D3-AL

Account Locking

Lock or disable compromised accounts to prevent adversary access while investigation continues.

D3FEND / Evict

Implementation

  • Establish account lockout procedures
  • Coordinate with IT and HR
  • Document access before lockout
  • Monitor for access attempts
  • Plan for service account impacts

Tools

  • Active Directory
  • Azure AD
  • Okta
  • CyberArk
  • SailPoint

ATT&CK mappings

3

MITRE D3FEND ↗