MITRE D3FENDdefensive technique

D3-SFA System File Analysis

Official page ↗
Tactic
Detect

Definition

Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.

How it works

How it works This technique ensures the integrity of system owned file resources. System files can impact the behavior below the user level. Considerations • Need to manage the size of log file analysis. • False positives are a concern with this technique and filtering will need to be given additional thought. • A baseline or snapshot of file checksums should be established for future comparison.

Related

Counters · MITRE ATT&CK (17)

  • T0888 Remote System Information Discovery technique
  • T1556.003 Pluggable Authentication Modules sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574 Hijack Execution Flow technique
  • T1003.007 Proc Filesystem sub-technique
  • T1556 Modify Authentication Process technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.003 Sudo and Sudo Caching sub-technique
  • T1543.002 Systemd Service sub-technique
  • T1055.009 Proc Memory sub-technique
  • T1543 Create or Modify System Process technique
  • T1003 OS Credential Dumping technique
  • T1018 Remote System Discovery technique
  • T1036 Masquerading technique
  • T1055 Process Injection technique
  • T1070 Indicator Removal technique

Child of · MITRE D3FEND (1)

  • D3-OSM Operating System Monitoring defensive technique

Referenced by MITRE D3FEND · child of (1)

  • D3-SBV Service Binary Verification defensive technique

References