DetectD3-PM

Platform Monitoring

Definition

Monitoring platform components such as operating systems software, hardware devices, or firmware.

D3FEND ID: D3-PM
Tactic: Detect
Certification relevance: CySA+GCIHGCIASecurity+

Sub-techniques

D3-FEMCFirmware Embedded Monitoring Code
D3-OMMOperating Mode Monitoring
D3-OPMOperational Process Monitoring
D3-APMApplication Performance Monitoring
D3-FIMFile Integrity Monitoring
D3-PUMPlatform Uptime Monitoring
D3-FVFirmware Verification
D3-FBAFirmware Behavior Analysis
D3-OSMOperating System Monitoring

ATT&CK techniques it counters

D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.

59 techniques, 199 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1003OS Credential Dumping
.005 Cached Domain Credentials .006 DCSync .007 Proc Filesystem .008 /etc/passwd and /etc/shadow
T1005Data from Local System
T1014Rootkit
T1016System Network Configuration Discovery
.001 Internet Connection Discovery .002 Wi-Fi Discovery
T1018Remote System Discovery
T1027Obfuscated Files or Information
.001 Binary Padding .002 Software Packing .004 Compile After Delivery
T1033System Owner/User Discovery
T1036Masquerading
.001 Invalid Code Signature .003 Rename Legitimate Utilities .004 Masquerade Task or Service .005 Match Legitimate Resource Name or Location .006 Space after Filename
T1037Boot or Logon Initialization Scripts
.001 Logon Script (Windows).002 Login Hook .003 Network Logon Script .004 RC Scripts .005 Startup Items
T1041Exfiltration Over C2 Channel
T1048Exfiltration Over Alternative Protocol
.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1053Scheduled Task/Job
.001 At (Linux) Execution .002 At .003 Cron .004 Launchd .005 Scheduled Task .006 Systemd Timers .007 Container Orchestration Job
T1055Process Injection
.001 Dynamic-link Library Injection .002 Portable Executable Injection .003 Thread Execution Hijacking .009 Proc Memory .012 Process Hollowing .014 VDSO Hijacking
T1056Input Capture
.001 Keylogging .003 Web Portal Capture .004 Credential API Hooking
T1059Command and Scripting Interpreter
.001 PowerShell .002 AppleScript .003 Windows Command Shell .004 Unix Shell .005 Visual Basic .006 Python .007 JavaScript .008 Network Device CLI .009 Cloud API .010 AutoHotKey & AutoIT .011 Lua .012 Hypervisor CLI .013 Container CLI/API
T1068Exploitation for Privilege Escalation
T1070Indicator Removal
.001 Clear Windows Event Logs .002 Clear Linux or Mac System Logs .003 Clear Command History .004 File Deletion
T1071Application Layer Protocol
.001 Web Protocols .002 File Transfer Protocols .003 Mail Protocols .004 DNS .005 Publish/Subscribe Protocols
T1072Software Deployment Tools
T1074Data Staged
.001 Local Data Staging
T1083File and Directory Discovery
T1110Brute Force
.001 Password Guessing .003 Password Spraying .004 Credential Stuffing
T1114Email Collection
.001 Local Email Collection .002 Remote Email Collection
T1119Automated Collection
T1123Audio Capture
T1125Video Capture
T1127Trusted Developer Utilities Proxy Execution
.001 MSBuild
T1134Access Token Manipulation
.002 Create Process with Token .003 Make and Impersonate Token
T1137Office Application Startup
.001 Office Template Macros .003 Outlook Forms
T1140Deobfuscate/Decode Files or Information
T1187Forced Authentication
T1203Exploitation for Client Execution
T1204User Execution
.002 Malicious File
T1210Exploitation of Remote Services
T1211Exploitation for Stealth
T1212Exploitation for Credential Access
T1218System Binary Proxy Execution
.005 Mshta .011 Rundll32
T1220XSL Script Processing
T1486Data Encrypted for Impact
T1489Service Stop
T1505Server Software Component
.002 Transport Agent .003 Web Shell
T1534Internal Spearphishing
T1542Pre-OS Boot
.001 System Firmware .002 Component Firmware .004 ROMMONkit
T1543Create or Modify System Process
.001 Launch Agent .002 Systemd Service .004 Launch Daemon
T1546Event Triggered Execution
.002 Screensaver .003 Windows Management Instrumentation Event Subscription .004 Unix Shell Configuration Modification .005 Trap .006 LC_LOAD_DYLIB Addition .008 Accessibility Features .009 AppCert DLLs .010 AppInit DLLs .013 PowerShell Profile .014 Emond .015 Component Object Model Hijacking
T1547Boot or Logon Autostart Execution
.001 Registry Run Keys / Startup Folder .006 Kernel Modules and Extensions .007 Re-opened Applications .008 LSASS Driver .009 Shortcut Modification .011 Plist Modification
T1548Abuse Elevation Control Mechanism
.002 Bypass User Account Control .003 Sudo and Sudo Caching
T1552Unsecured Credentials
.001 Credentials In Files .003 Shell History
T1555Credentials from Password Stores
.001 Keychain .002 Securityd Memory .003 Credentials from Web Browsers .004 Windows Credential Manager .005 Password Managers .006 Cloud Secrets Management Stores
T1556Modify Authentication Process
.002 Password Filter DLL .003 Pluggable Authentication Modules
T1560Archive Collected Data
.001 Archive via Utility .002 Archive via Library .003 Archive via Custom Method
T1562Impair Defenses
.001 Disable or Modify Tools .003 Impair Command History Logging .009 Safe Mode Boot .013 Disable or Modify Network Device Firewall
T1564Hide Artifacts
.002 Hidden Users .003 Hidden Window .006 Run Virtual Instance .007 VBA Stomping
T1565Data Manipulation
.001 Stored Data Manipulation .003 Runtime Data Manipulation
T1566Phishing
.001 Spearphishing Attachment .002 Spearphishing Link .003 Spearphishing via Service
T1573Encrypted Channel
.002 Asymmetric Cryptography
T1574Hijack Execution Flow
.001 DLL .002 DLL Side-Loading .004 Dylib Hijacking .005 Executable Installer File Permissions Weakness .006 Dynamic Linker Hijacking .007 Path Interception by PATH Environment Variable .008 Path Interception by Search Order Hijacking .009 Path Interception by Unquoted Path .010 Services File Permissions Weakness .011 Services Registry Permissions Weakness .012 COR_PROFILER
T1578Modify Cloud Compute Infrastructure
.002 Create Cloud Instance .003 Delete Cloud Instance .004 Revert Cloud Instance
T1649Steal or Forge Authentication Certificates

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 59 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

CAR-2013-04-002Quick execution of a series of suspicious commands9 shared
CAR-2013-01-002Autorun Differences6 shared
CAR-2013-10-002DLL Injection via Load Library2 shared
CAR-2014-02-001Service Binary Modifications2 shared
CAR-2013-03-001Reg.exe called from Command Shell2 shared
CAR-2020-05-003Rare LolBAS Command Lines2 shared
CAR-2016-03-001Host Discovery Commands2 shared
CAR-2013-02-003Processes Spawning cmd.exe1 shared
CAR-2013-05-002Suspicious Run Locations1 shared
CAR-2013-05-004Execution with AT1 shared
CAR-2013-05-009Running executables with same hash and different names1 shared
CAR-2013-07-005Command Line Usage of Archiving Software1 shared

57 more in the full list