M1037Filter Network Traffic
Restricting inbound/outbound traffic with default-deny filtering, egress control, and anti-spoofing (uRPF/BCP38).
ZT: verify explicitlyFirewall / Egress FilteringNetworkCloud
TA0043Defense Plan
Reconnaissance
Gathering information about the target
M1056Pre-compromise
Reducing externally exposed information and asset footprint against pre-attack reconnaissance.
External Exposure ReductionNetworkCloud
M1019Threat Intelligence Program
Collecting relevant threat actor/TTP/IOC intelligence and integrating it into defense.
ZT: assume breachCTI ProgramWindowsLinuxmacOSNetworkCloud
M1017User Training
Reducing human-originated risk by training users on phishing, social engineering, and secure behavior.
Security Awareness ProgramWindowsLinuxmacOSIdentityCloud
M1016Vulnerability Scanning
Regular internal/external scanning and external attack surface management to find vulnerabilities before attackers do.
Vulnerability ManagementNetworkWindowsLinuxCloud