D3-ANET — Authentication Event Thresholding

Where It Sits in the Scheme

4 ASOM-Fed techniques reach this countermeasure, across 2 forms of maneuver.

This is the direction the forward mapping cannot answer. A reader who works in D3FEND arrives holding D3-ANET and needs to know where it is employed in a scheme of maneuver — not which of MITRE's tactics it belongs to, which they already know.

Reached By

M3.15 Break-Glass Account ControlM3 Envelopment · T1 Identity
Hold emergency accounts under split control with alerting on any use, so the last resort is not the soft target.
M3.17 Authentication Anomaly ScoringM3 Envelopment · T1 Identity
Score authentication against the behavioral baseline and feed the score back into the policy decision point.
M6.02 Step-Up Authentication on AnomalyM6 Delay · T1 Identity
Demand stronger proof at the moment behavior deviates, rather than uniformly at sign-in.
M6.07 Progressive LockoutM6 Delay · T1 Identity
Escalate friction against an identity under attack without handing an attacker a denial-of-service lever.

Forms That Arrive Here

A countermeasure reached from more than one form is employed more than one way. D3FEND has no notion of a form, so this join exists only here.

M3 EnvelopmentThe formMake identity, not network location, the decisive plane — surround the adversary with policy.
M6 DelayThe formBuy decision time and prevent the adversary culminating on the objective.

What This Does Not Claim

That a technique reaches a D3FEND countermeasure says the two describe the same defensive act. It does not say the countermeasure is deployed, configured, or working — that is an assessment finding about your estate, not a property of the framework.

MITRE's own entry for this technique is at d3fend.mitre.org, and it is the authority on what the countermeasure is. This page is the authority only on where it sits in ASOM-Fed. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation. This mapping is published by threatDefendr and is neither produced nor endorsed by MITRE.