{
  "name": "Segmentation as a mitigation in ATT&CK",
  "versions": {
    "attack": "19.1",
    "navigator": "5.2.0",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Enterprise ATT&CK techniques mapped by MITRE to mitigation M1030 Network Segmentation, refreshed from ATT&CK v19.1. microsegment.io adds the microsegmentation lens: reduce unnecessary reachability, constrain lateral movement, protect management and identity paths, limit egress, and make containment operational.",
  "filters": {
    "platforms": [
      "PRE",
      "Windows",
      "Linux",
      "macOS",
      "Network",
      "AWS",
      "GCP",
      "Azure",
      "Azure AD",
      "Office 365",
      "SaaS",
      "IaaS",
      "Containers"
    ]
  },
  "sorting": 0,
  "layout": {
    "layout": "side",
    "showID": false,
    "showName": true,
    "showAggregateScores": false,
    "countUnscored": false,
    "aggregateFunction": "average",
    "expandedSubtechniques": "annotated"
  },
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1021.001",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Remote Desktop Protocol. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1021.003",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Distributed Component Object Model. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1021.006",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Windows Remote Management. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1040",
      "tactic": "credential-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Network Sniffing. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1040",
      "tactic": "discovery",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Network Sniffing. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1046",
      "tactic": "discovery",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Network Service Discovery. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1048",
      "tactic": "exfiltration",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Exfiltration Over Alternative Protocol. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1048.001",
      "tactic": "exfiltration",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1048.002",
      "tactic": "exfiltration",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1048.003",
      "tactic": "exfiltration",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Exfiltration Over Unencrypted Non-C2 Protocol. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1072",
      "tactic": "execution",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Software Deployment Tools. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1072",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Software Deployment Tools. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1095",
      "tactic": "command-and-control",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Non-Application Layer Protocol. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1098",
      "tactic": "persistence",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Account Manipulation. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1098",
      "tactic": "privilege-escalation",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Account Manipulation. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1098.001",
      "tactic": "persistence",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Additional Cloud Credentials. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1098.001",
      "tactic": "privilege-escalation",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Additional Cloud Credentials. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1133",
      "tactic": "initial-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for External Remote Services. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1133",
      "tactic": "persistence",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for External Remote Services. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1136",
      "tactic": "persistence",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Create Account. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1136.002",
      "tactic": "persistence",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Domain Account. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1136.003",
      "tactic": "persistence",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Cloud Account. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1190",
      "tactic": "initial-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Exploit Public-Facing Application. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1199",
      "tactic": "initial-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Trusted Relationship. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1210",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Exploitation of Remote Services. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1482",
      "tactic": "discovery",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Domain Trust Discovery. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1489",
      "tactic": "impact",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Service Stop. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1552.007",
      "tactic": "credential-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Container API. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1557",
      "tactic": "collection",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Adversary-in-the-Middle. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1557",
      "tactic": "credential-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Adversary-in-the-Middle. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1557.001",
      "tactic": "collection",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Name Resolution Poisoning and SMB Relay. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1557.001",
      "tactic": "credential-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Name Resolution Poisoning and SMB Relay. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1563",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Remote Service Session Hijacking. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1563.002",
      "tactic": "lateral-movement",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for RDP Hijacking. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1565",
      "tactic": "impact",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Data Manipulation. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1565.003",
      "tactic": "impact",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Runtime Data Manipulation. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1571",
      "tactic": "command-and-control",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Non-Standard Port. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1602",
      "tactic": "collection",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Data from Configuration Repository. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1602.001",
      "tactic": "collection",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for SNMP (MIB Dump). Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1602.002",
      "tactic": "collection",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Network Device Configuration Dump. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1610",
      "tactic": "execution",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Deploy Container. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1612",
      "tactic": "stealth",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Build Image on Host. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1613",
      "tactic": "discovery",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Container and Resource Discovery. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    },
    {
      "techniqueID": "T1669",
      "tactic": "initial-access",
      "color": "#fdae6b",
      "comment": "M1030 Network Segmentation: constrain unnecessary reachability for Wi-Fi Networks. Microsegmentation strengthens this by enforcing least-privilege workload communication close to the asset.",
      "enabled": true
    }
  ],
  "gradient": {
    "colors": [
      "#ff6666",
      "#ffe766",
      "#fdae6b"
    ],
    "minValue": 0,
    "maxValue": 100
  },
  "legendItems": [
    {
      "label": "MITRE M1030 Network Segmentation mapping - microsegmentation relevance: workload reachability and blast-radius control",
      "color": "#fdae6b"
    }
  ],
  "metadata": [
    {
      "name": "Source",
      "value": "MITRE ATT&CK Enterprise v19.1 STIX, mitigation M1030 Network Segmentation"
    },
    {
      "name": "microsegment.io interpretation",
      "value": "Illumio-style microsegmentation aligns when policy is based on observed workload dependencies and enforced as least-privilege L3/L4 communication. It does not replace identity, patching, endpoint, or application-layer controls."
    },
    {
      "name": "Updated",
      "value": "2026-07-10"
    },
    {
      "name": "Technique-tactic entries",
      "value": "44"
    },
    {
      "name": "Unique technique IDs",
      "value": "37"
    }
  ],
  "links": [
    {
      "label": "MITRE M1030 Network Segmentation",
      "url": "https://attack.mitre.org/mitigations/M1030/"
    },
    {
      "label": "MITRE ATT&CK version history",
      "url": "https://attack.mitre.org/resources/versions/"
    },
    {
      "label": "microsegment.io article",
      "url": "https://microsegment.io/2019/11/08/mitre-attack-and-segmentation/"
    }
  ],
  "showTacticRowBackground": false,
  "tacticRowBackground": "#dddddd",
  "selectTechniquesAcrossTactics": false,
  "selectSubtechniquesWithParent": false,
  "selectVisibleTechniques": false
}