D3-WSAA — Web Session Activity Analysis
D3-WSAA: Web Session Activity Analysis
MITRE D3FEND countermeasure
What it does
Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior.
Attacks this counters
No ATT&CK technique in this corpus maps to this countermeasure. D3FEND may map it to techniques outside the Enterprise matrix, or to ones MITRE has since revoked — absence here is about this corpus, not about the countermeasure.