MITRE D3FENDdefensive technique
D3-SDM System Daemon Monitoring
- Tactic
- Detect
Definition
Tracking changes to the state or configuration of critical system level processes.
How it works
How it works
Attackers may manipulate system settings or services to disable system logging or monitoring of security tools and events. Firewall and antivirus services are popular targets for attackers. Disabling system logs will also allow an attacker's actions to go unnoticed. Analysis of logs, registries, and process monitoring help defenders locate signs of tampering. Two possible approaches are to monitor hardened system services or to monitor registry updates for modifications to security settings.
Related
Counters · MITRE ATT&CK (2)
Child of · MITRE D3FEND (1)
- D3-OSM Operating System Monitoring defensive technique
References
- https://patents.google.com/patent/US20110023115A1 Host intrusion prevention system using software and user behavior analysis
- https://patents.google.com/patent/US8239947B1 Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system
- https://car.mitre.org/analytics/CAR-2016-04-003/ CAR-2016-04-003: User Activity from Stopping Windows Defensive Services