M1037Filter Network Traffic
Restricting inbound/outbound traffic with default-deny filtering, egress control, and anti-spoofing (uRPF/BCP38).
ZT: verify explicitlyFirewall / Egress FilteringNetworkCloud
TA0011Defense Plan
Command and Control
Command-and-control communication
M1031Network Intrusion Prevention
IDS/IPS that detects and blocks known malicious patterns and anomalies in network traffic, with proper sensor placement.
ZT: assume breachIDS/IPSNetwork
M1021Restrict Web-Based Content
Narrows egress channels with DNS hardening (protective DNS/RPZ + sinkhole) and web proxy/filtering.
ZT: verify explicitlyWeb/DNS FilteringWindowsLinuxmacOSNetwork