RestoreD3-RS
Restore Software
Definition
Restoring software to a host.
- D3FEND ID
- D3-RS
- Tactic
- Restore
- Certification relevance
- CISSPCISMSecurity+
ATT&CK techniques it counters
20 techniques, 40 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1014Rootkit
- T1056Input Capture
- T1072Software Deployment Tools
- T1127Trusted Developer Utilities Proxy Execution
- T1137Office Application Startup
- T1176Software Extensions
- T1195Supply Chain Compromise
- T1212Exploitation for Credential Access
- T1218System Binary Proxy Execution
- T1489Service Stop
- T1490Inhibit System Recovery
- T1497Virtualization/Sandbox Evasion
- T1505Server Software Component
- T1542Pre-OS Boot
- T1546Event Triggered Execution
- T1547Boot or Logon Autostart Execution
- T1554Compromise Host Software Binary
- T1564Hide Artifacts
- T1574Hijack Execution Flow
- T1649Steal or Forge Authentication Certificates
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 20 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-01-002Autorun Differences3 shared
- CAR-2013-03-001Reg.exe called from Command Shell2 shared
- CAR-2020-05-003Rare LolBAS Command Lines2 shared
- CAR-2014-03-006RunDLL32.exe monitoring1 shared
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2019-04-002Generic Regsvr321 shared
- CAR-2019-04-003Squiblydoo1 shared
- CAR-2020-08-001NTFS Alternate Data Stream Execution - System Utilities1 shared
- CAR-2020-08-002NTFS Alternate Data Stream Execution - LOLBAS1 shared
- CAR-2020-09-002Component Object Model Hijacking1 shared