DetectD3-MBT
Memory Boundary Tracking
Definition
Analyzing a call stack for return addresses which point to unexpected memory locations.
- D3FEND ID
- D3-MBT
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
7 techniques, 9 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1055Process Injection
- T1056Input Capture
- T1068Exploitation for Privilege Escalation
- T1203Exploitation for Client Execution
- T1210Exploitation of Remote Services
- T1211Exploitation for Stealth
- T1212Exploitation for Credential Access
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 7 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.