MITRE D3FENDdefensive technique

D3-EAL Executable Allowlisting

Official page ↗
Tactic
Isolate
Synonyms
File Signature Authentication

Definition

Using a digital signature to authenticate a file before opening.

How it works

How it works This technique is generic and there are numerous ways to compute and authenticate digital signatures. A digital certificate is generated from a private/public key pair issued by a certificate authority (CA). A hash of the file is encrypted using the private key. When the file is downloaded by another user, the user's system uses the public key to decrypt the hash and a new hash is created of the downloaded file. The hash decrypted by the public key is compared to the new hash and if there is a mismatch, further techniques, such as file deletion, file quarantine, or Executable Blacklisting may be invoked. This technique may be invoked when deciding whether to load or execute a file. Considerations Organizations which download or create high volumes of software make management complex, in particular engineering or scientific organizations.

Related

Counters · MITRE ATT&CK (70)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T0888 Remote System Information Discovery technique
  • T0846 Remote System Discovery technique
  • T0863 User Execution technique
  • T0871 Execution through API technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574 Hijack Execution Flow technique
  • T1204.002 Malicious File sub-technique
  • T1565 Data Manipulation technique
  • T1565.003 Runtime Data Manipulation sub-technique
  • T1134.004 Parent PID Spoofing sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1027.001 Binary Padding sub-technique
  • T1027.002 Software Packing sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1546.002 Screensaver sub-technique
  • T1546.005 Trap sub-technique
  • T1546.006 LC_LOAD_DYLIB Addition sub-technique
  • T1546.008 Accessibility Features sub-technique
  • T1546.009 AppCert DLLs sub-technique
  • T1546.010 AppInit DLLs sub-technique
  • T1546.013 PowerShell Profile sub-technique
  • T1547.009 Shortcut Modification sub-technique
Show all 70 ›

Child of · MITRE D3FEND (1)

  • D3-EI Execution Isolation defensive technique

References