MITRE Shield will be retired on October 18th in favor of MITRE Engage. To learn more, click here.

Active Defense Matrix

The Shield matrix consists of the following core components:

Tactics, denoting what the defender is trying to accomplish (the columns).
Techniques, describing how the defense achieves the tactic(s) (the individual cells).

Channel	Collect	Contain	Detect	Disrupt	Facilitate	Legitimize	Test
Admin Access	API Monitoring	Admin Access	API Monitoring	Admin Access	Admin Access	Application Diversity	Admin Access
API Monitoring	Application Diversity	Baseline	Application Diversity	Application Diversity	Application Diversity	Burn-In	API Monitoring
Application Diversity	Backup and Recovery	Decoy Account	Baseline	Backup and Recovery	Behavioral Analytics	Decoy Account	Application Diversity
Decoy Account	Decoy Account	Decoy Network	Behavioral Analytics	Baseline	Burn-In	Decoy Content	Backup and Recovery
Decoy Content	Decoy Content	Detonate Malware	Decoy Account	Behavioral Analytics	Decoy Account	Decoy Credentials	Decoy Account
Decoy Credentials	Decoy Credentials	Hardware Manipulation	Decoy Content	Decoy Content	Decoy Content	Decoy Diversity	Decoy Content
Decoy Diversity	Decoy Network	Isolation	Decoy Credentials	Decoy Credentials	Decoy Credentials	Decoy Network	Decoy Credentials
Decoy Network	Decoy System	Migrate Attack Vector	Decoy Diversity	Decoy Network	Decoy Diversity	Decoy Persona	Decoy Diversity
Decoy Persona	Detonate Malware	Network Manipulation	Decoy Network	Email Manipulation	Decoy Persona	Decoy Process	Decoy Network
Decoy Process	Email Manipulation	Security Controls	Decoy Persona	Hardware Manipulation	Decoy System	Decoy System	Decoy Persona
Decoy System	Hunting	Software Manipulation	Decoy System	Isolation	Network Diversity	Network Diversity	Decoy System
Detonate Malware	Network Diversity		Email Manipulation	Network Manipulation	Network Manipulation	Pocket Litter	Detonate Malware
Migrate Attack Vector	Network Monitoring		Hunting	Security Controls	Peripheral Management		Migrate Attack Vector
Network Diversity	PCAP Collection		Isolation	Standard Operating Procedure	Pocket Litter		Network Diversity
Network Manipulation	Peripheral Management		Network Manipulation	User Training	Security Controls		Network Manipulation
Peripheral Management	Protocol Decoder		Network Monitoring	Software Manipulation	Software Manipulation		Peripheral Management
Pocket Litter	Security Controls		PCAP Collection				Pocket Litter
Security Controls	System Activity Monitoring		Pocket Litter				Security Controls
Software Manipulation	Software Manipulation		Protocol Decoder				Software Manipulation
			Standard Operating Procedure
			System Activity Monitoring
			User Training
			Software Manipulation

Link	Preview