Where It Sits in the Scheme
8 ASOM-Fed techniques reach this countermeasure, across 4 forms of maneuver.
This is the direction the forward mapping cannot answer. A reader who works in D3FEND arrives holding D3-CR and needs to know where it is employed in a scheme of maneuver — not which of MITRE's tactics it belongs to, which they already know.
Reached By
- M3.08 Identity Lifecycle EnforcementM3 Envelopment · T1 Identity
Bind joiner, mover and leaver events to authoritative sources so access follows the person, not the ticket.
- M3.11 Session and Token Revocation PathM3 Envelopment · T1 Identity
Maintain a tested path to invalidate sessions and tokens estate-wide within a stated interval.
- M7.05 Credential Reset SweepM7 Counterattack · T1 Identity
Execute a scoped, ordered reset of credentials and tokens across the compromised blast radius.
- M8.02 Estate-Wide Session RevocationM8 Isolation / Retrograde · T1 Identity
Invalidate every session and token across the estate as one action when the identity plane is in doubt.
- M8.14 Rapid Offboarding and RevocationM8 Isolation / Retrograde · T7 Workforce
Remove all access from a departing or suspended person in one action, in a time measured against the tempo an insider needs.
- M8.16 Supplier SeveranceM8 Isolation / Retrograde · T9 Supply Chain
Be able to cut a supplier's access immediately and continue the mission, because the alternative is negotiating with an intrusion.
- M8.17 Device Decommissioning and SanitizationM8 Isolation / Retrograde · T2 Devices
Remove a retired, lost or reassigned device from the estate's trust and sanitize its media within a period derived from what its retained trust could do.
- M9.05 Pre-Emptive Credential InvalidationM9 Spoiling Attack · T1 Identity
Invalidate credentials on exposure intelligence, before misuse, accepting the friction.
Forms That Arrive Here
A countermeasure reached from more than one form is employed more than one way. D3FEND has no notion of a form, so this join exists only here.
- M3 EnvelopmentThe formMake identity, not network location, the decisive plane — surround the adversary with policy.
- M7 CounterattackThe formSeize the initiative and evict before the adversary reaches the objective.
- M8 Isolation / RetrogradeThe formGive ground deliberately to preserve the force. Degrade gracefully; never fail open.
- M9 Spoiling AttackThe formDisrupt adversary staging before the attack is launched.
What This Does Not Claim
That a technique reaches a D3FEND countermeasure says the two describe the same defensive act. It does not say the countermeasure is deployed, configured, or working — that is an assessment finding about your estate, not a property of the framework.
MITRE's own entry for this technique is at d3fend.mitre.org, and it is the authority on what the countermeasure is. This page is the authority only on where it sits in ASOM-Fed. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation. This mapping is published by threatDefendr and is neither produced nor endorsed by MITRE.