D3-SYSRB

System Rebuild

Rebuild compromised systems from known-good images to ensure complete removal of adversary presence.

D3FEND / Restore

Implementation

  • Maintain golden images
  • Automate system provisioning
  • Document system configurations
  • Validate rebuilt systems
  • Preserve forensic evidence first

Tools

  • Microsoft SCCM
  • Ansible
  • Terraform
  • Packer
  • Kubernetes

ATT&CK mappings

3

MITRE D3FEND ↗