thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

MITRE D3FEND

A MITRE knowledge graph of defensive cybersecurity countermeasures mapped to offensive techniques.

Definition

D3FEND catalogs defensive techniques under tactics such as Model, Harden, Detect, Isolate, Deceive, Evict and Restore, and links them to ATT&CK techniques via digital artifacts. It helps architects select countermeasures for specific threats.

Example

Using D3FEND to find detection techniques for process injection such as process code segment verification.

Exam tip

D3FEND is defensive; ATT&CK is offensive.

Related terms