This page is experimental and may change significantly in future
releases.
Process
Access Control Configuration
Access Control List
Access Token
Activity Dependency
Address Space
Administrative Network Traffic
Alias
Allocate Memory
Application
Application Configuration
Application Configuration Database
Application Configuration Database Record
Application Configuration File
Application Installer
Application Inventory Sensor
Application Layer Firewall
Application Layer Link
Application Process
Application Process Configuration
Application Rule
Application Shim
Archive File
Artifact Server
Asymmetric Key
Audio Input Device
Authenticate User
Authentication
Authentication Function
Authentication Log
Authentication Server
Authentication Service
Authorization
Authorization Log
Authorization Service
Barcode Scanner Input Device
Binary Large Object
Binary Segment
Blob
Block Device
Boot Loader
Boot Record
Boot Sector
Browser
Browser Extension
Build Tool
Business Communication Platform Client
CA Certificate File
Processor Cache Memory
Call Stack
Central Processing Unit
Certificate
Certificate File
Certificate Trust Store
Chatroom Client
Child Process
Client Application
Client Computer
Clipboard
Cloud Configuration
Cloud Instance Metadata
Cloud Service Authentication
Cloud Service Authorization
Cloud Service Sensor
Cloud Storage
Cloud User Account
Code Analyzer
Code Repository
Collaborative Software
Network Agent
Command
Command History Log
Command History Log File
Command Line Interface
Compiler
Compiler Configuration File
Computing Server
Configuration Database
Configuration Database Record
Configuration File
Configuration Management Database
Configuration Resource
Connect Socket
Console Output Function
Container Build Tool
Container Image
Container Orchestration Software
Container Process
Container Runtime
Copy Memory Function
Copy Token
Create File
Create Process
Create Socket
Create Thread
Credential
Credential Management System
Cryptographic Key
Custom Archive File
DNS Lookup
DNS Network Traffic
DNS Record
DNS Server
Data Artifact Server
Data Dependency
Data Link Link
Database
Database File
Database Query
Database Server
Decoy Artifact
Default User Account
Dependency
Deserialization Function
Desktop Computer
Developer Application
Dial Up Modem
Digital Artifact
Digital System
Directory
Directory Service
Display Adapter
Display Device Driver
Display Server
Document File
Domain Name
Domain Registration
Domain User Account
Dynamic Analysis Tool
Email
Email Attachment
Email Rule
Embedded Computer
Enclave
Encrypted Credential
Encrypted Password
Endpoint Sensor
Eval Function
Event Log
Exception Handler
Executable Binary
Executable File
Executable Script
External Content Inclusion Function
Fast Symbolic Link
File
File Hash
File Path Open Function
File Section
File Server
File Share Service
File System
File System Link
File System Metadata
File System Sensor
File Transfer Network Traffic
Finger Print Scanner Input Device
Firewall
Firmware
Firmware Sensor
First-stage Boot Loader
Flash Memory
Forward Proxy Server
Free Memory
Get Open Sockets
Get Open Windows
Get Running Processes
Get Screen Capture
Get System Config Value
Get System Network Config Value
Get System Time
Global User Account
Graphical User Interface
Graphics Card Firmware
Graphics Processing Unit
Group Policy
HTML File
Hard Disk Firmware
Hard Link
Hardware Device
Hardware Driver
Heap Segment
Host
Host-based Firewall
Host Configuration Sensor
Hostname
Human Input Device Firmware
IP Address
IPC Network Traffic
IP Phone
Identifier
Image Code Segment
Image Data Segment
Image Scanner Input Device
Image Segment
Impersonate User
Import Library Function
In-memory Password Store
Inbound Internet DNS Response Traffic
Inbound Internet Mail Traffic
Inbound Internet Network Traffic
Inbound Network Traffic
Init Script
Input Device
Input Function
Instant Messaging Client
Integration Test Execution Tool
Internet DNS Lookup
Internet File Transfer Traffic
Internet Network
Internet Network Traffic
Interprocess Communication
Intranet Administrative Network Traffic
Intranet DNS Lookup
Intranet File Transfer Traffic
Intranet IPC Network Traffic
Intranet Multicast Network Traffic
Intranet Network
Intranet Network Traffic
Intranet RPC Network Traffic
Intranet Web Network Traffic
Intrusion Detection System
Intrusion Prevention System
Java Archive
JavaScript Blob
Kerberos Ticket
Kerberos Ticket Granting Service Ticket
Kerberos Ticket Granting Ticket
Kernel
Kernel API Sensor
Kernel Module
Kernel Process Table
Keyboard Input Device
Kiosk Computer
Laptop Computer
Legacy System
Link
Local Area Network
Local Area Network Traffic
Local Authentication Service
Local Authorization Service
Local Resource
Local Resource Access
Local User Account
Log
Log File
Log Message Function
Logical Link
Login Session
Logon User
MacOS Keychain
Mail Network Traffic
Mail Server
Mail Service
Mathematical Function
Media Server
Memory Address
Memory Address Space
Memory Allocation Function
Memory Block
Memory Extent
Memory Free Function
Memory Management Unit
Memory Management Unit Component
Memory Pool
Memory Protection Unit
Memory Word
Message Transfer Agent
Metadata
Microcode
Mobile Phone
Modem
Mouse Input Device
Move File
Multimedia Document File
NTFS Hard Link
NTFS Junction Point
NTFS Link
NTFS Symbolic Link
Network
Network Card Firmware
Network Directory Resource
Network File Resource
Network File Share Resource
Network Flow
Network Flow Sensor
Network Init Script File Resource
Network Link
Network Node
Network Packet
Network Printer
Network Protocol Analyzer
Network Resource
Network Resource Access
Network Sensor
Network Service
Network Session
Network Traffic
Network Traffic Analysis Software
Object File
Office Application
Office Application File
Open File
Operating System
Operating System Configuration
Operating System Configuration Component
Operating System Configuration File
Operating System Executable File
Operating System File
Operating System Log File
Operating System Packaging Tool
Operating System Process
Operating System Shared Library File
Operations Center Computer
Optical Modem
Orchestration Controller
Orchestration Server
Orchestration Worker
Outbound Internet DNS Lookup Traffic
Outbound Internet Encrypted Remote Terminal Traffic
Outbound Internet Encrypted Traffic
Outbound Internet Encrypted Web Traffic
Outbound Internet File Transfer Traffic
Outbound Internet Mail Traffic
Outbound Internet Network Traffic
Outbound Internet RPC Traffic
Outbound Internet Web Traffic
Outbound Network Traffic
Output Device
POSIX Symbolic Link
Packet Log
Page
Page Frame
Page Table
Parent Process
Partition
Partition Table
Password
Password Database
Password File
Password Manager
Password Store
Peripheral Firmware
Peripheral Hub Firmware
Personal Computer
Physical Address
Physical Link
Physical Location
Pipe
Platform
Pointer
Pointer Dereferencing Function
PowerShell Profile Script
Primary Storage
Print Server
Private Key
Privileged User Account
Process
Process Code Segment
Process Data Segment
Process Environment Variable
Process Image
Process Segment
Process Start Function
Process Tree
Processor
Processor Component
Processor Register
Property List File
Proxy Server
Public Key
Python Package
Python Script File
RAM
RDP Session
RF Node
RF Receiver
RF Transceiver
RF Transmitter
ROM
RPC Network Traffic
Radio Modem
Raw Memory Access Function
Read File
Record
Remote Authentication Service
Remote Authorization Service
Remote Command
Remote Database Query
Remote Procedure Call
Remote Resource
Remote Session
Remote Terminal Session
Removable Media Device
Resource
Resource Access
Resource Fork
Reverse Proxy Server
Router
SSH Session
Saved Instruction Pointer
Script Application Process
Second-stage Boot Loader
Secondary Storage
Security Token
Sensor
Serialization Function
Server
Service Application
Service Application Process
Service Dependency
Session
Session Cookie
Set System Config Value
Shadow Stack
Shared Computer
Shared Library File
Shared Resource Access Function
Shim
Shim Database
Shortcut File
Slow Symbolic Link
Software
Software Artifact Server
Software Deployment Tool
Software Library
Software Library File
Software Package
Software Packaging Tool
Software Patch
Source Code Analyzer Tool
Stack Component
Stack Frame
Stack Frame Canary
Stack Segment
Startup Directory
Static Analysis Tool
Storage
Stored Procedure
String Format Function
Subroutine
Suspend Process
Switch
Symbolic Link
Symmetric Key
System Call
System Config System Call
System Configuration Database
System Configuration Database Record
System Configuration Init Database Record
System Configuration Init Resource
System Dependency
System Firewall Configuration
System Firmware
System Init Configuration
System Init Process
System Init Script
System Password Database
System Service Software
System Software
System Startup Directory
System Time Application
System Utilization Record
Tablet Computer
Task Schedule
Task Scheduler Process
Task Scheduler Software
Terminate Process
Tertiary Storage
Test Execution Tool
Thin Client Computer
Thread
Thread Start Function
Ticket Granting Ticket
Trace Process
Translation Lookaside Buffer
Transport Link
Trust Store
URL
Unit Test Execution Tool
Unix Hard Link
Unix Link
User
User Account
User Action
User Application
User Behavior
User Init Configuration File
User Init Script
User Input Function
User Interface
User Logon Init Resource
User Process
User Startup Directory
User Startup Script File
User to User Message
Utility Software
VPN Server
Version Control Tool
Video Input Device
Virtual Address
Virtual Memory Space
Virtualization Software
Volume
Volume Boot Record
Web Application Firewall
Web Application Server
Web Authentication
Web File Resource
Web Network Traffic
Web Resource Access
Web Script File
Web Server
Web Server Application
Wide Area Network
Windows Registry
Windows Registry Key
Windows Shortcut File
Wireless Access Point
Wireless Router
Write File
Zero Client Computer
Object Properties
id: d3f:Process
- name
- Process
- definition
- A process is an instance of a computer program that is being executed. It contains the program code and its current activity. Depending on the operating system (OS), a process may be made up of multiple threads of execution that execute instructions concurrently. A computer program is a passive collection of instructions, while a process is the actual execution of those instructions. Several processes may be associated with the same program; for example, opening up several instances of the same program often means more than one process is being executed.
- defined by
- http://dbpedia.org/resource/Process_(computing)
Neighbors
graph LR;
d3f:CreateProcess["Create Process"] --> | creates | d3f:Process["Process"];
class d3f:CreateProcess inbound_node;
style d3f:CreateProcess fill:#fff4dd;
class d3f:Process RootArtifactNode;
style d3f:Process fill:#fff4dd;
click d3f:CreateProcess href "/dao/artifact/d3f:CreateProcess";
click d3f:Process href "/dao/artifact/d3f:Process";d3f:ProcessTree["Process Tree"] --> | contains | d3f:Process["Process"];
class d3f:ProcessTree inbound_node;
style d3f:ProcessTree fill:#fff4dd;
class d3f:Process RootArtifactNode;
style d3f:Process fill:#fff4dd;
click d3f:ProcessTree href "/dao/artifact/d3f:ProcessTree";
click d3f:Process href "/dao/artifact/d3f:Process";d3f:Software["Software"] --> | instructs | d3f:Process["Process"];
class d3f:Software inbound_node;
style d3f:Software fill:#fff4dd;
class d3f:Process RootArtifactNode;
style d3f:Process fill:#fff4dd;
click d3f:Software href "/dao/artifact/d3f:Software";
click d3f:Process href "/dao/artifact/d3f:Process";d3f:SuspendProcess["Suspend Process"] --> | evicts | d3f:Process["Process"];
class d3f:SuspendProcess inbound_node;
style d3f:SuspendProcess fill:#fff4dd;
class d3f:Process RootArtifactNode;
style d3f:Process fill:#fff4dd;
click d3f:SuspendProcess href "/dao/artifact/d3f:SuspendProcess";
click d3f:Process href "/dao/artifact/d3f:Process";d3f:TerminateProcess["Terminate Process"] --> | terminates | d3f:Process["Process"];
class d3f:TerminateProcess inbound_node;
style d3f:TerminateProcess fill:#fff4dd;
class d3f:Process RootArtifactNode;
style d3f:Process fill:#fff4dd;
click d3f:TerminateProcess href "/dao/artifact/d3f:TerminateProcess";
click d3f:Process href "/dao/artifact/d3f:Process";d3f:TraceProcess["Trace Process"] --> | monitors | d3f:Process["Process"];
class d3f:TraceProcess inbound_node;
style d3f:TraceProcess fill:#fff4dd;
class d3f:Process RootArtifactNode;
style d3f:Process fill:#fff4dd;
click d3f:TraceProcess href "/dao/artifact/d3f:TraceProcess";
click d3f:Process href "/dao/artifact/d3f:Process";
d3f:Process["Process"] --> | contains | d3f:ProcessImage["Process Image"];
class d3f:Process RootArtifactNode; class d3f:ProcessImage ArtifactNode;
click d3f:Process href "/dao/artifact/undefined";
click d3f:ProcessImage href "/dao/artifact/d3f:ProcessImage";d3f:Process["Process"] --> | uses | d3f:Resource["Resource"];
class d3f:Process RootArtifactNode; class d3f:Resource ArtifactNode;
click d3f:Process href "/dao/artifact/undefined";
click d3f:Resource href "/dao/artifact/d3f:Resource";d3f:Process["Process"] --> | instructed-by | d3f:Software["Software"];
class d3f:Process RootArtifactNode; class d3f:Software ArtifactNode;
click d3f:Process href "/dao/artifact/undefined";
click d3f:Software href "/dao/artifact/d3f:Software";d3f:Process["Process"] --> | process-user | d3f:UserAccount["User Account"];
class d3f:Process RootArtifactNode; class d3f:UserAccount ArtifactNode;
click d3f:Process href "/dao/artifact/undefined";
click d3f:UserAccount href "/dao/artifact/d3f:UserAccount";d3f:Process["Process"] --> | may-execute | d3f:Thread["Thread"];
class d3f:Process RootArtifactNode; class d3f:Thread ArtifactNode;
click d3f:Process href "/dao/artifact/undefined";
click d3f:Thread href "/dao/artifact/d3f:Thread";d3f:Process["Process"] --> | process-image-path | d3f:ExecutableBinary["Executable Binary"];
class d3f:Process RootArtifactNode; class d3f:ExecutableBinary ArtifactNode;
click d3f:Process href "/dao/artifact/undefined";
click d3f:ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";
Inferred Relationships
Hierarchy
(filtered)
Related Countermeasure Techniques
graph LR;
DomainTrustPolicy["Domain Trust Policy"] -->
| restricts | DirectoryService["Directory Service"]; class DomainTrustPolicy DefensiveTechniqueNode; class DirectoryService ArtifactNode; click DomainTrustPolicy href "/technique/d3f:DomainTrustPolicy"; click DirectoryService href "/dao/artifact/d3f:DirectoryService";SystemDaemonMonitoring["System Daemon Monitoring"] -->
| monitors | OperatingSystemProcess["Operating System Process"]; class SystemDaemonMonitoring DefensiveTechniqueNode; class OperatingSystemProcess ArtifactNode; click SystemDaemonMonitoring href "/technique/d3f:SystemDaemonMonitoring"; click OperatingSystemProcess href "/dao/artifact/d3f:OperatingSystemProcess";ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
| analyzes | Process["Process"]; class ProcessSelf-ModificationDetection DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSelf-ModificationDetection href "/technique/d3f:ProcessSelf-ModificationDetection"; click Process href "/dao/artifact/d3f:Process";ProcessSpawnAnalysis["Process Spawn Analysis"] -->
| analyzes | Process["Process"]; class ProcessSpawnAnalysis DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; click Process href "/dao/artifact/d3f:Process";ProcessLineageAnalysis["Process Lineage Analysis"] -->
| analyzes | Process["Process"]; class ProcessLineageAnalysis DefensiveTechniqueNode; class Process ArtifactNode; click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis"; click Process href "/dao/artifact/d3f:Process";Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
| isolates | Process["Process"]; class Hardware-basedProcessIsolation DefensiveTechniqueNode; class Process ArtifactNode; click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; click Process href "/dao/artifact/d3f:Process";MandatoryAccessControl["Mandatory Access Control"] -->
| isolates | Process["Process"]; class MandatoryAccessControl DefensiveTechniqueNode; class Process ArtifactNode; click MandatoryAccessControl href "/technique/d3f:MandatoryAccessControl"; click Process href "/dao/artifact/d3f:Process";ProcessTermination["Process Termination"] -->
| terminates | Process["Process"]; class ProcessTermination DefensiveTechniqueNode; class Process ArtifactNode; click ProcessTermination href "/technique/d3f:ProcessTermination"; click Process href "/dao/artifact/d3f:Process";ProcessSuspension["Process Suspension"] -->
| suspends | Process["Process"]; class ProcessSuspension DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSuspension href "/technique/d3f:ProcessSuspension"; click Process href "/dao/artifact/d3f:Process";ScriptExecutionAnalysis["Script Execution Analysis"] -->
| analyzes | ScriptApplicationProcess["Script Application Process"]; class ScriptExecutionAnalysis DefensiveTechniqueNode; class ScriptApplicationProcess ArtifactNode; click ScriptExecutionAnalysis href "/technique/d3f:ScriptExecutionAnalysis"; click ScriptApplicationProcess href "/dao/artifact/d3f:ScriptApplicationProcess";
Related Weaknesses
Process has no related weaknesses in this release.
Related Offensive Techniques
graph LR;
T1212["Exploitation for Credential Access"] --> |may-access| AuthenticationService["Authentication Service"]; class T1212 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1212 href "/offensive-technique/attack/T1212/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1556["Modify Authentication Process"] --> |modifies| AuthenticationService["Authentication Service"]; class T1556 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1556 href "/offensive-technique/attack/T1556/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1003001["LSASS Memory"] --> |accesses| AuthenticationService["Authentication Service"]; class T1003001 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1003001 href "/offensive-technique/attack/T1003.001/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1003002["Security Account Manager"] --> |may-access| AuthenticationService["Authentication Service"]; class T1003002 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1003002 href "/offensive-technique/attack/T1003.002/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1550["Use Alternate Authentication Material"] --> |accesses| AuthenticationService["Authentication Service"]; class T1550 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1550 href "/offensive-technique/attack/T1550/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1033["System Owner/User Discovery"] --> |may-access| DirectoryService["Directory Service"]; class T1033 OffensiveTechniqueNode;
class DirectoryService ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click DirectoryService href "/dao/artifact/d3f:DirectoryService";T1505002["Transport Agent"] --> |adds| MessageTransferAgent["Message Transfer Agent"]; class T1505002 OffensiveTechniqueNode;
class MessageTransferAgent ArtifactNode; click T1505002 href "/offensive-technique/attack/T1505.002/"; click MessageTransferAgent href "/dao/artifact/d3f:MessageTransferAgent";T1562001["Disable or Modify Tools"] --> |disables| OperatingSystemProcess["Operating System Process"]; class T1562001 OffensiveTechniqueNode;
class OperatingSystemProcess ArtifactNode; click T1562001 href "/offensive-technique/attack/T1562.001/"; click OperatingSystemProcess href "/dao/artifact/d3f:OperatingSystemProcess";T1003001["LSASS Memory"] --> |accesses| Process["Process"]; class T1003001 OffensiveTechniqueNode;
class Process ArtifactNode; click T1003001 href "/offensive-technique/attack/T1003.001/"; click Process href "/dao/artifact/d3f:Process";T1003002["Security Account Manager"] --> |may-access| Process["Process"]; class T1003002 OffensiveTechniqueNode;
class Process ArtifactNode; click T1003002 href "/offensive-technique/attack/T1003.002/"; click Process href "/dao/artifact/d3f:Process";T1003004["LSA Secrets"] --> |may-access| Process["Process"]; class T1003004 OffensiveTechniqueNode;
class Process ArtifactNode; click T1003004 href "/offensive-technique/attack/T1003.004/"; click Process href "/dao/artifact/d3f:Process";T1505003["Web Shell"] --> |produces| Process["Process"]; class T1505003 OffensiveTechniqueNode;
class Process ArtifactNode; click T1505003 href "/offensive-technique/attack/T1505.003/"; click Process href "/dao/artifact/d3f:Process";T1546007["Netsh Helper DLL"] --> |produces| Process["Process"]; class T1546007 OffensiveTechniqueNode;
class Process ArtifactNode; click T1546007 href "/offensive-technique/attack/T1546.007/"; click Process href "/dao/artifact/d3f:Process";