNS Network Traffic b ...... omain name, or DNS query type.
Analysis of domain name metada ...... esolve to an undesirable host.
Analyzing database queries to ...... org/data/definitions/66.html).
Removing unreachable or "dead code" from compiled source code.
The deceive tactic is used to ...... ved or controlled environment.
A Decoy Environment comprises ...... oses of deceiving an attacker.
A file created for the purposes of deceiving an adversary.
Deploying a network resource for the purposes of deceiving an adversary.
A Decoy Object is created and deployed for the purposes of deceiving attackers.
Establishing a fake online ide ...... or interact with adversaries.
Issuing publicly released media to deceive adversaries.
An authentication token created for the purposes of deceiving an adversary.
A Credential created for the purpose of deceiving an adversary.
A method which makes a computer system more difficult to attack.
The detect tactic is used to i ...... activity on computer networks.
Encrypting a hard disk partition to prevent cleartext access to a file system.
Monitoring the existence of or changes to Domain User Accounts.
Restricting inter-domain trust by modifying domain configuration.
Ensuring the integrity of drivers loaded during initialization of the operating system.
Executing or opening a file in ...... ram such as a document reader.
Encrypted encapsulation of routable network traffic.
Monitoring the security status ...... endpoint has been compromised.
The eviction tactic is used to remove an adversary from a computer network.
Validates that a referenced exception handler pointer is a valid exception handler.
Using a digital signature to authenticate a file before opening.
Blocking the execution of file ...... ined application policy rules.
Execution Isolation techniques ...... as memory, devices, or files.
Analyzing the files accessed by a process to identify unauthorized activity.