DetectD3-PCSV
Process Code Segment Verification
Definition
Comparing the "text" or "code" memory segments to a source of truth.
- D3FEND ID
- D3-PCSV
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
7 techniques, 9 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1055Process Injection
- T1056Input Capture
- T1068Exploitation for Privilege Escalation
- T1203Exploitation for Client Execution
- T1210Exploitation of Remote Services
- T1211Exploitation for Stealth
- T1212Exploitation for Credential Access
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 7 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.