Lion Cipher Lab
Map defenses to attacks with MITRE D3FEND
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
MITRE ATT&CK gave the whole industry a shared language for what adversaries do — but it stops there on purpose. Read a technique page and it tells you the behaviour, some detections, and some mitigations, yet it will not organize your defensive options, rank them, or tell you how one countermeasure relates to another. That is exactly the gap MITRE D3FEND fills: it is a free, public knowledge graph of cybersecurity countermeasures, and its key move is to tie every defensive technique to the digital artifacts it operates on — a file, a process, a piece of outbound network traffic. Because…
What you'll learn
- what MITRE D3FEND is and how it complements ATT&CK
- the seven D3FEND defensive tactics (Model, Harden, Detect, Isolate, Deceive, Evict, Restore)
- reading a D3FEND defensive-technique page
- the digital artifact as the join between an ATT&CK technique and a D3FEND countermeasure
- using the ATT&CK-to-D3FEND lookup to generate candidate defenses
- building an ATT&CK -> artifact -> D3FEND -> control mapping table
- prioritizing countermeasures (harden first, detect where you cannot, isolate to limit blast radius)
- treating D3FEND mappings as candidate lists, not prescriptions
Steps in this lab
- Offense has a map — where is the one for defense?
- The D3FEND matrix: seven defensive tactics
- Digital artifacts: the noun that joins offense and defense
- A worked example: from T1566 Phishing to candidate defenses
- The adversary profile we will defend against
- Build the table, rows 1-2: phishing and user execution
- Build the table, rows 3-4: command-and-control and exfiltration
- Prioritize: harden first, detect where you cannot, isolate to limit blast radius
- Judgment: D3FEND is a thinking tool, not a checklist