{
  "technique_id": "T1110",
  "d3fend_mappings": [
    {
      "id": "D3-CAA",
      "name": "Connection Attempt Analysis",
      "relationship": "detect",
      "practical_action": "Review failed sign-in bursts, password spray patterns across many accounts from a small set of sources, and any success immediately following a failure streak.\n",
      "tooling": [
        "Sentinel",
        "Entra ID",
        "Defender XDR"
      ]
    },
    {
      "id": "D3-SPP",
      "name": "Strong Password Policy",
      "relationship": "harden",
      "practical_action": "Confirm lockout thresholds, smart lockout, and banned-password lists are enforced; tighten where legacy or service accounts are exempt.\n",
      "tooling": [
        "Entra ID",
        "Group Policy"
      ]
    },
    {
      "id": "D3-MFA",
      "name": "Multi-factor Authentication",
      "relationship": "harden",
      "practical_action": "Confirm MFA is enforced for the affected account and that legacy authentication protocols (which bypass MFA) are blocked.\n",
      "tooling": [
        "Entra ID Conditional Access"
      ]
    },
    {
      "id": "D3-CR",
      "name": "Credential Revocation",
      "relationship": "evict",
      "practical_action": "Revoke sessions and refresh tokens if a spray attempt succeeded.",
      "tooling": [
        "Microsoft Graph",
        "Entra ID"
      ]
    }
  ]
}