Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-CAA — Connection Attempt Analysis

Analyzing failed connections in a network to detect unauthorized activity.

15Enterprise inferred
3ICS inferred
1Parent technique
1Related artifact

Detect · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Analyzing failed connections in a network to detect unauthorized activity.

Official D3FEND knowledge-base content

How it works

Connection Attempt Analysis in multiple ways.

Monitoring traffic to unallocated IP space

One approach looks for failed connection attempts against unallocated IP space. First, network traffic is captured to map out the network to identify network assets as well as unallocated IP space. The map is then used to determine if connection attempts are being made to the unallocated IP space.

Monitoring for sequentially transmitted traffic

Another approach passively inspects network traffic with application protocol analyzers observing network activity characteristics such as volume of packets sent/ received, TCP session attributes, and connection information between hosts (start time, source/destination host, services, etc.). Then using pattern matching to identify traffic which appears to be probing for network hosts.

Considerations

  • Implementations that rely on analysis of unallocated IP address space increase in their complexity with network size and decentralized network infrastructure.
  • Inventory of unallocated IP space should be continuously updated to mitigate the risk of false positives.
  • IPv6 also introduces challenges including IPv6 traffic bypassing IPv4 specific protection systems (ex. firewalls and IDS) and complexity in managing both IPv6 and IPv4 addresses.
Bare Metal Cyber interpretation

Implementation perspective

Connection Attempt Analysis should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Intranet Network Traffic.

Use the technique to identify suspicious, unauthorized, or abnormal activity through observable evidence and repeatable analysis.

Questions to ask

  • Which events, states, or artifacts must be observed for the analysis to work?
  • What analytic logic, threshold, comparison, or signature turns observations into a finding?
  • How are expected false positives, blind spots, and environmental variations documented?
  • Who receives the result, and what action is expected when the technique produces a finding?

Evidence and validation

  • Telemetry and data-source configuration records
  • Analytic logic, thresholds, signatures, and version history
  • Test cases demonstrating expected positive and negative results
  • Alert, triage, escalation, and tuning records

Common failure patterns

  • Required telemetry is missing, delayed, or transformed in a way that invalidates the analysis.
  • The technique produces alerts without an accountable triage and response process.
  • Detection coverage is claimed from product deployment without testing the relevant analytic behavior.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Direct child techniques

None listed at this level.

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

analyzesIntranet Network Traffic
Show inferred artifact relationship paths (1)
Connection Attempt AnalysisanalyzesIntranet Network Traffic
Inferred and experimental

Offensive-technique relationships

These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.

ATT&CK Enterprise (15)
ATT&CK for ICS (3)
T0866Exploitation of Remote ServicesInitial Access, Lateral Movement
T0884Connection ProxyCommand and Control
T0886Remote ServicesInitial Access, Lateral Movement
Source record

Authoritative sources