MITRE D3FENDdefensive technique
D3-RC Restore Configuration
- Tactic
- Restore
Definition
Restoring an software configuration.
Related
Counters · MITRE ATT&CK (64)
- T1666 Modify Cloud Resource Hierarchy technique
- T1556.009 Conditional Access Policies sub-technique
- T1578.005 Modify Cloud Compute Configurations sub-technique
- T1548.005 Temporary Elevated Cloud Access sub-technique
- T1615 Group Policy Discovery technique
- T1564.008 Email Hiding Rules sub-technique
- T1614 System Location Discovery technique
- T1574.012 COR_PROFILER sub-technique
- T1578.003 Delete Cloud Instance sub-technique
- T1578.004 Revert Cloud Instance sub-technique
- T0858 Change Operating Mode technique
- T0868 Detect Operating Mode technique
- T1578.002 Create Cloud Instance sub-technique
- T1574.011 Services Registry Permissions Weakness sub-technique
- T1574 Hijack Execution Flow technique
- T1564 Hide Artifacts technique
- T1518.001 Security Software Discovery sub-technique
- T1114.003 Email Forwarding Rule sub-technique
- T1134.005 SID-History Injection sub-technique
- T1552.005 Cloud Instance Metadata API sub-technique
- T1552.006 Group Policy Preferences sub-technique
- T1556 Modify Authentication Process technique
- T1556.002 Password Filter DLL sub-technique
- T1553 Subvert Trust Controls technique
- T1553.003 SIP and Trust Provider Hijacking sub-technique
- T1552 Unsecured Credentials technique
- T1548 Abuse Elevation Control Mechanism technique
- T1548.001 Setuid and Setgid sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1546.001 Change Default File Association sub-technique
Child of · MITRE D3FEND (1)
- D3-RO Restore Object defensive technique
References
- https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf Cybersecurity Incident & Vulnerability Response Playbooks