HardenD3-AH
Application Hardening
Also called: Process Hardening
Definition
Application Hardening makes an executable application more resilient to a class of exploits which either introduce new code or execute unwanted existing code. These techniques may be applied at compile-time or on an application binary.
- D3FEND ID
- D3-AH
- Tactic
- Harden
- Certification relevance
- Security+CISSPCCSP
Sub-techniques
ATT&CK techniques it counters
D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.
15 techniques, 22 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1033System Owner/User Discovery
- T1055Process Injection
- T1056Input Capture
- T1068Exploitation for Privilege Escalation
- T1114Email Collection
- T1189Drive-by Compromise
- T1190Exploit Public-Facing Application
- T1203Exploitation for Client Execution
- T1210Exploitation of Remote Services
- T1211Exploitation for Stealth
- T1212Exploitation for Credential Access
- T1218System Binary Proxy Execution
- T1562Impair Defenses
- T1564Hide Artifacts
- T1620Reflective Code Loading
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 15 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2014-03-006RunDLL32.exe monitoring1 shared
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2019-04-002Generic Regsvr321 shared
- CAR-2019-04-003Squiblydoo1 shared
- CAR-2020-08-001NTFS Alternate Data Stream Execution - System Utilities1 shared
- CAR-2020-08-002NTFS Alternate Data Stream Execution - LOLBAS1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2020-11-003DLL Injection with Mavinject1 shared
- CAR-2020-11-004Processes Started From Irregular Parent1 shared
- CAR-2020-11-009Compiled HTML Access1 shared
- CAR-2020-11-010CMSTP1 shared