DetectD3-SICA
System Init Config Analysis
Also called: Startup Analysis, Autorun Analysis
Definition
Analysis of any system process startup configuration.
- D3FEND ID
- D3-SICA
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
4 techniques, 9 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1037Boot or Logon Initialization Scripts
- T1547Boot or Logon Autostart Execution
- T1562Impair Defenses
- T1574Hijack Execution Flow
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 4 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-01-002Autorun Differences3 shared
- CAR-2013-03-001Reg.exe called from Command Shell2 shared
- CAR-2020-05-003Rare LolBAS Command Lines2 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands2 shared
- CAR-2014-07-001Service Search Path Interception1 shared
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2020-11-001Boot or Logon Initialization Scripts1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2021-11-001Registry Edit with Creation of SafeDllSearchMode Key Set to 01 shared
- CAR-2021-11-002Registry Edit with Modification of Userinit, Shell or Notify1 shared