HardenD3-PH
Platform Hardening
Also called: System Hardening, Endpoint Hardening
Definition
Hardening components of a Platform with the intention of making them more difficult to exploit. Platforms includes components such as: * BIOS UEFI Subsystems * Hardware security devices such as Trusted Platform Modules * Boot process logic or code * Kernel software components
- D3FEND ID
- D3-PH
- Tactic
- Harden
- Certification relevance
- Security+CISSPCCSP
Sub-techniques
ATT&CK techniques it counters
D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.
68 techniques, 198 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1003OS Credential Dumping
- T1005Data from Local System
- T1012Query Registry
- T1014Rootkit
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1025Data from Removable Media
- T1027Obfuscated Files or Information
- T1033System Owner/User Discovery
- T1036Masquerading
- T1037Boot or Logon Initialization Scripts
- T1041Exfiltration Over C2 Channel
- T1048Exfiltration Over Alternative Protocol
- T1052Exfiltration Over Physical Medium
- T1053Scheduled Task/Job
- T1055Process Injection
- T1056Input Capture
- T1059Command and Scripting Interpreter
- T1070Indicator Removal
- T1071Application Layer Protocol
- T1072Software Deployment Tools
- T1074Data Staged
- T1083File and Directory Discovery
- T1091Replication Through Removable Media
- T1092Communication Through Removable Media
- T1111Multi-Factor Authentication Interception
- T1112Modify Registry
- T1114Email Collection
- T1119Automated Collection
- T1123Audio Capture
- T1125Video Capture
- T1127Trusted Developer Utilities Proxy Execution
- T1137Office Application Startup
- T1140Deobfuscate/Decode Files or Information
- T1176Software Extensions
- T1187Forced Authentication
- T1195Supply Chain Compromise
- T1200Hardware Additions
- T1204User Execution
- T1207Rogue Domain Controller
- T1212Exploitation for Credential Access
- T1218System Binary Proxy Execution
- T1220XSL Script Processing
- T1486Data Encrypted for Impact
- T1489Service Stop
- T1490Inhibit System Recovery
- T1497Virtualization/Sandbox Evasion
- T1505Server Software Component
- T1534Internal Spearphishing
- T1542Pre-OS Boot
- T1543Create or Modify System Process
- T1546Event Triggered Execution
- T1547Boot or Logon Autostart Execution
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1554Compromise Host Software Binary
- T1555Credentials from Password Stores
- T1556Modify Authentication Process
- T1560Archive Collected Data
- T1562Impair Defenses
- T1564Hide Artifacts
- T1565Data Manipulation
- T1566Phishing
- T1573Encrypted Channel
- T1574Hijack Execution Flow.001 DLL.002 DLL Side-Loading.004 Dylib Hijacking.005 Executable Installer File Permissions Weakness.006 Dynamic Linker Hijacking.007 Path Interception by PATH Environment Variable.008 Path Interception by Search Order Hijacking.009 Path Interception by Unquoted Path.010 Services File Permissions Weakness.012 COR_PROFILER
- T1614System Location Discovery
- T1619Cloud Storage Object Discovery
- T1649Steal or Forge Authentication Certificates
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 68 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands11 shared
- CAR-2013-01-002Autorun Differences7 shared
- CAR-2013-03-001Reg.exe called from Command Shell4 shared
- CAR-2020-05-003Rare LolBAS Command Lines4 shared
- CAR-2013-10-002DLL Injection via Load Library2 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 02 shared
- CAR-2021-11-002Registry Edit with Modification of Userinit, Shell or Notify2 shared
- CAR-2021-12-002Modification of Default Startup Folder in the Registry Key 'Common Startup'2 shared
- CAR-2014-02-001Service Binary Modifications2 shared
- CAR-2016-03-001Host Discovery Commands2 shared
- CAR-2013-02-003Processes Spawning cmd.exe1 shared
- CAR-2013-05-002Suspicious Run Locations1 shared