MITRE D3FENDdefensive technique

D3-OSM Operating System Monitoring

Official page ↗
Tactic
Detect

Definition

The operating system software, for D3FEND's purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.

How it works

Technique Overview "An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs." [1] Operating System Monitoring Techniques have varied implementations including built-in kernel modules, third-party privileged system daemons, or even standard systems administration tools included with an operating system. 1. http://dbpedia.org/resource/Operating_system

Related

Child of · MITRE D3FEND (1)

  • D3-PM Platform Monitoring defensive technique

Referenced by MITRE D3FEND · child of (8)

  • D3-EHB Endpoint Health Beacon defensive technique
  • D3-IDA Input Device Analysis defensive technique
  • D3-MBT Memory Boundary Tracking defensive technique
  • D3-SDM System Daemon Monitoring defensive technique
  • D3-SFA System File Analysis defensive technique
  • D3-SICA System Init Config Analysis defensive technique
  • D3-SJA Scheduled Job Analysis defensive technique
  • D3-USICA User Session Init Config Analysis defensive technique

References