Execution Isolation

Definition

Execution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files.

D3FEND ID: D3-EI
Tactic: Isolate
Certification relevance: Security+CISSPCCSP

Sub-techniques

ATT&CK techniques it counters

D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.

33 techniques, 112 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1003OS Credential Dumping
.001 LSASS Memory .002 Security Account Manager .004 LSA Secrets
T1007System Service Discovery
T1010Application Window Discovery
T1016System Network Configuration Discovery
.001 Internet Connection Discovery .002 Wi-Fi Discovery
T1018Remote System Discovery
T1027Obfuscated Files or Information
.001 Binary Padding .002 Software Packing .004 Compile After Delivery
T1033System Owner/User Discovery
T1036Masquerading
.001 Invalid Code Signature .003 Rename Legitimate Utilities
T1037Boot or Logon Initialization Scripts
.001 Logon Script (Windows).002 Login Hook .003 Network Logon Script .004 RC Scripts
T1047Windows Management Instrumentation
T1053Scheduled Task/Job
.001 At (Linux) Execution .002 At .003 Cron .004 Launchd .005 Scheduled Task .006 Systemd Timers .007 Container Orchestration Job
T1055Process Injection
.003 Thread Execution Hijacking .004 Asynchronous Procedure Call .013 Process Doppelgänging
T1057Process Discovery
T1059Command and Scripting Interpreter
.001 PowerShell .002 AppleScript .003 Windows Command Shell .004 Unix Shell .005 Visual Basic .006 Python .007 JavaScript .008 Network Device CLI .009 Cloud API .010 AutoHotKey & AutoIT .011 Lua .012 Hypervisor CLI .013 Container CLI/API
T1082System Information Discovery
T1124System Time Discovery
T1134Access Token Manipulation
.004 Parent PID Spoofing
T1137Office Application Startup
.001 Office Template Macros
T1140Deobfuscate/Decode Files or Information
T1204User Execution
.002 Malicious File
T1212Exploitation for Credential Access
T1218System Binary Proxy Execution
.001 Compiled HTML File .002 Control Panel .003 CMSTP .005 Mshta .011 Rundll32
T1220XSL Script Processing
T1505Server Software Component
.001 SQL Stored Procedures .002 Transport Agent .003 Web Shell
T1546Event Triggered Execution
.002 Screensaver .005 Trap .006 LC_LOAD_DYLIB Addition .007 Netsh Helper DLL .008 Accessibility Features .009 AppCert DLLs .010 AppInit DLLs .013 PowerShell Profile .015 Component Object Model Hijacking
T1547Boot or Logon Autostart Execution
.001 Registry Run Keys / Startup Folder .009 Shortcut Modification
T1548Abuse Elevation Control Mechanism
.002 Bypass User Account Control
T1550Use Alternate Authentication Material
.001 Application Access Token .002 Pass the Hash .003 Pass the Ticket .004 Web Session Cookie
T1556Modify Authentication Process
.001 Domain Controller Authentication .002 Password Filter DLL .003 Pluggable Authentication Modules .004 Network Device Authentication .005 Reversible Encryption .006 Multi-Factor Authentication .007 Hybrid Identity .008 Network Provider DLL .009 Conditional Access Policies
T1562Impair Defenses
.001 Disable or Modify Tools .003 Impair Command History Logging
T1565Data Manipulation
.003 Runtime Data Manipulation
T1574Hijack Execution Flow
.007 Path Interception by PATH Environment Variable .008 Path Interception by Search Order Hijacking .009 Path Interception by Unquoted Path
T1621Multi-Factor Authentication Request Generation

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 33 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

47 more in the full list