Defensive countermeasure techniques, and the ATT&CK techniques each one counters
Reflects D3FEND 1.6.0 (released 2026-08-31). See also the ATT&CK map and CAR analytics.
Know what you are defending: asset, network, system and operational inventories.
Make exploitation harder before an attack: credentials, applications, platforms and messages.
Find adversary activity in files, processes, networks, identities and user behaviour.
Create logical or physical barriers that limit what an adversary can reach.
Plant decoy environments and objects that reveal or misdirect the adversary.
Remove the adversary: lock accounts, kill processes, quarantine files.
Return systems, accounts and data to a known good state after an incident.
Click any defensive technique to see its definition, the ATT&CK techniques it counters and the certifications that test it.