Isolate

The isolate tactic creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses.

Informational References

https://d3fend.mitre.org/tactic/d3f:Isolate/

Techniques

ID				Name	Description
D3-NI				Network Isolation	Network Isolation techniques prevent network hosts from accessing non-essential system network resources.
	D3-BDI			Broadcast Domain Isolation	Broadcast isolation restricts the number of computers a host can contact on their LAN.
	D3-DNSAL			DNS Allowlisting	Permitting only approved domains and their subdomains to be resolved.
	D3-DNSDL			DNS Denylisting	Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type.
		D3-FRDDL		Forward Resolution Domain Denylisting	Blocking a lookup based on the query's domain name value.
			D3-HDDL	Hierarchical Domain Denylisting	Blocking the resolution of any subdomain of a specified domain name.
			D3-HDL	Homoglyph Denylisting	Blocking DNS queries that are deceptively similar to legitimate domain names.
		D3-FRIDL		Forward Resolution IP Denylisting	Blocking a DNS lookup's answer's IP address value.
		D3-RRDD		Reverse Resolution Domain Denylisting	Blocking a reverse DNS lookup's answer's domain name value.
		D3-RRID		Reverse Resolution IP Denylisting	Blocking a reverse lookup based on the query's IP address value.
	D3-ET			Encrypted Tunnels	Encrypted encapsulation of routable network traffic.
	D3-NTF			Network Traffic Filtering	Restricting network traffic originating from any location.
		D3-ITF		Inbound Traffic Filtering	Restricting network traffic originating from untrusted networks destined towards a private host or enclave.
		D3-OTF		Outbound Traffic Filtering	Restricting network traffic originating from a private host or enclave destined towards untrusted networks.
D3-EI				Execution Isolation	Execution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files.
	D3-EAL			Executable Allowlisting	Using a digital signature to authenticate a file before opening.
	D3-EDL			Executable Denylisting	Blocking the execution of files on a host in accordance with defined application policy rules.
	D3-HBPI			Hardware-based Process Isolation	Preventing one process from writing to the memory space of another process through hardware based address manager implementations.
	D3-IOPR			IO Port Restriction	Limiting access to computer input/output (IO) ports to restrict unauthorized devices.
	D3-KBPI			Kernel-based Process Isolation	Using kernel-level capabilities to isolate processes.
		D3-MAC		Mandatory Access Control	Controlling access to local computer system resources with kernel-level capabilities.
		D3-SCF		System Call Filtering	Configuring a kernel to use an allow or deny list to filter kernel api calls.