d3fend-evict

What problem does it solve?

D3FEND-evict provides a structured approach to contain active cyber incidents by evicting adversaries through credential revocation, account locking, and targeted file and process removal. It translates MITRE D3FEND containment techniques into actionable guidance for security teams and automated playbooks. It clarifies when to invoke eviction workflows and how to coordinate restoration and evidence preservation.

Core Features & Use Cases

• Credential eviction: revoke compromised credentials and lock accounts to prevent reuse.
• Object & file eviction: remove malicious files, registry keys, and related artifacts.
• Process & system eviction: suspend or terminate malicious processes and perform safe shutdowns when required.
• Reference material: guidance and procedures stored under references/ for detailed steps during execution.

Quick Start

Initiate d3fend-evict containment workflows during an active incident to begin credential, object, and process eviction procedures.