D3-EDL

Executable Denylisting

Description

Blocking the execution of files on a host in accordance with defined application policy rules.

Mapped SPARTA techniques

No techniques mapped to this control.

Cross-framework references

Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.

Counters 51 in MITRE ATT&CK Enterprise

T1007 System Service Discovery
T1010 Application Window Discovery
T1016 System Network Configuration Discovery
T1018 Remote System Discovery
T1027.001 Binary Padding
T1027.002 Software Packing
T1027.004 Compile After Delivery
T1033 System Owner/User Discovery
T1036.001 Invalid Code Signature
T1036.003 Rename Legitimate Utilities
T1037.001 Logon Script (Windows)
T1037.002 Login Hook
T1037.003 Network Logon Script
T1037.004 RC Scripts
T1047 Windows Management Instrumentation
T1053 Scheduled Task/Job
T1055.003 Thread Execution Hijacking
T1055.004 Asynchronous Procedure Call
T1055.013 Process Doppelgänging
T1057 Process Discovery
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1124 System Time Discovery
T1134.004 Parent PID Spoofing
T1137.001 Office Template Macros
T1140 Deobfuscate/Decode Files or Information
T1204.002 Malicious File
T1218.001 Compiled HTML File
T1218.002 Control Panel
T1218.003 CMSTP
T1218.005 Mshta
T1218.011 Rundll32
T1220 XSL Script Processing
T1505.001 SQL Stored Procedures
T1505.003 Web Shell
T1546.002 Screensaver
T1546.005 Trap
T1546.006 LC_LOAD_DYLIB Addition
T1546.008 Accessibility Features
T1546.009 AppCert DLLs
T1546.010 AppInit DLLs
T1546.013 PowerShell Profile
T1546.015 Component Object Model Hijacking
T1547.001 Registry Run Keys / Startup Folder
T1547.009 Shortcut Modification
T1548.002 Bypass User Account Control
T1562.003 Impair Command History Logging
T1565.003 Runtime Data Manipulation
T1574.007 Path Interception by PATH Environment Variable
T1574.008 Path Interception by Search Order Hijacking
T1574.009 Path Interception by Unquoted Path

Cite as SafeMode Space, d3fend D3-EDL.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description

›Mapped SPARTA techniques

›Cross-framework references

Counters 51 in MITRE ATT&CK Enterprise

Description

Mapped SPARTA techniques

Cross-framework references