MITRE D3FENDdefensive technique

D3-FCA File Creation Analysis

Official page ↗

Tactic: Detect

Definition

Analyzing the properties of file create system call invocations.

Related

Counters · MITRE ATT&CK (4)

T1074.001 Local Data Staging sub-technique
T1218.001 Compiled HTML File sub-technique
T1218 System Binary Proxy Execution technique
T1074 Data Staged technique

Child of · MITRE D3FEND (1)

D3-SCA System Call Analysis defensive technique

References

https://car.mitre.org/analytics/CAR-2020-09-001/ CAR-2020-09-001: Scheduled Task - FileAccess
https://car.mitre.org/analytics/CAR-2019-07-002/ CAR-2019-07-002: Lsass Process Dump via Procdump