Esc
Network Isolation
Definition
Network Isolation techniques prevent network hosts from accessing non-essential system network resources.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 15 techniques in this category, Network Isolation.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Network Isolation | D3-NI | Network Isolation techniques prevent network hosts from accessing non-essential system network resources. | |
| - Reverse Resolution IP Denylisting | D3-RRID | Blocking a reverse lookup based on the query's IP address value. | Reverse Resolution IP Blacklisting |
| - Hierarchical Domain Denylisting | D3-HDDL | Blocking the resolution of any subdomain of a specified domain name. | Hierarchical Domain Blacklisting |
| - Encrypted Tunnels | D3-ET | Encrypted encapsulation of routable network traffic. | |
| - Inbound Traffic Filtering | D3-ITF | Restricting network traffic originating from untrusted networks destined towards a private host or enclave. | |
| - Homoglyph Denylisting | D3-HDL | Blocking DNS queries that are deceptively similar to legitimate domain names. | Homoglyph Blacklisting |
| - Forward Resolution Domain Denylisting | D3-FRDDL | Blocking a lookup based on the query's domain name value. | Forward Resolution Domain Blacklisting |
| - DNS Allowlisting | D3-DNSAL | Permitting only approved domains and their subdomains to be resolved. | DNS Whitelisting |
| - Network Traffic Filtering | D3-NTF | Restricting network traffic originating from any location. | |
| - Broadcast Domain Isolation | D3-BDI | Broadcast isolation restricts the number of computers a host can contact on their LAN. | Network Segmentation |
| - Email Filtering | D3-EF | Filtering incoming email traffic based on specific criteria. | |
| - Outbound Traffic Filtering | D3-OTF | Restricting network traffic originating from a private host or enclave destined towards untrusted networks. | |
| - Forward Resolution IP Denylisting | D3-FRIDL | Blocking a DNS lookup's answer's IP address value. | Forward Resolution IP Blacklisting |
| - DNS Denylisting | D3-DNSDL | Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type. | DNS Blacklisting |
| - Directional Network Link | D3-DNL | Enforce one-way network communication by preventing two-way communication. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Remote Services
Use Alternate Authentication Material
Exploitation of Remote Services
Internal Spearphishing
Remote Service Session Hijacking
Lateral Tool Transfer
Privilege Escalation
Account Manipulation
Event Triggered Execution
Command And Control
Remote Access Tools
Encrypted Channel
Proxy
Data Obfuscation
Multi-Stage Channels
Fallback Channels
Data Encoding
Application Layer Protocol
Dynamic Resolution
Traffic Signaling
Web Service
Non-Application Layer Protocol
Ingress Tool Transfer
Protocol Tunneling
Non-Standard Port
Impact
Network Denial of Service
Endpoint Denial of Service
Data Manipulation
Collection
Adversary-in-the-Middle
Browser Session Hijacking
Email Collection
Discovery
Remote System Discovery
Persistence
Account Manipulation
Pre-OS Boot
BITS Jobs
Traffic Signaling
Event Triggered Execution
Initial Access
Phishing
Exploit Public-Facing Application
Trusted Relationship
Drive-by Compromise
Credential Access
Adversary-in-the-Middle
Brute Force
OS Credential Dumping
Steal or Forge Kerberos Tickets
Defense Evasion
Use Alternate Authentication Material
Pre-OS Boot
Rogue Domain Controller
BITS Jobs
Traffic Signaling
System Binary Proxy Execution
Exfiltration
Exfiltration Over Web Service
Automated Exfiltration
Exfiltration Over Alternative Protocol
Data Transfer Size Limits
Scheduled Transfer
Exfiltration Over C2 Channel
Exfiltration Over Other Network Medium