MITRE D3FENDdefensive technique

D3-SSC Shadow Stack Comparisons

Official page ↗
Tactic
Detect

Definition

Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.

How it works

How it works This technique compares the call stack stored in system memory with the shadow call stack maintained in the cache memory of the processor. Mismatches between the two are compared since a return oriented programming attack may only be able to control or spoof the call stack and not the shadow call stack. Mismatches are counted and if the number of mismatches exceeds a certain threshold it is an indication of unauthorized activity and a security response action is performed. Considerations If the threshold for detecting a stack anomaly is low, it may not detect a return-oriented attack with just one gadget, such as a return-to-libc or return-to-plt attack. Additionally, this technique may not detect JOP (Jump-oriented programming), as the return instruction is not executed.

Related

Counters · MITRE ATT&CK (8)

  • T0890 Exploitation for Privilege Escalation technique
  • T0820 Exploitation for Evasion technique
  • T0866 Exploitation of Remote Services technique
  • T1203 Exploitation for Client Execution technique
  • T1210 Exploitation of Remote Services technique
  • T1211 Exploitation for Stealth technique
  • T1212 Exploitation for Credential Access technique
  • T1068 Exploitation for Privilege Escalation technique

Child of · MITRE D3FEND (1)

  • D3-PA Process Analysis defensive technique

References