M1037: Filter Network Traffic
Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:
Ingress Traffic Filtering:
- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.
Egress Traffic Filtering:
- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.
Protocol-Based Filtering:
- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.
Network Segmentation:
- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.
Application Layer Filtering:
- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.
Security context for executives and security teams
M1037: Filter Network Traffic describes Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Lim...
Executive priority
M1037: Filter Network Traffic is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M1037: Filter Network Traffic by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M1037: Filter Network Traffic appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Filter Network Traffic
Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:
Ingress Traffic Filtering:
- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.
Egress Traffic Filtering:
- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.
Protocol-Based Filtering:
- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.
Network Segmentation:
- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.
Application Layer Filtering:
- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1205.001 | Port KnockingSub-technique | Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented. |
| Enterprise | T1557 | Adversary-in-the-Middle | Use network appliances and host-based security software to block network traffic that is not necessary within the environment, such as legacy protocols that may be leveraged for AiTM conditions. |
| Enterprise | T1696 | Anti-Automation Evasion | Use web application firewalls, bot-management controls, and application-layer traffic filtering to restrict automated access to protected resources. Apply filtering using request characteristics, client/session reputation, behavioral signals, rate limits, and validated client or bot identity. Block, rate-limit, or challenge traffic that violates established access policies. |
| Enterprise | T1572 | Protocol Tunneling | Consider filtering network traffic to untrusted or known bad domains and resources. |
| Enterprise | T1499.003 | Application Exhaustion FloodSub-technique | Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.CitationCERT-EU DDoS March 2017 Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. |
| Enterprise | T1190 | Exploit Public-Facing Application | Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack. |
| Enterprise | T1557.003 | DHCP SpoofingSub-technique | Consider filtering DHCP traffic on ports 67 and 68 to/from unknown or untrusted DHCP servers. Additionally, port security may also be enabled on layer switches. Furthermore, consider enabling DHCP snooping on layer 2 switches as it will prevent DHCP spoofing attacks and starvation attacks. Consider tracking available IP addresses through a script or a tool. Additionally, block DHCPv6 traffic and incoming router advertisements, especially if IPv6 is not commonly used in the network.Citationntlm_relaying_kerberos_del |
| Enterprise | T1498.002 | Reflection AmplificationSub-technique | When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.CitationCERT-EU DDoS March 2017 Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.CitationCERT-EU DDoS March 2017 As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.CitationCERT-EU DDoS March 2017 |
| Enterprise | T1218 | System Binary Proxy Execution | Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. |
| Enterprise | T1071.004 | DNSSub-technique | Consider filtering DNS requests to unknown, untrusted, or known bad domains and resources. Resolving DNS requests with on-premise/proxy servers may also disrupt adversary attempts to conceal data within DNS packets. |
| Enterprise | T1090.003 | Multi-hop ProxySub-technique | Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting. |
| Enterprise | T1197 | BITS Jobs | Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic. |
| Enterprise | T1205 | Traffic Signaling | Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented. |
| Enterprise | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 ProtocolSub-technique | Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. |
| Enterprise | T1071.003 | Mail ProtocolsSub-technique | Limit the ability of servers and critical systems to initiate outbound email communications. Filtering SMTP/IMAP/POP3 traffic to only trusted mail servers reduces the risk of attackers using compromised systems to exfiltrate data via email or to receive commands from attacker-controlled email accounts. |
| Enterprise | T1021.005 | VNCSub-technique | VNC defaults to TCP ports 5900 for the server, 5800 for browser access, and 5500 for a viewer in listening mode. Filtering or blocking these ports will inhibit VNC traffic utilizing default ports. |
| Enterprise | T1498 | Network Denial of Service | When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.CitationCERT-EU DDoS March 2017 Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.CitationCERT-EU DDoS March 2017 As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.CitationCERT-EU DDoS March 2017 |
| Enterprise | T1218.012 | VerclsidSub-technique | Consider modifying host firewall rules to prevent egress traffic from verclsid.exe. |
| Enterprise | T1499.002 | Service Exhaustion FloodSub-technique | Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.CitationCERT-EU DDoS March 2017 Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. |
| Enterprise | T1499 | Endpoint Denial of Service | Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.CitationCERT-EU DDoS March 2017 Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies. |
| Enterprise | T1570 | Lateral Tool Transfer | Consider using the host firewall to restrict file sharing communications such as SMB. CitationMicrosoft Preventing SMB |
| Enterprise | T1552 | Unsecured Credentials | Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.CitationRedLock Instance Metadata API 2018 |
| Enterprise | T1499.004 | Application or System ExploitationSub-technique | Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.CitationCERT-EU DDoS March 2017 Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. |
| Enterprise | T1071.002 | File Transfer ProtocolsSub-technique | Filter outbound FTP/SFTP traffic from sensitive systems, allowing file transfers only to trusted internal or known IP addresses. This measure can prevent attackers from transferring data or payloads via FTP/SFTP channels to or from unauthorized external systems. |
| Enterprise | T1048 | Exfiltration Over Alternative Protocol | Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data. |
| Enterprise | T1696.002 | Avoid CAPTCHASub-technique | Apply bot-management and application-layer filtering independently of whether a CAPTCHA challenge is triggered. Evaluate protected requests using behavioral, client/session, rate, reputation, token, and automation signals, and block or rate-limit activity that violates policy even when no CAPTCHA was presented. |
| Enterprise | T1219 | Remote Access Tools | Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software. |
| Enterprise | T1187 | Forced Authentication | Block SMB traffic from exiting an enterprise network with egress filtering or by blocking TCP ports 139, 445 and UDP port 137. Filter or block WebDAV protocol traffic from exiting the network. If access to external resources over SMB and WebDAV is necessary, then traffic should be tightly limited with allowlisting. CitationUS-CERT SMB Security CitationUS-CERT APT Energy Oct 2017 |
| Enterprise | T1205.002 | Socket FiltersSub-technique | Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented. |
| Enterprise | T1498.001 | Direct Network FloodSub-technique | When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.CitationCERT-EU DDoS March 2017 Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.CitationCERT-EU DDoS March 2017 As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.CitationCERT-EU DDoS March 2017 |
| Enterprise | T1602.002 | Network Device Configuration DumpSub-technique | Apply extended ACLs to block unauthorized protocols outside the trusted network.CitationUS-CERT TA17-156A SNMP Abuse 2017 |
| Enterprise | T1105 | Ingress Tool Transfer | Use network filtering to block outbound traffic from compromised systems to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access. |
| Enterprise | T1219.002 | Remote Desktop SoftwareSub-technique | Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software. |
| Enterprise | T1095 | Non-Application Layer Protocol | Filter network traffic to prevent use of protocols across the network boundary that are unnecessary. If VMCI is not required in ESXi environments, consider restricting guest virtual machines from accessing VMCI services.CitationBroadcom VMCI Firewall |
| Enterprise | T1048.003 | Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique | Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. |
| Enterprise | T1071.005 | Publish/Subscribe ProtocolsSub-technique | Consider filtering publish/subscribe protocol requests to untrusted or known bad resources over irregular ports (e.g. MQTT’s standard ports are 1883 or 8883). |
| Enterprise | T1090 | Proxy | Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting. |
| Enterprise | T1499.001 | OS Exhaustion FloodSub-technique | Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.CitationCERT-EU DDoS March 2017 Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies. |
| Enterprise | T1537 | Transfer Data to Cloud Account | Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs. |
| Enterprise | T1602 | Data from Configuration Repository | Apply extended ACLs to block unauthorized protocols outside the trusted network.CitationUS-CERT TA17-156A SNMP Abuse 2017 |
| Enterprise | T1599 | Network Boundary Bridging | Upon identifying a compromised network device being used to bridge a network boundary, block the malicious packets using an unaffected network device in path, such as a firewall or a router that has not been compromised. Continue to monitor for additional activity and to ensure that the blocks are indeed effective. |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | Consider using the host firewall to restrict file sharing communications such as SMB. CitationMicrosoft Preventing SMB |
| Enterprise | T1557.002 | ARP Cache PoisoningSub-technique | Consider enabling DHCP Snooping and Dynamic ARP Inspection on switches to create mappings between IP addresses requested via DHCP and ARP tables and tie the values to a port on the switch that may block bogus traffic.CitationCisco ARP Poisoning Mitigation 2016CitationJuniper DAI 2020 |
| Enterprise | T1530 | Data from Cloud Storage | Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data. |
| Enterprise | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolSub-technique | Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Restrict and monitor outbound web traffic (HTTP/HTTPS) from critical servers to only approved destinations. Limiting the ability to initiate outbound HTTP/HTTPS connections, especially from public-facing servers, can prevent attackers from using tools like curl or wget to communicate with external C2 servers or download malicious payloads. |
| Enterprise | T1602.001 | SNMP (MIB Dump)Sub-technique | Apply extended ACLs to block unauthorized protocols outside the trusted network.CitationUS-CERT TA17-156A SNMP Abuse 2017 |
| Enterprise | T1071 | Application Layer Protocol | Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. |
| Enterprise | T1599.001 | Network Address Translation TraversalSub-technique | Block Traffic Upon identifying a compromised network device being used to bridge a network boundary, block the malicious packets using an unaffected network device in path, such as a firewall or a router that has not been compromised. Continue to monitor for additional activity and to ensure that the blocks are indeed effective. |
| Enterprise | T1557.001 | Name Resolution Poisoning and SMB RelaySub-technique | Use host-based security software to block LLMNR/NetBIOS/mDNS traffic. Enabling SMB Signing can stop NTLMv2 relay attacks.Citationbyt3bl33d3r NTLM RelayingCitationSecure Ideas SMB RelayCitationMicrosoft SMB Packet Signing |
| Enterprise | T1696.001 | Automate CAPTCHA CompletionSub-technique | Do not treat successful CAPTCHA completion alone as sufficient evidence that subsequent activity is human-generated. Continue evaluating requests using bot classification, request rate, client/session characteristics, token reuse, source reputation, and behavioral signals after successful challenge completion. Block or rate-limit activity that remains inconsistent with expected human use. |
| Enterprise | T1552.005 | Cloud Instance Metadata APISub-technique | Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.CitationRedLock Instance Metadata API 2018 |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.2 | Current bundle | 8601e69399ff… | ||
| 19.2 | 1.2 | Older bundle | 8601e69399ff… | ||
| 19.1 | 1.2 | Older bundle | 8601e69399ff… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackM1037Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.