MITRE D3FENDdefensive technique

D3-MBT Memory Boundary Tracking

Official page ↗
Tactic
Detect

Definition

Analyzing a call stack for return addresses which point to unexpected memory locations.

How it works

How it works This technique monitors for indicators of whether a return address is outside memory previously allocated for an object (i.e. function, module, process, or thread). If so, code that the return address points to is treated as malicious code. Considerations Kernel malware can manipulate memory contents, for example modifying pointers to hide processes, and thereby impact the accuracy of memory allocation information used to perform the analysis.

Related

Counters · MITRE ATT&CK (13)

  • T0890 Exploitation for Privilege Escalation technique
  • T0820 Exploitation for Evasion technique
  • T0866 Exploitation of Remote Services technique
  • T0874 Hooking technique
  • T1056.004 Credential API Hooking sub-technique
  • T1055.012 Process Hollowing sub-technique
  • T1203 Exploitation for Client Execution technique
  • T1210 Exploitation of Remote Services technique
  • T1211 Exploitation for Stealth technique
  • T1212 Exploitation for Credential Access technique
  • T1055 Process Injection technique
  • T1056 Input Capture technique
  • T1068 Exploitation for Privilege Escalation technique

Child of · MITRE D3FEND (1)

  • D3-OSM Operating System Monitoring defensive technique

References