Umbra Wiki defense defense/D3-DNSAL
Back to wiki

D3-DNSAL — DNS Allowlisting

provenance: imported · ATT&CK: T1071 T1071.004 T1568 T1568.001 T1568.002 T1568.003

D3-DNSAL: DNS Allowlisting

MITRE D3FEND countermeasure

What it does

Permitting only approved domains and their subdomains to be resolved.

Attacks this counters

The chain in this corpus runs CVE → CWE → CAPEC → ATT&CK technique, which ends at what an adversary does. This is the hop after: what stops it.

Source