MITRE D3FENDdefensive technique

D3-PSMD Process Self-Modification Detection

Official page ↗
Tactic
Detect

Definition

Detects processes that modify, change, or replace their own code at runtime.

How it works

How it Works A security agent installed on the host machine intercepts API calls between a process and operating system. Intercepted API calls are then compared against attack signatures/patterns to identify API calls that modify executable memory or modify the entry point address of a suspended child process. Attack patterns include: • Executable code of a suspended child process removed from memory by one or more API calls. • New executable code injected and / or loaded into memory of a suspended child process by one or more API calls. • Executable code modified by one or more API calls. • Next instruction pointer value in memory modified by one or more API calls. Considerations Comparing loaded code segments of processes with what is expected to have been loaded from a file can result in false positives, due to legitimate uses of self-modification for decrypting or uncompressing code segments.

Related

Counters · MITRE ATT&CK (23)

  • T1621 Multi-Factor Authentication Request Generation technique
  • T0821 Modify Controller Tasking technique
  • T0806 Brute Force I/O technique
  • T0813 Denial of Control technique
  • T0814 Denial of Service technique
  • T0819 Exploit Public-Facing Application technique
  • T0823 Graphical User Interface technique
  • T0878 Alarm Suppression technique
  • T1003.004 LSA Secrets sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1556 Modify Authentication Process technique
  • T1550 Use Alternate Authentication Material technique
  • T1546.007 Netsh Helper DLL sub-technique
  • T1546 Event Triggered Execution technique
  • T1505.003 Web Shell sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1505 Server Software Component technique
  • T1212 Exploitation for Credential Access technique
  • T1003 OS Credential Dumping technique
  • T1033 System Owner/User Discovery technique
  • T1053 Scheduled Task/Job technique

Child of · MITRE D3FEND (1)

  • D3-PA Process Analysis defensive technique

References