Process Analysis

Definition

Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.

D3FEND ID: D3-PA
Tactic: Detect
Certification relevance: CySA+GCIHGCIASecurity+

Sub-techniques

ATT&CK techniques it counters

D3FEND maps this technique to ATT&CK through its sub-techniques; the list combines their mappings.

39 techniques, 94 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 39 ATT&CK techniques above.

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

36 more in the full list