ARTIFACTS

D3FEND

Top Level Artifacts

Digital Artifact

Address Space

Memory Extent

Shadow Stack

Thread

Memory Address

Page Table

Software Package

User

User Account

User Action

User Behavior

User Interface

User to User Message

Volume

Dependency

Link

Binary Large Object

Binary Segment

Blob

Block Device

Boot Loader

Call Stack

Certificate

Clipboard

Command

Credential

Cryptographic Key

Database

Decoy Artifact

Digital System

Directory

Display Server

DNS Lookup

Domain Registration

Enclave

File Selection

File System

File System Link

Hardware Device

Hardware Driver

Identifier

Interprocess Communication

Intrusion Detection System

Kernel Process Table

Log

Metadata

Network

Network Flow

Network Node

Network Traffic

Operating System

Partition

Partition Table

Physical Location

Platform

Pointer

Process

Process Image

Process Tree

Record

Resource

Sensor

Session

Software

Stack Component

Storage

System Call

Task Schedule

Trust Store

Files

File

Archive File

Java Archive

Custom Archive File

Certificate File

CA Certificate File

Configuration File

Operating System Configuration File

Property List File

User Init Configuration File

Application Configuration File

Compiler Configuration File

Container Image

Document File

HTML File

Office Application File

Email

Email Attachment

Multimedia Document File

Executable File

Executable Binary

Executable Script

Init Script

Network Init Script File Resource

User Init Script

PowerShell Profile Script

Python Script File

System Init Script

User Startup Script File

Web Script File

Password File

Symbolic Link

Fast Symbolic Link

NTFS Junction Point

NTFS Symbolic Link

POSIX Symbolic Link

Slow Symbolic Link

Alias

NTFS Link

NTFS Hard Link

Software Library File

Log File

Operating System Log File

Command History Log File

Object File

Kernel Module

Shared Library File

Operating System Shared Library File

Operating System File

Operating System Executable File

Shortcut File

Windows Shortcut File

Database File

Network Traffic

Network Packets

Network Session

Remote Command

Remote Procedure Call

Remote Database Query

Remote Terminal Session

Outbound Network Traffic

Outbound Internet DNS Lookup Traffic

Outbound Internet File Transfer Traffic

Outbound Internet Network Traffic

Outbound Internet Web Traffic

Outbound Internet Encrypted Web Traffic

Outbound Internet Encrypted Traffic

Outbound Internet Encrypted Remote Terminal Traffic

Outbound Internet Mail Traffic

Outbound Internet RPC Traffic

RPC Network Traffic

Intranet RPC Network Traffic

Web Network Traffic

Intranet Web Network Traffic

IPC Network Traffic

Intranet IPC Network Traffic

Mail Network Traffic

Inbound Internet Mail Traffic

Administrative Network Traffic

Intranet Administrative Network Traffic

DNS Network Traffic

File Transfer Network Traffic

Internet File Transfer Traffic

Intranet File Transfer Traffic

Inbound Network Traffic

Inbound Internet Network Traffic

Inbound Internet DNS Response Traffic

Internet Network Traffic

Intranet Network Traffic

Intranet Multicast Network Traffic

Local Area Network Traffic

Software

Software Library

Shim

Application Shim

Software Patch

Subroutine

Exception Handler

Input Function

User Input Function

Stored Procedure

Authentication Function

Console Output Function

Copy Memory Function

Deserialization Function

Eval Function

External Content Inclusion Function

File Path Open Function

Import Library Function

Log Message Function

Mathematical Function

Memory Allocation Function

Memory Free Function

Pointer Dereferencing Function

Process Start Function

Raw Memory Access Function

Serialization Function

Shared Resource Access Function

String Format Function

Thread Start Function

System Service Software

Local Authorization Service

Task Scheduler Software

Local Authentication Service

System Software

Host-based Firewall

Kernel

Utility Software

System Time Application

Network Agent

Application

Client Application

Password Manager

Service Application

Software Deployment Tool

Virtualization Software

Container Orchestration Software

Container Runtime

Credential Management System

Web Server Application

User Application

Office Application

Browser

Browser Extension

Collaborative Software

Business Communication Platform Client

Chatroom Client

Instant Messaging Client

Developer Application

Build Tool

Compiler

Software Packaging Tool

Container Build Tool

Operating System Packaging Tool

Code Analyzer

Dynamic Analysis Tool

Static Analysis Tool

Source Code Analyzer Tool

Test Execution Tool

Integration Test Execution Tool

Unit Test Execution Tool

Version Control Tool

Network Traffic Analysis Software

Application Installer

Firmware

Microcode

Peripheral Firmware

Graphics Card Firmware

Hard Disk Firmware

Human Input Device Firmware

Network Card Firmware

Peripheral Hub Firmware

System Firmware

Outbound Network Traffic

Outbound traffic is network traffic originating from a host of interest (client), to another host (server).

ID: d3f:OutboundNetworkTraffic

ⓘ

Type: Network Traffic

Informational References

https://d3fend.mitre.org/dao/artifact/d3f:OutboundNetworkTraffic/

D3FEND Techniques

Name	Description
D3-OTF	Restricting network traffic originating from a private host or enclave destined towards untrusted networks.

SPARTA Countermeasures

ID	Name	Description
CM0002	COMSEC	A component of cybersecurity to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications. COMSEC includes cryptographic security, transmission security, emissions security, and physical security of COMSEC material. It is imperative to utilize secure communication protocols with strong cryptographic mechanisms to prevent unauthorized disclosure of, and detect changes to, information during transmission. Systems should also maintain the confidentiality and integrity of information during preparation for transmission and during reception. Spacecraft should not employ a mode of operations where cryptography on the TT&C link can be disabled (i.e., crypto-bypass mode). The cryptographic mechanisms should identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
CM0034	Monitor Critical Telemetry Points	Monitor defined telemetry points for malicious activities (i.e., jamming attempts, commanding attempts (e.g., command modes, counters, etc.)). This would include valid/processed commands as well as commands that were rejected. Telemetry monitoring should synchronize with ground-based Defensive Cyber Operations (i.e., SIEM/auditing) to create a full space system situation awareness from a cybersecurity perspective.
CM0032	On-board Intrusion Detection & Prevention	Utilize on-board intrusion detection/prevention system that monitors the mission critical components or systems and audit/logs actions. The IDS/IPS should have the capability to respond to threats (initial access, execution, persistence, evasion, exfiltration, etc.) and it should address signature-based attacks along with dynamic never-before seen attacks using machine learning/adaptive technologies. The IDS/IPS must integrate with traditional fault management to provide a wholistic approach to faults on-board the spacecraft. Spacecraft should select and execute safe countermeasures against cyber-attacks. These countermeasures are a ready supply of options to triage against the specific types of attack and mission priorities. Minimally, the response should ensure vehicle safety and continued operations. Ideally, the goal is to trap the threat, convince the threat that it is successful, and trace and track the attacker — with or without ground support. This would support successful attribution and evolving countermeasures to mitigate the threat in the future. “Safe countermeasures” are those that are compatible with the system’s fault management system to avoid unintended effects or fratricide on the system.
CM0038	Segmentation	Identify the key system components or capabilities that require isolation through physical or logical means. Information should not be allowed to flow between partitioned applications unless explicitly permitted by security policy. Isolate mission critical functionality from non-mission critical functionality by means of an isolation boundary (implemented via partitions) that controls access to and protects the integrity of, the hardware, software, and firmware that provides that functionality. Enforce approved authorizations for controlling the flow of information within the spacecraft and between interconnected systems based on the defined security policy that information does not leave the spacecraft boundary unless it is encrypted. Implement boundary protections to separate bus, communications, and payload components supporting their respective functions.