RestoreD3-RD
Restore Database
Definition
Restoring the data in a database.
- D3FEND ID
- D3-RD
- Tactic
- Restore
- Certification relevance
- CISSPCISMSecurity+
ATT&CK techniques it counters
15 techniques, 35 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1003OS Credential Dumping
- T1012Query Registry
- T1033System Owner/User Discovery
- T1112Modify Registry
- T1137Office Application Startup
- T1207Rogue Domain Controller
- T1213Data from Information Repositories
- T1218System Binary Proxy Execution
- T1543Create or Modify System Process
- T1546Event Triggered Execution
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1555Credentials from Password Stores
- T1564Hide Artifacts
- T1614System Location Discovery
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 15 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands5 shared
- CAR-2013-01-002Autorun Differences3 shared
- CAR-2013-03-001Reg.exe called from Command Shell2 shared
- CAR-2020-05-003Rare LolBAS Command Lines2 shared
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-03-006RunDLL32.exe monitoring1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-005Remote Registry1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2019-04-001UAC Bypass1 shared
- CAR-2019-04-002Generic Regsvr321 shared