MITRE D3FENDdefensive technique

D3-AEM Application Exception Monitoring

Official page ↗
Tactic
Detect
Synonyms
Application Failure Monitoring

Definition

Monitoring the failures of system counters and timers.

How it works

How it works Monitoring timer and counter failures or exceedances can reveal issues with the program or platform, and is important for both safety and security. It may also help identify tampering or malicious activity affecting the device or the processes it controls.

Related

Counters · MITRE ATT&CK (19)

  • T1003.005 Cached Domain Credentials sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1134.003 Make and Impersonate Token sub-technique
  • T1003.006 DCSync sub-technique
  • T1110.001 Password Guessing sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1110.004 Credential Stuffing sub-technique
  • T1070.003 Clear Command History sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.003 Sudo and Sudo Caching sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1546.005 Trap sub-technique
  • T1546 Event Triggered Execution technique
  • T1187 Forced Authentication technique
  • T1134 Access Token Manipulation technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1003 OS Credential Dumping technique
  • T1070 Indicator Removal technique
  • T1110 Brute Force technique

Child of · MITRE D3FEND (1)

  • D3-APM Application Performance Monitoring defensive technique

References