DetectD3-SSC
Shadow Stack Comparisons
Definition
Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.
- D3FEND ID
- D3-SSC
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
Across MITRE's defensive frameworks
Linked through the 5 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.