DetectD3-USICA
User Session Init Config Analysis
Also called: User Startup Config Analysis
Definition
Analyzing modifications to user session config files such as .bashrc or .bash_profile.
- D3FEND ID
- D3-USICA
- Tactic
- Detect
- Certification relevance
- CySA+GCIHGCIASecurity+
ATT&CK techniques it counters
2 techniques, 4 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2014-11-003Debuggers for Accessibility Applications1 shared
- CAR-2014-11-008Command Launched from WinLogon1 shared
- CAR-2020-08-001NTFS Alternate Data Stream Execution - System Utilities1 shared
- CAR-2020-08-002NTFS Alternate Data Stream Execution - LOLBAS1 shared
- CAR-2020-09-002Component Object Model Hijacking1 shared
- CAR-2020-09-005AppInit DLLs1 shared
- CAR-2020-11-011Registry Edit from Screensaver1 shared
- CAR-2013-01-002Autorun Differences1 shared