Esc
Network Isolation
Definition
Network Isolation techniques prevent network hosts from accessing non-essential system network resources.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 15 techniques in this category, Network Isolation.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Network Isolation | D3-NI | Network Isolation techniques prevent network hosts from accessing non-essential system network resources. | |
| - Reverse Resolution IP Denylisting | D3-RRID | Blocking a reverse lookup based on the query's IP address value. | Reverse Resolution IP Blacklisting |
| - Hierarchical Domain Denylisting | D3-HDDL | Blocking the resolution of any subdomain of a specified domain name. | Hierarchical Domain Blacklisting |
| - Encrypted Tunnels | D3-ET | Encrypted encapsulation of routable network traffic. | |
| - Inbound Traffic Filtering | D3-ITF | Restricting network traffic originating from untrusted networks destined towards a private host or enclave. | |
| - Homoglyph Denylisting | D3-HDL | Blocking DNS queries that are deceptively similar to legitimate domain names. | Homoglyph Blacklisting |
| - Forward Resolution Domain Denylisting | D3-FRDDL | Blocking a lookup based on the query's domain name value. | Forward Resolution Domain Blacklisting |
| - DNS Allowlisting | D3-DNSAL | Permitting only approved domains and their subdomains to be resolved. | DNS Whitelisting |
| - Network Traffic Filtering | D3-NTF | Restricting network traffic originating from any location. | |
| - Broadcast Domain Isolation | D3-BDI | Broadcast isolation restricts the number of computers a host can contact on their LAN. | Network Segmentation |
| - Email Filtering | D3-EF | Filtering incoming email traffic based on specific criteria. | |
| - Outbound Traffic Filtering | D3-OTF | Restricting network traffic originating from a private host or enclave destined towards untrusted networks. | |
| - Forward Resolution IP Denylisting | D3-FRIDL | Blocking a DNS lookup's answer's IP address value. | Forward Resolution IP Blacklisting |
| - DNS Denylisting | D3-DNSDL | Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type. | DNS Blacklisting |
| - Directional Network Link | D3-DNL | Enforce one-way network communication by preventing two-way communication. |
Related Offensive Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Persistence
BITS Jobs
Account Manipulation
Event Triggered Execution
Pre-OS Boot
Traffic Signaling
Stealth
BITS Jobs
Pre-OS Boot
Traffic Signaling
System Binary Proxy Execution
Command and Control
Application Layer Protocol
Web Service
Dynamic Resolution
Remote Access Tools
Data Obfuscation
Multi-Stage Channels
Fallback Channels
Data Encoding
Non-Application Layer Protocol
Proxy
Ingress Tool Transfer
Protocol Tunneling
Non-Standard Port
Encrypted Channel
Traffic Signaling
Credential Access
Steal or Forge Kerberos Tickets
Brute Force
OS Credential Dumping
Adversary-in-the-Middle
Initial Access
Exploit Public-Facing Application
Phishing
Drive-by Compromise
Trusted Relationship
Impact
Network Denial of Service
Endpoint Denial of Service
Data Manipulation
Lateral Movement
Use Alternate Authentication Material
Lateral Tool Transfer
Remote Services
Remote Service Session Hijacking
Exploitation of Remote Services
Internal Spearphishing
Collection
Browser Session Hijacking
Adversary-in-the-Middle
Email Collection
Exfiltration
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service
Automated Exfiltration
Data Transfer Size Limits
Scheduled Transfer
Exfiltration Over C2 Channel
Exfiltration Over Other Network Medium
Privilege Escalation
Account Manipulation
Event Triggered Execution
Defense Impairment
Rogue Domain Controller
Discovery
Remote System Discovery