DetectD3-SFA
System File Analysis
Definition
Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.
- D3FEND ID
- D3-SFA
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
Sub-techniques
ATT&CK techniques it counters
9 techniques, 17 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1003OS Credential Dumping
- T1018Remote System Discovery
- T1036Masquerading
- T1055Process Injection
- T1070Indicator Removal
- T1543Create or Modify System Process
- T1548Abuse Elevation Control Mechanism
- T1556Modify Authentication Process
- T1574Hijack Execution Flow
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 9 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-04-002Quick execution of a series of suspicious commands4 shared
- CAR-2013-10-002DLL Injection via Load Library2 shared
- CAR-2014-02-001Service Binary Modifications2 shared
- CAR-2013-01-002Autorun Differences2 shared
- CAR-2013-05-002Suspicious Run Locations1 shared
- CAR-2013-05-009Running executables with same hash and different names1 shared
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2016-04-002User Activity from Clearing Event Logs1 shared
- CAR-2019-04-001UAC Bypass1 shared
- CAR-2019-04-004Credential Dumping via Mimikatz1 shared