MITRE D3FENDdefensive technique

D3-PSA Process Spawn Analysis

Official page ↗
Tactic
Detect

Definition

Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.

How it works

How it works Process attributes are established when an operating system spawns a new process. These attributes are analyzed to look for the presence or absence of specific values or patterns. Some attributes of interest are: • user • process name • image path • security content Considerations • Attackers can spoof the parent process identifier (PPID), which could bypass this defense to allow execution of a malicious process from an arbitrary parent process. • Attackers could have legitimately compromised any of the process properties, such as the user, to make the execution appear legitimate. • Location: If the full image path is not checked, there could be a conflict with an executable that appears earlier due to resolution involving the system environment path/classpath variable. • Parsing issues: If the raw command from a shell is analyzed, rather than the actual function call, it is important to identify the actual command being run from its arguments. In Windows, services with unquoted file paths containing spaces will try to use the first token as the executable and the rest as arguments -- and shift tokens to the executable until a valid one is found. • Some operating systems can spawn processes without forking.

Related

Counters · MITRE ATT&CK (54)

  • T0895 Autorun Image technique
  • T0894 System Binary Proxy Execution technique
  • T1621 Multi-Factor Authentication Request Generation technique
  • T0821 Modify Controller Tasking technique
  • T0888 Remote System Information Discovery technique
  • T0806 Brute Force I/O technique
  • T0813 Denial of Control technique
  • T0814 Denial of Service technique
  • T0819 Exploit Public-Facing Application technique
  • T0823 Graphical User Interface technique
  • T0846 Remote System Discovery technique
  • T0863 User Execution technique
  • T0878 Alarm Suppression technique
  • T1003.004 LSA Secrets sub-technique
  • T1134.004 Parent PID Spoofing sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1556 Modify Authentication Process technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1550 Use Alternate Authentication Material technique
  • T1546.007 Netsh Helper DLL sub-technique
  • T1546.009 AppCert DLLs sub-technique
  • T1546.010 AppInit DLLs sub-technique
  • T1218.001 Compiled HTML File sub-technique
  • T1218.002 Control Panel sub-technique
  • T1218.003 CMSTP sub-technique
  • T1218.005 Mshta sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1546 Event Triggered Execution technique
Show all 54 ›

Child of · MITRE D3FEND (1)

  • D3-PA Process Analysis defensive technique

Referenced by MITRE D3FEND · child of (1)

  • D3-PLA Process Lineage Analysis defensive technique

References