https://cybersecuritytracker.ai/defensive-actions?cat=networkCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1105cst-defensive-M1031-T1105Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1105cst-defensive-M1037-T1105Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1071cst-defensive-M1031-T1071Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1071cst-defensive-M1037-T1071Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1057-T1005cst-defensive-M1057-T1005Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or maliciSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1017-T1027cst-defensive-M1017-T1027User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modulSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1040-T1027cst-defensive-M1040-T1027Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures: Suspicious Process Behavior: Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1027cst-defensive-M1047-T1027Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1049-T1027cst-defensive-M1049-T1027Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be impSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1037cst-defensive-M1022-T1037Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1024-T1037cst-defensive-M1024-T1037Restricting registry permissions involves configuring access control settings for sensitive registry keys and hives to ensure that only authorized users or processes can make modifications. By limiting access, organizations can prevent unauthorized changes that adversaries might use for persistence, privilege escalation, or defense evasion. This mitigation can be implemented through the following measures: Review and Adjust Permissions on Critical Keys - Regularly review permissions on keys suSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1048-003cst-defensive-M1030-T1048-003Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1048-003cst-defensive-M1031-T1048-003Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1048-003cst-defensive-M1037-T1048-003Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1057-T1048-003cst-defensive-M1057-T1048-003Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or maliciSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1038-T1059-004cst-defensive-M1038-T1059-004Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures: Application Control: - Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applicatSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1071-001cst-defensive-M1031-T1071-001Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1071-001cst-defensive-M1037-T1071-001Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1071-002cst-defensive-M1031-T1071-002Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1071-002cst-defensive-M1037-T1071-002Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1020-T1090cst-defensive-M1020-T1090SSL/TLS inspection involves decrypting encrypted network traffic to examine its content for signs of malicious activity. This capability is crucial for detecting threats that use encryption to evade detection, such as phishing, malware, or data exfiltration. After inspection, the traffic is re-encrypted and forwarded to its destination. This mitigation can be implemented through the following measures: Deploy SSL/TLS Inspection Appliances: - Implement SSL/TLS inspection solutions to decrypt anSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1090cst-defensive-M1031-T1090Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1037-T1090cst-defensive-M1037-T1090Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1090-001cst-defensive-M1031-T1090-001Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1026-T1495cst-defensive-M1026-T1495Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures: Account Permissions and Roles: - Implement RBAC and least privilege principles to allocate permSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1046-T1495cst-defensive-M1046-T1495Boot Integrity ensures that a system starts securely by verifying the integrity of its boot process, operating system, and associated components. This mitigation focuses on leveraging secure boot mechanisms, hardware-rooted trust, and runtime integrity checks to prevent tampering during the boot sequence. It is designed to thwart adversaries attempting to modify system firmware, bootloaders, or critical OS components. This mitigation can be implemented through the following measures: ImplementaSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1051-T1495cst-defensive-M1051-T1495Software updates ensure systems are protected against known vulnerabilities by applying patches and upgrades provided by vendors. Regular updates reduce the attack surface and prevent adversaries from exploiting known security gaps. This includes patching operating systems, applications, drivers, and firmware. This mitigation can be implemented through the following measures: Regular Operating System Updates - Implementation: Apply the latest Windows security updates monthly using WSUS (WindowSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1505cst-defensive-M1018-T1505User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1024-T1505cst-defensive-M1024-T1505Restricting registry permissions involves configuring access control settings for sensitive registry keys and hives to ensure that only authorized users or processes can make modifications. By limiting access, organizations can prevent unauthorized changes that adversaries might use for persistence, privilege escalation, or defense evasion. This mitigation can be implemented through the following measures: Review and Adjust Permissions on Critical Keys - Regularly review permissions on keys suSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1026-T1505cst-defensive-M1026-T1505Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures: Account Permissions and Roles: - Implement RBAC and least privilege principles to allocate permSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1042-T1505cst-defensive-M1042-T1505Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or secuSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1045-T1505cst-defensive-M1045-T1505Code Signing is a security process that ensures the authenticity and integrity of software by digitally signing executables, scripts, and other code artifacts. It prevents untrusted or malicious code from executing by verifying the digital signatures against trusted sources. Code signing protects against tampering, impersonation, and distribution of unauthorized or malicious software, forming a critical defense against supply chain and software exploitation attacks. This mitigation can be implemSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1046-T1505cst-defensive-M1046-T1505Boot Integrity ensures that a system starts securely by verifying the integrity of its boot process, operating system, and associated components. This mitigation focuses on leveraging secure boot mechanisms, hardware-rooted trust, and runtime integrity checks to prevent tampering during the boot sequence. It is designed to thwart adversaries attempting to modify system firmware, bootloaders, or critical OS components. This mitigation can be implemented through the following measures: ImplementaSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1505cst-defensive-M1047-T1505Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1018-T1505-003cst-defensive-M1018-T1505-003User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimumSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1042-T1505-003cst-defensive-M1042-T1505-003Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures: Remove Legacy Software: - Use Case: Disable or remove older versions of software that no longer receive updates or secuSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1026-T1542-005cst-defensive-M1026-T1542-005Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures: Account Permissions and Roles: - Implement RBAC and least privilege principles to allocate permSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1028-T1542-005cst-defensive-M1028-T1542-005Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques. This mitigation can be implemented through the following measures: Disable Unused Features: - Turn off SMBv1, LLMNR, and NetBIOS where not nSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1542-005cst-defensive-M1031-T1542-005Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1035-T1542-005cst-defensive-M1035-T1542-005Restrict access to network resources, such as file shares, remote systems, and services, to only those users, accounts, or systems with a legitimate business requirement. This can include employing technologies like network concentrators, RDP gateways, and zero-trust network access (ZTNA) models, alongside hardening services and protocols. This mitigation can be implemented through the following measures: Audit and Restrict Access: - Regularly audit permissions for file shares, network serviceSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1046-T1542-005cst-defensive-M1046-T1542-005Boot Integrity ensures that a system starts securely by verifying the integrity of its boot process, operating system, and associated components. This mitigation focuses on leveraging secure boot mechanisms, hardware-rooted trust, and runtime integrity checks to prevent tampering during the boot sequence. It is designed to thwart adversaries attempting to modify system firmware, bootloaders, or critical OS components. This mitigation can be implemented through the following measures: ImplementaSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1542-005cst-defensive-M1047-T1542-005Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1022-T1552-004cst-defensive-M1022-T1552-004Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files. Enforce Least Privilege Permissions: - Remove unnecessary write permissions on sensitive files and directories. - Use file ownershipSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1027-T1552-004cst-defensive-M1027-T1552-004Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures: Windows Systems: - Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.gSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1041-T1552-004cst-defensive-M1041-T1552-004Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures: Encrypt Data at Rest: - Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices. - Implementation: Implement BitLocker for Windows systems or FileVault for macOS devSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1047-T1552-004cst-defensive-M1047-T1552-004Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures. Auditing is applicable to all systems usedSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1017-T1557cst-defensive-M1017-T1557User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures: Create Comprehensive Training Programs: - Design training modulSun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1030-T1557cst-defensive-M1030-T1557Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1031-T1557cst-defensive-M1031-T1557Use intrusion detection signatures to block traffic at network boundaries.Sun, 26 Jul 2026 22:05:07 GMThttps://cybersecuritytracker.ai/defensive-actions?entry=M1035-T1557cst-defensive-M1035-T1557Restrict access to network resources, such as file shares, remote systems, and services, to only those users, accounts, or systems with a legitimate business requirement. This can include employing technologies like network concentrators, RDP gateways, and zero-trust network access (ZTNA) models, alongside hardening services and protocols. This mitigation can be implemented through the following measures: Audit and Restrict Access: - Regularly audit permissions for file shares, network serviceSun, 26 Jul 2026 22:05:07 GMT