D3-ANET — Authentication Event Thresholding
D3-ANET: Authentication Event Thresholding
MITRE D3FEND countermeasure
What it does
Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile.
Attacks this counters
No ATT&CK technique in this corpus maps to this countermeasure. D3FEND may map it to techniques outside the Enterprise matrix, or to ones MITRE has since revoked — absence here is about this corpus, not about the countermeasure.