{
  "technique_id": "T1021",
  "d3fend_mappings": [
    {
      "id": "D3-RTSD",
      "name": "Remote Terminal Session Detection",
      "relationship": "detect",
      "practical_action": "Review remote logon events (RDP/SSH/WinRM/SMB) for unusual source-destination-account combinations.\n",
      "tooling": [
        "Defender for Endpoint",
        "Sentinel"
      ]
    },
    {
      "id": "D3-CAA",
      "name": "Connection Attempt Analysis",
      "relationship": "detect",
      "practical_action": "Detect unusual internal RDP/SSH/SMB connection patterns indicating lateral movement.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-ST",
      "name": "Session Termination",
      "relationship": "evict",
      "practical_action": "Terminate the remote session and revoke the account's credentials/sessions if malicious.",
      "tooling": [
        "Microsoft Graph",
        "Active Directory"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Restrict remote-service access via firewall/segmentation to expected jump hosts only.",
      "tooling": [
        "Firewall",
        "Group Policy"
      ]
    }
  ]
}