Hardware-based Process Isolation

24 techniques, 65 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1003OS Credential Dumping
  .001 LSASS Memory.002 Security Account Manager.004 LSA Secrets
• T1007System Service Discovery
• T1010Application Window Discovery
• T1016System Network Configuration Discovery
  .001 Internet Connection Discovery.002 Wi-Fi Discovery
• T1018Remote System Discovery
• T1033System Owner/User Discovery
• T1047Windows Management Instrumentation
• T1053Scheduled Task/Job
  .001 At (Linux) Execution.002 At.003 Cron.004 Launchd.005 Scheduled Task.006 Systemd Timers.007 Container Orchestration Job
• T1055Process Injection
  .004 Asynchronous Procedure Call.013 Process Doppelgänging
• T1057Process Discovery
• T1082System Information Discovery
• T1124System Time Discovery
• T1134Access Token Manipulation
  .004 Parent PID Spoofing
• T1140Deobfuscate/Decode Files or Information
• T1212Exploitation for Credential Access
• T1218System Binary Proxy Execution
  .001 Compiled HTML File.002 Control Panel.003 CMSTP.005 Mshta.011 Rundll32
• T1220XSL Script Processing
• T1505Server Software Component
  .001 SQL Stored Procedures.002 Transport Agent.003 Web Shell
• T1546Event Triggered Execution
  .007 Netsh Helper DLL.009 AppCert DLLs.010 AppInit DLLs
• T1548Abuse Elevation Control Mechanism
  .002 Bypass User Account Control
• T1550Use Alternate Authentication Material
  .001 Application Access Token.002 Pass the Hash.003 Pass the Ticket.004 Web Session Cookie
• T1556Modify Authentication Process
  .001 Domain Controller Authentication.002 Password Filter DLL.003 Pluggable Authentication Modules.004 Network Device Authentication.005 Reversible Encryption.006 Multi-Factor Authentication.007 Hybrid Identity.008 Network Provider DLL.009 Conditional Access Policies
• T1562Impair Defenses
  .001 Disable or Modify Tools
• T1621Multi-Factor Authentication Request Generation

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.