Definition
Restricting network traffic originating from any location.
Implementation perspective
Network Traffic Filtering should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Email, Network Traffic, OT Protocol Message, Remote Command.
Use the technique to create a logical or physical boundary that limits access, execution, communication, or movement.
Questions to ask
- What is being isolated, from whom or what, and under which conditions?
- Which flows or operations remain explicitly allowed across the boundary?
- What happens when the isolation mechanism fails or loses policy context?
- How is the boundary tested for alternate paths, bypasses, and unintended dependencies?
Evidence and validation
- Architecture and data-flow diagrams showing the isolation boundary
- Policy, rule, or configuration exports from enforcing components
- Tests of allowed, denied, and failure-state behavior
- Monitoring evidence for boundary violations and policy changes
Common failure patterns
- The intended boundary has undocumented alternate paths or inherited trust relationships.
- Rules accumulate without ownership, review, or removal of obsolete exceptions.
- Isolation is assumed from network location while application, identity, or management paths remain open.
This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.
Technique hierarchy
Top-level family
Parent techniques
Direct child techniques
Artifacts and ontology entities
These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.
Explicit technique relationships
filtersNetwork Traffic
filtersOT Protocol Message
filtersRemote Command
Show inferred artifact relationship paths (4)
Email FilteringfiltersEmail
Network Traffic FilteringfiltersNetwork Traffic
Network Traffic FilteringfiltersOT Protocol Message
Network Traffic FilteringfiltersRemote Command
Offensive-technique relationships
These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.
ATT&CK Enterprise (74)
T1001Data ObfuscationCommand and ControlT1003.006DCSyncCredential AccessT1008Fallback ChannelsCommand and ControlT1011Exfiltration Over Other Network MediumExfiltrationT1018Remote System DiscoveryDiscoveryT1020Automated ExfiltrationExfiltrationT1021Remote ServicesLateral MovementT1021.001Remote Desktop ProtocolLateral MovementT1021.004SSHLateral MovementT1029Scheduled TransferExfiltrationT1030Data Transfer Size LimitsExfiltrationT1041Exfiltration Over C2 ChannelExfiltrationT1047Windows Management InstrumentationExecutionT1048Exfiltration Over Alternative ProtocolExfiltrationT1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolExfiltrationT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolExfiltrationT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolExfiltrationT1071Application Layer ProtocolCommand and ControlT1071.001Web ProtocolsCommand and ControlT1071.002File Transfer ProtocolsCommand and ControlT1071.003Mail ProtocolsCommand and ControlT1071.004DNSCommand and ControlT1090.001Internal ProxyCommand and ControlT1090.002External ProxyCommand and ControlT1090.003Multi-hop ProxyCommand and ControlT1090.004Domain FrontingCommand and ControlT1095Non-Application Layer ProtocolCommand and ControlT1098.001Additional Cloud CredentialsPersistence, Privilege EscalationT1102Web ServiceCommand and ControlT1104Multi-Stage ChannelsCommand and ControlT1105Ingress Tool TransferCommand and ControlT1110.003Password SprayingCredential AccessT1110.004Credential StuffingCredential AccessT1114.001Local Email CollectionCollectionT1132Data EncodingCommand and ControlT1185Browser Session HijackingCollectionT1189Drive-by CompromiseInitial AccessT1190Exploit Public-Facing ApplicationInitial AccessT1197BITS JobsExecution, Persistence, StealthT1199Trusted RelationshipInitial AccessT1204.001Malicious LinkExecutionT1205Traffic SignalingCommand and Control, Persistence, StealthT1205.001Port KnockingCommand and Control, Persistence, StealthT1207Rogue Domain ControllerDefense ImpairmentT1210Exploitation of Remote ServicesLateral MovementT1218.003CMSTPStealthT1219Remote Access ToolsCommand and ControlT1498.001Direct Network FloodImpactT1498.002Reflection AmplificationImpactT1499.002Service Exhaustion FloodImpactT1534Internal SpearphishingLateral MovementT1542.005TFTP BootPersistence, StealthT1546.003Windows Management Instrumentation Event SubscriptionPersistence, Privilege EscalationT1546.008Accessibility FeaturesPersistence, Privilege EscalationT1550.001Application Access TokenLateral MovementT1550.004Web Session CookieLateral MovementT1557Adversary-in-the-MiddleCollection, Credential AccessT1557.001Name Resolution Poisoning and SMB RelayCollection, Credential AccessT1557.003DHCP SpoofingCollection, Credential AccessT1558.003KerberoastingCredential Access
Showing the first 60 of 74 source-derived relationships. Open the official D3FEND technique for the current graph view.
ATT&CK for ICS (44)
T0800Activate Firmware Update ModeInhibit Response Function
T0801Monitor Process StateCollection
T0802Automated CollectionCollection
T0803Block Command MessageInhibit Response Function
T0805Block Serial COMInhibit Response Function
T0806Brute Force I/OImpair Process Control
T0809Data DestructionInhibit Response Function
T0811Data from Information RepositoriesCollection
T0814Denial of ServiceInhibit Response Function
T0817Drive-by CompromiseInitial Access
T0819Exploit Public-Facing ApplicationInitial Access
T0821Modify controller TaskingExecution
T0822External Remote ServicesInitial Access
T0830Adversary-in-the-MiddleCollection
T0835Manipulate I/O ImageInhibit Response Function
T0836Modify ParameterImpair Process Control
T0838Modify Alarm SettingsInhibit Response Function
T0839Module FirmwareImpair Process Control, Persistence
T0840Network Connection EnumerationDiscovery
T0842Network SniffingDiscovery
T0843Program DownloadLateral Movement
T0845Program UploadCollection
T0846Remote System DiscoveryDiscovery
T0848Rogue MasterInitial Access
T0855Unauthorized Command MessageImpair Process Control
T0856Spoof Reporting MessageEvasion, Impair Process Control
T0857System FirmwareInhibit Response Function, Persistence
T0858Change Operating ModeEvasion, Execution
T0861Point & Tag IdentificationCollection
T0865Spearphishing AttachmentInitial Access
T0866Exploitation of Remote ServicesInitial Access, Lateral Movement
T0868Detect Operating ModeCollection
T0869Standard Application Layer ProtocolCommand and Control
T0873Project File InfectionPersistence
T0877I/O ImageCollection
T0878Alarm SuppressionInhibit Response Function
T0884Connection ProxyCommand and Control
T0885Commonly Used PortCommand and Control
T0886Remote ServicesInitial Access, Lateral Movement
T0888Remote System Information DiscoveryDiscovery
T0889Modify ProgramPersistence
T0893Data from Local SystemCollection
T0894System Binary Proxy ExecutionEvasion
T0895Autorun ImageExecution
Authoritative sources
- Open this technique on the official D3FEND website ↗
- Open the official ontology resources ↗
- Active firewall system and methodology ↗McAfee LLC · Emilio Villa, Adrian Zidaritz, Michael David Varga, Gerhard Eschelbeck, Michael Kevin Jones, Mark James McArdle · PatentReference
- Automatically generating rules for connection security ↗Microsoft · Charles D. Bassett; Eran Yariv; Ian M. Carbaugh; Lokesh Srinivas Koppolu; Maksim Noy; Sarah A. Wahlert; Pradeep Bahl · PatentReference
- FWTK - Firewall Toolkit ↗InternetArticleReference
- Firewall for interent access ↗Secure Computing LLC · Edward B Stockwell, Alan E Klietz · PatentReference
- Firewall for processing a connectionless network packet ↗National Security Agency · Patrick W. Dowd, John T. McHenry · PatentReference
- Firewall for processing connection-oriented and connectionless datagrams over a connection-oriented network ↗National Security Agency · Patrick W. Dowd, John T. McHenry · PatentReference
- Firewalls that filter based upon protocol commands ↗Intel Corp · James E. Toga · PatentReference
- Method for controlling computer network security ↗Checkpoint Software Technologies Ltd · Gil Shwed · PatentReference
- Network firewall with proxy ↗Secure Computing LLC · Michael W Green, Ricky Ronald Kruse · PatentReference
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by The MITRE Corporation. MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Use of D3FEND source material is subject to the official Terms of Use.