MITRE D3FENDdefensive technique

D3-SBV Service Binary Verification

Official page ↗
Tactic
Detect

Definition

Analyzing changes in service binary files by comparing to a source of truth.

How it works

How it works System service applications may originate from the operating system installation or third-party applications installed with administrative privileges. These services have an entry point of some executable file-- a binary or a script. Attackers sometimes modify these executables to launch their own code. Analyzing changes in these files may uncover unauthorized activity. Considerations • These files change for legitimate reasons when the system or software updates. • The source of truth must not be corrupted in order for this method to work.

Related

Counters · MITRE ATT&CK (15)

  • T1649 Steal or Forge Authentication Certificates technique
  • T0889 Modify Program technique
  • T1564.006 Run Virtual Instance sub-technique
  • T0843 Program Download technique
  • T0845 Program Upload technique
  • T0873 Project File Infection technique
  • T1574.005 Executable Installer File Permissions Weakness sub-technique
  • T1574 Hijack Execution Flow technique
  • T1574.010 Services File Permissions Weakness sub-technique
  • T1564 Hide Artifacts technique
  • T1056.003 Web Portal Capture sub-technique
  • T1489 Service Stop technique
  • T1212 Exploitation for Credential Access technique
  • T1056 Input Capture technique
  • T1072 Software Deployment Tools technique

Child of · MITRE D3FEND (1)

  • D3-SFA System File Analysis defensive technique

References