MITRE D3FENDdefensive technique

D3-RFUM Remote Firmware Update Monitoring

Official page ↗
Tactic
Detect

Definition

Monitoring of remote firmware update commands to identify unauthorized software installations.

How it works

How it works By deploying sensors within the OT environment to passively monitor network traffic, tools can leverage deep packet inspection to identify protocol-specific commands and generate logs of relevant firmware activity. Additionally, these tools may incorporate behavioral and signature-based analysis to enhance detection and alerting capabilities.

Related

Counters · MITRE ATT&CK (2)

  • T0800 Activate Firmware Update Mode technique
  • T0814 Denial of Service technique

Child of · MITRE D3FEND (1)

  • D3-APCA Application Protocol Command Analysis defensive technique

References