MITRE D3FENDdefensive technique

D3-KBPI Kernel-based Process Isolation

Official page ↗
Tactic
Isolate

Definition

Using kernel-level capabilities to isolate processes.

Related

Counters · MITRE ATT&CK (23)

  • T1621 Multi-Factor Authentication Request Generation technique
  • T0821 Modify Controller Tasking technique
  • T0806 Brute Force I/O technique
  • T0813 Denial of Control technique
  • T0814 Denial of Service technique
  • T0819 Exploit Public-Facing Application technique
  • T0823 Graphical User Interface technique
  • T0878 Alarm Suppression technique
  • T1003.004 LSA Secrets sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1556 Modify Authentication Process technique
  • T1550 Use Alternate Authentication Material technique
  • T1546.007 Netsh Helper DLL sub-technique
  • T1546 Event Triggered Execution technique
  • T1505.003 Web Shell sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1505 Server Software Component technique
  • T1212 Exploitation for Credential Access technique
  • T1003 OS Credential Dumping technique
  • T1033 System Owner/User Discovery technique
  • T1053 Scheduled Task/Job technique

Child of · MITRE D3FEND (1)

  • D3-EI Execution Isolation defensive technique

References