DetectD3-SBV
Service Binary Verification
Definition
Analyzing changes in service binary files by comparing to a source of truth.
- D3FEND ID
- D3-SBV
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
7 techniques, 11 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Across MITRE's defensive frameworks
Linked through the 7 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2020-08-001NTFS Alternate Data Stream Execution - System Utilities1 shared
- CAR-2020-08-002NTFS Alternate Data Stream Execution - LOLBAS1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared