MITRE D3FENDdefensive technique

D3-PS Process Suspension

Official page ↗
Tactic
Evict

Definition

Suspending a running process on a computer system.

How it works

How it works A running process might be suspended to mitigate its immediate effects if it is exhibiting anomalous, unauthorized, or malicious behavior. Defenders may choose to suspend rather than terminate to analyze the process first and resume the process if deemed benign. System-provided functions Windows tools In Windows, the `PsSuspend` command line utility from the SysInternals Suite provides functionality to suspend processes on a local or remote system.

Related

Counters · MITRE ATT&CK (23)

  • T1621 Multi-Factor Authentication Request Generation technique
  • T0821 Modify Controller Tasking technique
  • T0806 Brute Force I/O technique
  • T0813 Denial of Control technique
  • T0814 Denial of Service technique
  • T0819 Exploit Public-Facing Application technique
  • T0823 Graphical User Interface technique
  • T0878 Alarm Suppression technique
  • T1003.004 LSA Secrets sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1556 Modify Authentication Process technique
  • T1550 Use Alternate Authentication Material technique
  • T1546.007 Netsh Helper DLL sub-technique
  • T1546 Event Triggered Execution technique
  • T1505.003 Web Shell sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1505 Server Software Component technique
  • T1212 Exploitation for Credential Access technique
  • T1003 OS Credential Dumping technique
  • T1033 System Owner/User Discovery technique
  • T1053 Scheduled Task/Job technique

Child of · MITRE D3FEND (1)

  • D3-PE Process Eviction defensive technique

References