MITRE D3FENDdefensive technique

D3-FIM File Integrity Monitoring

Official page ↗
Tactic
Detect

Definition

Detecting any suspicious changes to files in a computer system.

How it works

How it Works There are a number of tools in Windows and Unix that can monitor specific files in a system and generate alerts if any artifacts have been created, modified, or removed. They accomplish this by comparing the current artifacts to a previous snapshot. Unix - Unix systems have a file integrity checker tool called tripwire. Tripwire first initializes a database that serves as a basis for comparison and can then scan the system to compare the state of the current file system against the initial baseline database. Additionally, users can define policies that specify potential violations. Windows - In Microsoft Azure, file integrity monitoring can be enabled which can track file and registry key creation, removals, and modifications of specific files. Considerations Files can change constantly due to the non-static nature of a computer system. File Integrity Monitoring works best when pointed at a narrow scope of critical files to limit the number of unnecessary files that may be modified over the course of normal use. The accuracy and precision of defined policies also affect the efficacy of this technique.

Related

Counters · MITRE ATT&CK (127)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T0893 Data from Local System technique
  • T1649 Steal or Forge Authentication Certificates technique
  • T0888 Remote System Information Discovery technique
  • T1564.007 VBA Stomping sub-technique
  • T1564.006 Run Virtual Instance sub-technique
  • T1556.003 Pluggable Authentication Modules sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T0851 Rootkit technique
  • T0865 Spearphishing Attachment technique
  • T0871 Execution through API technique
  • T1127.001 MSBuild sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573 Encrypted Channel technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1574.004 Dylib Hijacking sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1564.002 Hidden Users sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574 Hijack Execution Flow technique
  • T1204.002 Malicious File sub-technique
Show all 127 ›

Child of · MITRE D3FEND (1)

  • D3-PM Platform Monitoring defensive technique

References