Where It Sits in the Scheme
3 ASOM-Fed techniques reach this countermeasure, across 3 forms of maneuver.
This is the direction the forward mapping cannot answer. A reader who works in D3FEND arrives holding D3-NM and needs to know where it is employed in a scheme of maneuver — not which of MITRE's tactics it belongs to, which they already know.
Reached By
- M1.01 External Attack Surface EnumerationM1 Screen / Guard · T3 Networks
Continuously enumerate everything the agency exposes to the internet, from the outside in, on the same cadence an adversary would.
- M7.08 Lateral Path AuditM7 Counterattack · T3 Networks
Recompute what the adversary could reach from where they stand, and close the paths ahead of them.
- M10.03 Terrain Overlay UpdateM10 Exploitation & Pursuit · TX Cross-Cutting
Update the terrain overlay with what contact revealed, including everything the map got wrong.
Forms That Arrive Here
A countermeasure reached from more than one form is employed more than one way. D3FEND has no notion of a form, so this join exists only here.
- M1 Screen / GuardThe formGain early warning and buy reaction time before the adversary touches key terrain.
- M7 CounterattackThe formSeize the initiative and evict before the adversary reaches the objective.
- M10 Exploitation & PursuitThe formConvert contact into durable advantage rather than closing the ticket.
What This Does Not Claim
That a technique reaches a D3FEND countermeasure says the two describe the same defensive act. It does not say the countermeasure is deployed, configured, or working — that is an assessment finding about your estate, not a property of the framework.
MITRE's own entry for this technique is at d3fend.mitre.org, and it is the authority on what the countermeasure is. This page is the authority only on where it sits in ASOM-Fed. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation. This mapping is published by threatDefendr and is neither produced nor endorsed by MITRE.