MITRE D3FENDdefensive technique

D3-PA Process Analysis

Official page ↗
Tactic
Detect

Definition

Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.

Related

Referenced by MITRE D3FEND · child of (9)

  • D3-DQSA Database Query String Analysis defensive technique
  • D3-FAPA File Access Pattern Analysis defensive technique
  • D3-IBCA Indirect Branch Call Analysis defensive technique
  • D3-PCSV Process Code Segment Verification defensive technique
  • D3-PSA Process Spawn Analysis defensive technique
  • D3-PSMD Process Self-Modification Detection defensive technique
  • D3-SCA System Call Analysis defensive technique
  • D3-SEA Script Execution Analysis defensive technique
  • D3-SSC Shadow Stack Comparisons defensive technique