MITRE D3FENDdefensive technique

D3-PLA Process Lineage Analysis

Official page ↗
Tactic
Detect
Synonyms
Process Tree Analysis

Definition

Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution, duration, and order relative to siblings and ancestors.

How it works

How it works Process tree analysis techniques gather information on how a process was initiated to determine if a process is malicious. For example, if a process was not initiated from boot or not initiated by another process, that process is identified as suspicious. Also, if a new process was started before a process initiated by the device (ex. during boot) and that new process was not initiated by a user (which can be determined by examining process parameters such as type of process, its creator, source, etc.) the process is identified as suspicious. For example, Microsoft Word may block execution of any subprocess that is not in an approved path. Considerations • Attackers may spoof the parent PID (https://attack.mitre.org/techniques/T1502/), rendering such after-the-fact analysis on process lineage ineffective. • Processes may hide from various means of detection; an example on Linux is where a rootkit might remove key files for the process from its directory in /proc. • Zombie processes.

Related

Counters · MITRE ATT&CK (23)

  • T1621 Multi-Factor Authentication Request Generation technique
  • T0821 Modify Controller Tasking technique
  • T0806 Brute Force I/O technique
  • T0813 Denial of Control technique
  • T0814 Denial of Service technique
  • T0819 Exploit Public-Facing Application technique
  • T0823 Graphical User Interface technique
  • T0878 Alarm Suppression technique
  • T1003.004 LSA Secrets sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1556 Modify Authentication Process technique
  • T1550 Use Alternate Authentication Material technique
  • T1546.007 Netsh Helper DLL sub-technique
  • T1546 Event Triggered Execution technique
  • T1505.003 Web Shell sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1505 Server Software Component technique
  • T1212 Exploitation for Credential Access technique
  • T1003 OS Credential Dumping technique
  • T1033 System Owner/User Discovery technique
  • T1053 Scheduled Task/Job technique

Child of · MITRE D3FEND (1)

  • D3-PSA Process Spawn Analysis defensive technique

References