H3XA — Operational Evidence

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Use intrusion detection signatures to block traffic at network boundaries.

59 recorded

Relationships

mitigates

to Adversary-in-the-Middle

Technique

mitigates

to Application Layer Protocol

Technique

mitigates

to ARP Cache Poisoning

Technique

mitigates

to Asymmetric Cryptography

Technique

mitigates

to Bidirectional Communication

Technique

mitigates

to Data Encoding

Technique

mitigates

to Data from Configuration Repository

Technique

mitigates

to Data Obfuscation

Technique

mitigates

to Data Transfer Size Limits

Technique

mitigates

to Dead Drop Resolver

Technique

mitigates

to DHCP Spoofing

Technique

mitigates

to DNS

Technique

mitigates

to Domain Generation Algorithms

Technique

mitigates

to Dynamic Resolution

Technique

mitigates

to Encrypted Channel

Technique

mitigates

Technique

mitigates

to Exfiltration Over Alternative Protocol

Technique

mitigates

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

mitigates

to Exfiltration Over C2 Channel

Technique

mitigates

to Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Technique

mitigates

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

mitigates

to External Proxy

Technique

mitigates

to Fallback Channels

Technique

mitigates

to File Transfer Protocols

Technique

mitigates

to Ingress Tool Transfer

Technique

mitigates

to Internal Proxy

Technique

mitigates

Technique

mitigates

to Lateral Tool Transfer

Technique

mitigates

to Mail Protocols

Technique

mitigates

to Malicious Copy and Paste

Technique

mitigates

to Malicious Image

Technique

mitigates

to Malicious Library

Technique

mitigates

to Malicious Link

Technique

mitigates

to Multi-Stage Channels

Technique

mitigates

to Name Resolution Poisoning and SMB Relay

Technique

mitigates

to Network Device Configuration Dump

Technique

mitigates

to Network Service Discovery

Technique

mitigates

to Non-Application Layer Protocol

Technique

mitigates

to Non-Standard Encoding

Technique

mitigates

to Non-Standard Port

Technique

mitigates

to One-Way Communication

Technique

mitigates

Technique

mitigates

to Protocol or Service Impersonation

Technique

mitigates

to Protocol Tunneling

Technique

mitigates

Technique

mitigates

to Publish/Subscribe Protocols

Technique

mitigates

to Remote Access Tools

Technique

mitigates

Technique

mitigates

to Scheduled Transfer

Technique

mitigates

to SNMP (MIB Dump)

Technique

mitigates

to Spearphishing Attachment

Technique

mitigates

to Standard Encoding

Technique

mitigates

to Steganography

Technique

mitigates

to Symmetric Cryptography

Technique

mitigates

to Template Injection

Technique

mitigates

Technique

mitigates

to User Execution

Technique

mitigates

to Web Protocols

Technique

mitigates

Technique

1 external

References

mitre-attack

M1031