D3FEND™ - A knowledge graph of cybersecurity countermeasures
type: Ontology
description: D3FEND is a framework which encodes a countermeasure knowledge base as a knowledge graph. The graph contains the types and relations that define key concepts in the cybersecurity countermeasure domain and the relations necessary to link those concepts to each other. Each of these concepts and relations are linked to references in the cybersecurity literature.
license: MIT
comment: Use of the D3FEND Knowledge Graph, and the associated references from this ontology are subject to the Terms of Use. D3FEND is funded by the National Security Agency (NSA) Cybersecurity Directorate and managed by the National Security Engineering Center (NSEC) whcih is operated by The MITRE Corporation. D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. This software was produced for the U.S. Government under Basic Contract No. W56KGU-18-D0004, and is subject to the Rights in Noncommercial Computer Sotware and Noncommercial Computer Software Documentation Clause 252.227-7014 (FEB 2012) Copyright 2021 The MITRE Corporation.
version IRI: d3fend.owl

AMD64 Code Segment
type: Image Code Segment
type: Process Code Segment
type: NamedIndividual

ARM32 Code Segment
type: Image Code Segment
type: Process Code Segment
type: NamedIndividual

ASCII Domain Name
type: Domain Name
type: NamedIndividual

Access Control List
type: Class
comment: A list of permissions attached to an object.
subclass of: Access Control Information

Adobe PDF File 1.3
type: Document File
type: NamedIndividual
may-contain: Javascript File

Alias
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: In macOS, an alias is a small file that represents another object in a local, remote, or removable[1] file system and provides a dynamic link to it; the target object may be moved or renamed, and the alias will still link to it (unless the original file is recreated; such an alias is ambiguous and how it is resolved depends on the version of macOS).
subclass of: Slow Symbolic Link

Application Inventory Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: Application
subclass of: Endpoint Sensor

Application Process Configuration
type: Class
comment: The current configuration of an application process, stored in memory. It may have been sourced from other types of application configurations, e.g. Application Configuration Files or Application Configuration Database Records.
subclass of: Application Configuration

Application Shim
type: Class
type: NamedIndividual
contains: Executable File
comment: An application shim adapts an application program to run on a version of a platform for which they were not originally created. Most commonly "Application Shimming" refers to use of The Windows Application Compatibility Toolkit (ACT) provides backward compatibility by simulating the behavior of older version of Windows.
subclass of: Shim

Assertion Confidence
type: Class
comment: Assertion confidence individuals enumerate the confidence (high, medium, or low) assigned to the assertions that a given product implements a technique.
subclass of: D3FEND Analysis Thing

Authentication Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: An authentication server provides a network service that applications use to authenticate the credentials, usually account names and passwords, of their users. When a client submits a valid set of credentials, it receives a cryptographic ticket that it can subsequently use to access various services. Major authentication algorithms include passwords, Kerberos, and public key encryption.
subclass of: Server

Authorization Log
type: Class
type: NamedIndividual
records: Network Resource Access
comment: A log of authorization events.
subclass of: Restriction
  on property: records
  some values from: Network Resource Access
subclass of: Log

BSD Process
type: Process
type: NamedIndividual

Barcode Scanner Input Device
type: Class
comment: A barcode reader (or barcode scanner) is an optical scanner that can read printed barcodes, decode the data contained in the barcode and send the data to a computer. Like a flatbed scanner, it consists of a light source, a lens and a light sensor translating for optical impulses into electrical signals. Additionally, nearly all barcode readers contain decoder circuitry that can analyze the barcode's image data provided by the sensor and sending the barcode's content to the scanner's output port.
subclass of: Image Scanner Input Device
alternative label: Barcode Reader

Bash Script File
type: Executable Script
type: NamedIndividual

Book
type: Reference Type
type: NamedIndividual

Book Reference
type: Class
pref-label: Book
subclass of: Technique Reference

Business Communication Platform Client
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Client software to enable the process of sharing information between employees within and outside a company. Business communication encompasses topics such as marketing, brand management, customer relations, consumer behavior, advertising, public relations, corporate communication, community engagement, reputation management, interpersonal communication, employee engagement, and event management. It is closely related to the fields of professional communication and technical communication.
subclass of: Collaborative Software

CA Certificate File
type: Class
type: NamedIndividual
contains: Certificate
may-contain: File
may-contain: URL
comment: A file containing a digital certificate issued by a certificate authority (CA). Certificate authorities store, issue, and sign digital certificates used as part of the public key infrastructure.
subclass of: Certificate File

Call Stack
type: Class
type: NamedIndividual
contains: Stack Frame
comment: In computer science, a call stack is a stack data structure that stores information about the active subroutines of a computer program. This kind of stack is also known as an execution stack, program stack, control stack, run-time stack, or machine stack, and is often shortened to just "the stack". Although maintenance of the call stack is important for the proper functioning of most software, the details are normally hidden and automatic in high-level programming languages. Many computer instruction sets provide special instructions for manipulating stacks.
subclass of: Restriction
  on property: contains
  some values from: Stack Frame
subclass of: Digital Artifact

Chatroom Client
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Client software used to describe conduct any form of synchronous conferencing, occasionally even asynchronous conferencing. The term can thus mean any technology ranging from real-time online chat and online interaction with strangers (e.g., online forums) to fully immersive graphical social environments.
subclass of: Collaborative Software
alternative label: Chat Room Client

Child Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: A child process in computing is a process created by another process (the parent process). This technique pertains to multitasking operating systems, and is sometimes called a subprocess or traditionally a subtask. There are two major procedures for creating a child process: the fork system call (preferred in Unix-like systems and the POSIX standard) and the spawn (preferred in the modern (NT) kernel of Microsoft Windows, as well as in some historical operating systems).
subclass of: Process

Cloud Service Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: Cloud Service Authorization
subclass of: Restriction
  on property: monitors
  some values from: Cloud Service Authentication
subclass of: Sensor

Command History Log File
type: Class
type: NamedIndividual
contains: Command History Log
contains: Log
may-contain: File
may-contain: URL
comment: A command history log file is a file containing a command history, which the history of commands run in an operating system shell.
subclass of: Restriction
  on property: contains
  some values from: Command History Log
subclass of: Log File

Command Line Interface
type: Class
comment: A command-line interface or command language interpreter (CLI), also known as command-line user interface, console user interface, and character user interface (CUI), is a means of interacting with a computer program where the user (or client) issues commands to the program in the form of successive lines of text (command lines). Command-line interfaces to computer operating systems are less widely used by casual computer users, who favor graphical user interfaces. Programs with command-line interfaces are generally easier to automate via scripting.
subclass of: User Interface
alternative label: CLI
alternative label: CUI
alternative label: Command-line Interface

Computing Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A compute server is a system specifically designed to undertake large amounts of computation, usually but not necessarily in a client/server environment.
subclass of: Server

Container Build Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A software build tool that creates a container (e.g., Docker container) for deployment.
subclass of: Software Packaging Tool

DNS Calc Detection
type: Class
type: NamedIndividual
analyzes: Outbound Internet DNS Lookup Traffic
enables: Detect
may-contain: DNS Lookup
subclass of: DNS Traffic Analysis

DNS Record
type: Class
comment: A Domain Name System (DNS) record is a record of information returned to clients seeking to find computers, services, and other resources connected to the Internet or a private network. Record information is stored on a domain name server so it can respond to DNS queries from clients.There are a variety of record types, depending on the client's information needs. Common types include Start of Authority, IP addresses, SMTP mail exchangers, name servers, reverse DNS lookup pointers, etc.
subclass of: Record

DNS Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A Domain Name System (DNS) name server is a kind of name server. Domain names are one of the two principal namespaces of the Internet. The most important function of DNS servers is the translation (resolution) of human-memorable domain names and hostnames into the corresponding numeric Internet Protocol (IP) addresses, the second principal name space of the Internet which is used to identify and locate computer systems and resources on the Internet. (en). More generally, a name server is a computer application that implements a network service for providing responses to queries against a directory service. It translates an often humanly meaningful, text-based identifier to a system-internal, often numeric identification or addressing component. This service is performed by the server in response to a service protocol request.
subclass of: Server

Data Artifact Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A data artifact server provides access services to content in a content repository. The content repository or content store is a database of digital content with an associated set of data management, search and access methods allowing application-independent access to the content, rather like a digital library, but with the ability to store and modify content in addition to searching and retrieving. The content repository acts as the storage engine for a larger application such as a content management system or a document management system, which adds a user interface on top of the repository's application programming interface.
subclass of: Artifact Server

Database Server
type: Class
type: NamedIndividual
contains: Application
contains: Database
contains: Operating System
runs: Operating System
comment: A database server is a server which uses a database application that provides database services to other computer programs or to computers, as defined by the client–server model. Database management systems (DBMSs) frequently provide database-server functionality, and some database management systems (such as MySQL) rely exclusively on the client–server model for database access (while others e.g. SQLite are meant for using as an embedded database). For clarification, a database server is simply a server that maintains services related to clients via database applications.
subclass of: Restriction
  on property: contains
  some values from: Database
subclass of: Server
alternative label: Network Database Resource

Desktop Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A desktop computer is a personal computer designed for regular use at a single location on or near a desk or table due to its size and power requirements. The most common configuration has a case that houses the power supply, motherboard (a printed circuit board with a microprocessor as the central processing unit (CPU), memory, bus, and other electronic components, disk storage (usually one or more hard disk drives, solid state drives, optical disc drives, and in early models a floppy disk drive); a keyboard and mouse for input; and a computer monitor, speakers, and, often, a printer for output. The case may be oriented horizontally or vertically and placed either underneath, beside, or on top of a desk.
subclass of: Personal Computer

Dial Up Modem
type: Class
type: NamedIndividual
runs: Operating System
comment: A dial-up modem transmits computer data over an ordinary switched telephone line that has not been designed for data use. This contrasts with leased line modems, which also operate over lines provided by a telephone company, but ones which are intended for data use and do not impose the same signaling constraints. The modulated data must fit the frequency constraints of a normal voice audio signal, and the modem must be able to perform the actions needed to connect a call through a telephone exchange, namely: picking up the line, dialing, understanding signals sent back by phone company equipment (dial tone, ringing, busy signal,) and on the far end of the call, the second modem in the connection must be able to recognize the incoming ring signal and answer the line.
subclass of: Modem

Digital System
type: Class
subclass of: Digital Object

Directory Service
type: Class
comment: In computing, directory service or name service maps the names of network resources to their respective network addresses. It is a shared information infrastructure for locating, managing, administering and organizing everyday items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers and other objects. A directory service is a critical component of a network operating system. A directory server or name server is a server which provides such a service. Each resource on the network is considered an object by the directory server. Information about a particular resource is stored as a collection of attributes associated with that resource or object.
subclass of: Network Service

Display Device Driver
type: Class
type: NamedIndividual
drives: Display Adapter
drives: Hardware Device
comment: A device driver for a display adapter.
subclass of: Restriction
  on property: drives
  some values from: Display Adapter
subclass of: Hardware Driver

Dynamic Analysis Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor.
subclass of: Code Analyzer

Email Attachment
type: Class
type: NamedIndividual
attached-to: Email
may-contain: Executable Script
may-contain: File
may-contain: URL
comment: An email attachment is a computer file sent along with an email message. One or more files can be attached to any email message, and be sent along with it to the recipient. This is typically used as a simple method to share documents and images.
subclass of: Restriction
  on property: attached-to
  some values from: Email
subclass of: Document File

Embedded Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: An embedded computer is a computer system—a combination of a computer processor, computer memory, and input/output peripheral devices—that has a dedicated function within a larger mechanical or electrical system. It is embedded as part of a complete device often including electrical or electronic hardware and mechanical parts. Because an embedded system typically controls physical operations of the machine that it is embedded within, it often has real-time computing constraints. Embedded systems control many devices in common use today. Ninety-eight percent of all microprocessors manufactured are used in embedded systems.
subclass of: Client Computer
alternative label: Embedded System

Emulated File Analysis
type: File Analysis
type: Class
type: NamedIndividual
analyzes: Document File
analyzes: Executable File
d3fend-id: D3-EFA
definition: Emulating instructions in a file looking for specific patterns.
enables: Detect
kb-reference: Reference - Network-level polymorphic shellcode detection using emulation
subclass of: Restriction
  on property: analyzes
  some values from: Executable File
subclass of: Restriction
  on property: analyzes
  some values from: Document File
subclass of: File Analysis

Enclave
type: Class
type: NamedIndividual
may-contain: Local Area Network
comment: Network enclaves consist of standalone assets that do not interact with other information systems or networks. A major difference between a DMZ or demilitarized zone and a network enclave is a DMZ allows inbound and outbound traffic access, where firewall boundaries are traversed. In an enclave, firewall boundaries are not traversed. Enclave protection tools can be used to provide protection within specific security domains. These mechanisms are installed as part of an Intranet to connect networks that have similar security requirements.
subclass of: Restriction
  on property: may-contain
  some values from: Local Area Network
subclass of: Digital Artifact
alternative label: Network Enclave

Exception Handler
type: Class
type: NamedIndividual
contains: Executable File
comment: An exception handler is a code segment that processes an exception.
subclass of: Subroutine

FQDN Domain Name
type: Domain Name
type: NamedIndividual

Fast Flux Detection
type: Class
type: NamedIndividual
analyzes: Outbound Internet DNS Lookup Traffic
enables: Detect
may-contain: DNS Lookup
subclass of: DNS Traffic Analysis

Fast Symbolic Link
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: Fast symbolic links, allow storage of the target path within the data structures used for storing file information on disk (e.g., within the inodes). This space normally stores a list of disk block addresses allocated to a file. Thus, symlinks with short target paths are accessed quickly. Systems with fast symlinks often fall back to using the original method if the target path exceeds the available inode space.
subclass of: Symbolic Link
subclass of: Unix Link
disjoint with: Slow Symbolic Link
alternative label: Fast Symlink

File Hashing
type: File Analysis
type: Class
type: NamedIndividual
analyzes: File
d3fend-id: D3-FH
definition: Employing file hash comparisons to detect known malware.
enables: Detect
kb-article: ## How it works This technique requires a list of hashes to compare a file against. ## Considerations Performance on large files or very large numbers of files.
kb-reference: Reference - Munin
subclass of: Restriction
  on property: analyzes
  some values from: File
subclass of: File Analysis

File Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: The term server highlights the role of the machine in the traditional client–server scheme, where the clients are the workstations using the storage. A file server does not normally perform computational tasks or run programs on behalf of its client workstations. File servers are commonly found in schools and offices, where users use a local area network to connect their client computers.
subclass of: Server

File Share Service
type: Class
comment: A file sharing service (or file share service) provides the ability to share data across a network.
subclass of: Network Service

File System Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: File
subclass of: Endpoint Sensor

Finger Print Scanner Input Device
type: Class
comment: A fingerprint sensor is an electronic device used to capture a digital image of the fingerprint pattern. The captured image is called a live scan. This live scan is digitally processed to create a biometric template (a collection of extracted features) which is stored and used for matching. Many technologies have been used including optical, capacitive, RF, thermal, piezoresistive, ultrasonic, piezoelectric, and MEMS.
subclass of: Image Scanner Input Device
alternative label: Fingerprint Sensor

Firmware Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: Firmware
subclass of: Endpoint Sensor

First-stage Boot Loader
type: Class
subclass of: Boot Loader

Forward Proxy Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: An forward (or open) proxy is a proxy server that is accessible by any Internet user. Generally, a proxy server only allows users within a network group (i.e. a closed proxy) to store and forward Internet services such as DNS or web pages to reduce and control the bandwidth used by the group. With an open proxy, however, any user on the Internet is able to use this forwarding service.
subclass of: Proxy Server

Forward Resolution IP Denylisting
type: DNS Denylisting
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
blocks: Inbound Internet DNS Response Traffic
d3fend-id: D3-FRIDL
definition: Blocking a DNS lookup's answer's IP address value.
enables: Isolate
kb-article: ## How it works This technique prevents a client from learning IP addresses deemed to be potentially malicious, which would have been delivered via forward resolution responses. Responses to forward resolution requests (that is, requests where a domain is sent and IP(s) are returned) are collected, and the IP address(es) included as a response are examined. If the IP address(es) are in a range included in the blacklist, then the response is dropped and not forwarded to the client. The DNS lookup can be blocked by either dropping the network traffic with an inline device, or modifying the value of the response sent by the DNS server. To transparently prevent client applications from hanging on a request, it is common practice to replace malicious values with addresses in the range 127.0.0.0/8 or the address of a honeypot maintained by the network administrators. ## Considerations * This technique does not prevent the client from contacting the blacklisted IP, only from learning about this IP address via a nameserver lookup request. * DNS Response traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS answer IP address value(s). * DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of response over UDP. * Usage of new protocols to provide confidentiality for DNS traffic, such as DoH (DNS over HTTPS) and DoT (DNS over TLS), complicates collection of the IP address(es) in DNS responses. These protocols have often been enabled in browser settings transparently after a browser update, with DNS requests proxied over one of these cryptographic protocols through a specified host. * This technique must be implemented logically between the application that receives the response and the server which sent the response. * DNS responses sent in an encrypted manner, such as those using DoH or DoT, will require interception of the TLS connections in …
kb-reference: Reference - Use DNS Policy for Applying Filters on DNS Queries
synonym: Forward Resolution IP Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: Inbound Internet DNS Response Traffic
subclass of: DNS Denylisting

GNU GCC StackGuard
type: Stack Frame Canary Verification
type: NamedIndividual

Graphics Card Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on computer graphics card.
subclass of: Peripheral Firmware
alternative label: Video Card Firmware

HTTPS URL
type: URL
type: NamedIndividual

HTTP URL
type: URL
type: NamedIndividual

Hard Disk Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on a hard disk device.
subclass of: Peripheral Firmware
alternative label: Hard Drive Firmware

Heap Segment
type: Class
comment: The heap segment (or free store) is a large pool of memory from which dynamic memory requests of a process are allocated and satisfied.
subclass of: Process Segment

Hierarchical Domain Denylisting
type: Forward Resolution Domain Denylisting
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
blocks: Outbound Internet DNS Lookup Traffic
d3fend-id: D3-HDDL
definition: Blocking the resolution of any subdomain of a specified domain name.
enables: Isolate
kb-article: ## How it works This technique is used to block DNS queries from related domains and subdomains that are unauthorized. Hierarchical domain blacklisting considers the blacklisting of second level domains and additional sub-domains and specific hosts for a given query value. A denylist is maintained that contains DNS names and corresponding subdomains, including wildcards, that should be blocked for a given lookup. ## Considerations * The denylist of domain names will have to be maintained and will need to be kept up to date * Other domains that resolve to the domain of interest for blocking (CNAME, etc). * Denylists should have identified maintenance cycles to ensure lists are not stale.
kb-reference: Reference - Use DNS Policy for Applying Filters on DNS Queries
synonym: Hierarchical Domain Blacklisting
subclass of: Forward Resolution Domain Denylisting

Host Configuration Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: Operating System Configuration
subclass of: Restriction
  on property: monitors
  some values from: Application Configuration
subclass of: Endpoint Sensor

Hostname
type: Domain Name
type: Class
type: NamedIndividual
comment: In computer networking, a hostname (archaically nodename) is a label that is assigned to a device connected to a computer network and that is used to identify the device in various forms of electronic communication, such as the World Wide Web. Hostnames may be simple names consisting of a single word or phrase, or they may be structured.
subclass of: Identifier
alternative label: Nodename

Human Input Device Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on an HCI device such as a mouse or keyboard.
subclass of: Peripheral Firmware

IP Address
type: Class
comment: An Internet Protocol address (IP address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.An IP address serves two main functions: host or network interface identification and location addressing. Internet Protocol version 4 (IPv4) defines an IP address as a 32-bit number. However, because of the growth of the Internet and the depletion of available IPv4 addresses, a new version of IP (IPv6), using 128 bits for the IP address, was standardized in 1998. IPv6 deployment has been ongoing since the mid-2000s.
subclass of: Identifier

IP Phone
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A VoIP phone or IP phone uses voice over IP technologies for placing and transmitting telephone calls over an IP network, such as the Internet, instead of the traditional public switched telephone network (PSTN). Digital IP-based telephone service uses control protocols such as the Session Initiation Protocol (SIP), Skinny Client Control Protocol (SCCP) or various other proprietary protocols.
subclass of: Personal Computer
alternative label: VoIP Phone

Instant Messaging Client
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Client software used to engage in Instant Messaging, a type of online chat that offers real-time text transmission over the Internet. A LAN messenger operates in a similar way over a local area network. Short messages are typically transmitted between two parties, when each user chooses to complete a thought and select "send". Some IM applications can use push technology to provide real-time text, which transmits messages character by character, as they are composed. More advanced instant messaging can add file transfer, clickable hyperlinks, Voice over IP, or video chat.
subclass of: Collaborative Software

Integration Test Execution Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An integration test execution tool automatically performs integration testing. Integration testing (sometimes called integration and testing, abbreviated I&T) is the phase in software testing in which individual software modules are combined and tested as a group.
subclass of: Test Execution Tool

Internationalized Domain Name
type: Domain Name
type: NamedIndividual

Internet Article
type: Reference Type
type: NamedIndividual

Internet DNS Lookup
type: Class
comment: An internet Domain Name System (DNS) lookup is a DNS lookup made from a host on a network that is resolved after querying a DNS name server hosted on a different network.
subclass of: DNS Lookup

Internet File Transfer Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Internet file transfer network traffic is network traffic related to file transfers between network nodes that crosses a boundary between networks. This includes only network traffic conforming to standard file transfer protocols, not custom transfer protocols.
subclass of: File Transfer Network Traffic
subclass of: Internet Network Traffic

Internet Network
type: Class
comment: A network of multiple, connected networks. Internetworking is the practice of connecting a computer network with other networks through the use of gateways that provide a common method of routing information packets between the networks. The resulting system of interconnected networks are called an internetwork, or simply an internet. Internetworking is a combination of the words inter ("between") and networking; not internet-working or international-network.
subclass of: Network
alternative label: Interconnected Network
alternative label: Internet
alternative label: Internetwork

Intranet DNS Lookup
type: Class
comment: An Intranet Domain Name System (DNS) lookup is a DNS lookup made from a host on a network that is resolved after querying a DNS name server hosted on a that same network.
subclass of: DNS Lookup

Intranet RPC Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Intranet RPC network traffic is network traffic that does not cross a given network's boundaries and uses a standard remote procedure call (RPC) protocol.
subclass of: Intranet Network Traffic
subclass of: RPC Network Traffic

Intrusion Prevention System
type: Class
type: NamedIndividual
runs: Operating System
comment: Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it. Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent or block intrusions that are detected. IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address. An IPS also can correct cyclic redundancy check (CRC) errors, defragment packet streams, mitigate TCP sequencing issues, and clean up unwanted transport and network layer options.
subclass of: Intrusion Detection System
alternative label: IDPS
alternative label: IPS
alternative label: Intrusion Detection and Prevention System

Kerberos Ticket Granting Service Ticket
type: Class
type: NamedIndividual
authenticates: User Account
comment: A Kerberos ticket-granting service (TGS) ticket is given in response to requesting a Kerberos TGS request.
subclass of: Kerberos TIcket
alternative label: TGS Ticket

Kernel API Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: System Call
subclass of: Endpoint Sensor

Kiosk Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: An interactive kiosk is a computer terminal featuring specialized hardware and software that provides access to information and applications for communication, commerce, entertainment, or education. Early interactive kiosks sometimes resembled telephone booths, but have been embraced by retail, food service and hospitality to improve customer service and streamline operations. Interactive kiosks are typically placed in high foot traffic settings such as shops, hotel lobbies or airports.
subclass of: Shared Computer
alternative label: Interactive Kiosk

LDIF Record
type: User Account
type: NamedIndividual

Laptop Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A laptop computer (also laptop), is a small, portable personal computer (PC) with a "clamshell" form factor, typically having a thin LCD or LED computer screen mounted on the inside of the upper lid of the clamshell and an alphanumeric keyboard on the inside of the lower lid. The clamshell is opened up to use the computer. Laptops are folded shut for transportation, and thus are suitable for mobile use. Its name comes from lap, as it was deemed to be placed on a person's lap when being used. Although originally there was a distinction between laptops and notebooks (the former being bigger and heavier than the latter), as of 2014, there is often no longer any difference. Today, laptops are commonly used in a variety of settings, such as at work, in education, for playing games, web browsing
subclass of: Personal Computer
alternative label: Laptop
alternative label: Notebook

Linux ELF File 32bit
type: Executable Binary
type: NamedIndividual
comment: test

Linux ELF File 64bit
type: Executable Binary
type: NamedIndividual

Linux Exec
type: Create Process
type: NamedIndividual

Linux Process
type: Process
type: NamedIndividual

Local Authentication Service
type: Class
type: NamedIndividual
contains: Executable File
contains: Operating System File
may-contain: Application Configuration
uses: Resource
comment: A local authentication service running on a host can authenticate a user logged into just that local host computer.
subclass of: Authentication Service
subclass of: System Service Software

Local Authorization Service
type: Class
type: NamedIndividual
contains: Executable File
contains: Operating System File
may-contain: Application Configuration
uses: Resource
comment: A local authorization service running on a host can authorize a user logged into just that local host computer.
subclass of: Authorization Service
subclass of: System Service Software

Lua Script File
type: Executable Script
type: NamedIndividual

MSG Email File
type: Email
type: NamedIndividual

Mail Service
type: Class
comment: A mail service provides the ability to send and receive mail across a computer network. The mail service runs on message transfer agents (i.e., mail servers) and is accessed by users through an email client.
subclass of: Network Service
alternative label: Email Service

Marketing Material
type: Reference Type
type: NamedIndividual

Media Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A media server is a computer appliance or an application software that stores digital media (video, audio or images) and makes it available over a network. Media servers range from servers that provide video on demand to smaller personal computers or NAS (Network Attached Storage) for the home.
subclass of: Server

Message Authentication
type: Message Hardening
type: Class
type: NamedIndividual
authenticates: User to User Message
d3fend-id: D3-MAN
definition: Authenticating the sender of a message and ensuring message integrity.
enables: Harden
kb-article: ## How it works ### Digital Signature Digital signatures are used to verifying a message is from the expected sender. In email, Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol is typically used to digitally sign messages. A hash value of the sender’s message is created and encrypted with the sender’s private key to create a digital signature. The message and the digital signature are sent to the recipient where the sender’s public key is used to decrypt the digital signature and compute the hash of the message. The computed hash is compared with the hash from the received message, and any difference in the hash values signify the message did not originate from the sender and has been alerted in transit. ### Message Authentication Code (MAC) MAC is a fixed size string that is appended to a message to provide message authentication and integrity. The sender MAC signing algorithm takes as input a secret symmetric key shared between sender and recipient and the message to calculate a short tag that is appended to the message. The recipient receives the message with the appended tag, and a MAC verification algorithm is run using the symmetric key to verify the message came from the stated sender and ensure the message has not been tampered with. ## Considerations - Public keys associated with digital signatures should be verified by a Certification Authority (CA) to prevent impersonation. The CA verifies the owner of a public key and puts the sender’s identity and public key into a certificate that is signed by the CA. - Digital signatures provide non-repudiation where a third party can verify the authenticity of the message using the sender’s digital certificate signed by the CA. - Symmetric keys must be exchanged securely via a private channel and management of new symmetric keys are needed for each pair of participants wishing to exchange messages.
kb-reference: Reference – RFC 6376: DomainKeys Identified Mail (DKIM) Signatures – IETF
kb-reference: Reference - Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1
subclass of: Restriction
  on property: authenticates
  some values from: User to User Message
subclass of: Message Hardening

Message Encryption
type: Message Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-MENCR
definition: Encrypting a message body using a cryptographic key.
enables: Harden
encrypts: User to User Message
kb-article: ## How it works ### Asymmetric Cryptography Asymmetric encryption is typically accomplished using public and private key certificates based on the X.509 standard. The sender encrypts messages using the recipient’s public key and the receipt decrypts the message using their private key. Standards that can be used to implement message encryption include S/MIME (Secure/Multipurpose Internet Mail Extensions) and PGP. ### Symmetric Cryptography Symmetric encryption uses the same cryptographic key by both the sender and receiver to encrypt and decrypt a message. Asymmetric key exchange protocols such as Diffie-Hellman can be used to share the cryptographic key with the recipient. ## Considerations - Separate configuration settings to enable message encryption are often needed for each messenger client (e.g. webmail, desktop client, mobile). - Continuous monitoring to ensure private keys are not compromised and the certificate authority (CA) is trusted. - Secure transfer of private keys between multiple devices.
kb-reference: Reference - Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1
subclass of: Restriction
  on property: encrypts
  some values from: User to User Message
subclass of: Message Hardening

Microcode
type: Class
type: NamedIndividual
contains: Executable File
comment: Microcode is a computer hardware technique that interposes a layer of organization between the CPU hardware and the programmer-visible instruction set architecture of the computer. As such, the microcode is a layer of hardware-level instructions that implement higher-level machine code instructions or internal state machine sequencing in many digital processing elements.
subclass of: Firmware

Microsoft VCCLCompilerTool BufferSecurityCheck
type: Stack Frame Canary Verification
type: NamedIndividual

Microsoft Word DOCB File
type: Document File
type: NamedIndividual

Microsoft Word DOC File
type: Document File
type: NamedIndividual

Microsoft Word DOCM File
type: Document File
type: NamedIndividual

Microsoft Word DOCX File
type: Document File
type: NamedIndividual

Microsoft Word DOT File
type: Document File
type: NamedIndividual

Microsoft Word DOTM File
type: Document File
type: NamedIndividual

Microsoft Word DOTX File
type: Document File
type: NamedIndividual

Microsoft Word WBK File
type: Document File
type: NamedIndividual

Mobile Phone
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A mobile phone, cellular phone, cell phone, cellphone or hand phone, sometimes shortened to simply mobile, cell or just phone, is a portable telephone that can make and receive calls over a radio frequency link while the user is moving within a telephone service area. The radio frequency link establishes a connection to the switching systems of a mobile phone operator, which provides access to the public switched telephone network (PSTN). Modern mobile telephone services use a cellular network architecture and, therefore, mobile telephones are called cellular telephones or cell phones in North America. In addition to telephony, digital mobile phones (2G) support a variety of other services, such as text messaging, MMS, email, Internet access, short-range wireless communications (infrared,
subclass of: Personal Computer
alternative label: Cellphone
alternative label: Cellular Phone

Monitoring
type: Class
comment: the act of observing something (and sometimes keeping a record of it)
subclass of: D3FEND Thing

Mouse Input Device
type: Class
comment: A computer mouse (plural mice or mouses) is a hand-held pointing device that detects two-dimensional motion relative to a surface. This motion is typically translated into the motion of a pointer on a display, which allows a smooth control of the graphical user interface of a computer. In addition to moving a cursor, computer mice have one or more buttons to allow operations such as selection of a menu item on a display. Mice often also feature other elements, such as touch surfaces and scroll wheels, which enable additional control and dimensional input.
subclass of: Input Device
alternative label: Computer Mouse

NTFS Hard Link
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An NTFS hard link points to another file, and files share the same MFT entry (inode), in the same filesystem.
subclass of: Hard Link
subclass of: NTFS Link

NTFS Junction Point
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: NTFS junction points are are similar to NTFS symlinks but are defined only for directories. Only accepts local absolute paths.
subclass of: NTFS Link
subclass of: Symbolic Link
alternative label: Junction Point

NTFS Symbolic Link
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: An NTFS symbolic link records the path of another file that the links contents should show. Can accept relative paths. SMB networking (UNC path) and directory support added in NTFS 3.1.
subclass of: NTFS Link
subclass of: Symbolic Link
alternative label: NTFS Symlink

Network Card Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on a network card (network interface controller).
subclass of: Peripheral Firmware
alternative label: Network Controller Firmware

Network Directory Resource
type: Class
type: NamedIndividual
contains: Directory
comment: A directory resource made available from one host to other hosts on a computer network.
subclass of: Restriction
  on property: contains
  some values from: Directory
subclass of: Network File Share Resource

Network Flow Sensor
type: Class
subclass of: Restriction
  on property: monitors
  some values from: Network Flow
subclass of: Network Sensor

Network Printer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: In computing, a network printer is a device that can be accessed over a network which makes a persistent representation of graphics or text, usually on paper. While most output is human-readable, bar code printers are an example of an expanded use for printers. The different types of printers include 3D printer, inkjet printer, laser printer, thermal printer, etc. Note that not all printers are networked and the digital information to be printed must be passed either by removable media or as directly connecting the printer to a computer (e.g., by USB.)
subclass of: Shared Computer

Network Protocol Analyzer
type: Class
subclass of: Restriction
  on property: monitors
  some values from: Network Traffic
subclass of: Network Sensor

OS Support
type: Class
comment: OS Support individuals enumerate operating systems that products support.
subclass of: D3FEND Analysis Thing

Operating System Packaging Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A software packaging tool oriented on building a software package for a particular operating system (e.g. rpmbuild.)
subclass of: Software Packaging Tool

Operations Center Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: Mainframe computers or mainframes (colloquially referred to as "big iron") are computers used primarily by large organizations for critical applications; bulk data processing, such as census, industry and consumer statistics, and enterprise resource planning; and transaction processing. They are larger and have more processing power than some other classes of computers: minicomputers, servers, workstations, and personal computers.
subclass of: Shared Computer
alternative label: Mainframe

Optical Modem
type: Class
type: NamedIndividual
runs: Operating System
comment: A modem that connects to a fiber optic network is known as an optical network terminal (ONT) or optical network unit (ONU). These are commonly used in fiber to the home installations, installed inside or outside a house to convert the optical medium to a copper Ethernet interface, after which a router or gateway is often installed to perform authentication, routing, NAT, and other typical consumer internet functions, in addition to "triple play" features such as telephony and television service.
subclass of: Modem

Orchestration Controller
type: Class
type: NamedIndividual
contains: Application
contains: Container Orchestration Software
contains: Operating System
runs: Operating System
subclass of: Restriction
  on property: contains
  some values from: Container Orchestration Software
subclass of: Orchestration Server

Orchestration Worker
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
subclass of: Orchestration Server

Outbound Internet RPC Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet RPC traffic is RPC traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard RPC protocol.
subclass of: Outbound Internet Network Traffic
subclass of: RPC Network Traffic

PE32+ Executable File
type: Executable Binary
type: NamedIndividual

PE32 Executable File
type: Executable Binary
type: NamedIndividual

POSIX Symbolic Link
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: A POSIX-compliant symbolic link. These are often fast symbolic links, but need not be.
subclass of: Symbolic Link
subclass of: Unix Link

Packet Log
type: Class
type: NamedIndividual
records: Network Session
comment: A log of all the network packet data captured from a network by a network sensor (i.e., packet analyzer),
subclass of: Restriction
  on property: records
  some values from: Network Session
subclass of: Log

Parent Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: In computing, a parent process is a process that has created one or more child processes.
subclass of: Process

Parked Domain Detection
type: Class
type: NamedIndividual
analyzes: Outbound Internet DNS Lookup Traffic
enables: Detect
may-contain: DNS Lookup
subclass of: DNS Traffic Analysis

Password Manager
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A password manager is a software application or hardware that helps a user store and organize passwords. Password managers usually store passwords encrypted, requiring the user to create a master password: a single, ideally very strong password which grants the user access to their entire password database. Some password managers store passwords on the user's computer (called offline password managers), whereas others store data in the provider's cloud (often called online password managers). However offline password managers also offer data storage in the user's own cloud accounts rather than the provider's cloud. While the core functionality of a password manager is to securely store large collections of passwords, many provide additional features such as form filling and password generation.
subclass of: Application

Patent
type: Reference Type
type: NamedIndividual

Peripheral Hub Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on peripheral hub device such as a USB or Firewire hub.
subclass of: Peripheral Firmware
alternative label: USB Hub Firmware

Pipe
type: Class
comment: In Unix-like computer operating systems, a pipeline is a mechanism for inter-process communication using message passing. In the strictest sense, a pipe is a single segment of a pipeline, allowing one process to pass information forward to another. Network pipes allow processes on different hosts to interact.
subclass of: Interprocess Communication
alternative label: Pipeline

Powershell Script File
type: Executable Script
type: NamedIndividual

Print Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A print server, or printer server, is a device that connects printers to client computers over a network. It accepts print jobs from the computers and sends the jobs to the appropriate printers, queuing the jobs locally to accommodate the fact that work may arrive more quickly than the printer can actually handle.
subclass of: Server

Privileged User Account
type: Class
comment: A privileged account is a user account that has more privileges than ordinary users. Privileged accounts might, for example, be able to install or remove software, upgrade the operating system, or modify system or application configurations. They might also have access to files that are not normally accessible to standard users. Typical examples are root and administrator accounts. But there also service accounts, system accounts, etc. Privileged accounts are especially powerful, and should be monitored especially closely.
subclass of: User Account

Process Data Segment
type: Class
comment: A process data segment, is a portion of the program's virtual address space that contains executable instructions and corresponds to the loaded image data segment.
see also: Image Data Segment
subclass of: Process Segment

Python Script File
type: Executable Script
type: NamedIndividual

RF Shielding
type: Platform Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-RFS
definition: Adding physical barriers to a platform to prevent undesired radio interference.
enables: Harden
kb-reference: Reference - Privacy and security systems and methods of use
subclass of: Platform Hardening

Radio Modem
type: Class
type: NamedIndividual
runs: Operating System
comment: A radio modem provides the means to send digital data wirelessly. Radio modems are used to communicate by direct broadcast satellite, WiFi, WiMax, mobile phones, GPS, Bluetooth and NFC. Modern telecommunications and data networks also make extensive use of radio modems where long distance data links are required. Such systems are an important part of the PSTN, and are also in common use for high-speed computer network links to outlying areas where fiber optic is not economical.
subclass of: Modem

Reference - FWTK Documentation - fwtk.org
type: Technique Reference
type: NamedIndividual
has-link: https://web.archive.org/web/20070510153306/http://www.fwtk.org/fwtk/docs/documentation.html#1.1
kb-abstract: In case you don't already know, FWTK stands for the FireW all Tool Kit. It is used as a base to create a secure firewall system. If you need good documentation, please read the source code. If you are not familiar with C or do not feel comfortable with performing the configuration and security verification yourself, then I would suggest that you purchase a commercial firewall from a vendor (such as TIS, Checkpoint, Raptor, etc.). A machine needs other tools to secure it, including, but hardly limited to, tools to check files (tripwire), audit tools (tiger/cops), secure access methods (kerberos/ssh), something to watch logs and machine states (swatch/watcher some to mind) and filtering and routing tools such as screend/ipfilterd/ipacl. Again, I would recommend that you do not proceed to build a production FWTK firewall unless you are familiar with UNIX security.
kb-author: fwtk.org
kb-is-example-of: Inbound Traffic Filtering
kb-organization: fwtk.org
kb-reference-title: FWTK Documentation

Reference - Use Rkill to Stop Malware Processes - ghacks.net
type: Technique Reference
type: NamedIndividual
has-link: https://www.ghacks.net/2011/07/29/use-rkill-to-stop-malware-processes/
kb-author: Melanie Gross
kb-is-example-of: Process Termination
kb-organization: ghacks.net
kb-reference-title: Use Rkill to Stop Malware Processes

Reference - CAR-2015-07-001: All Logins Since Last Boot - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2015-07-001/
kb-abstract: Once a credential dumper like mimikatz runs, every user logged on since boot is potentially compromised, because the credentials were accessed via the memory of lsass.exe. When such an event occurs, this analytic will give the forensic context to identify compromised users. Those users could potentially be used in later events for additional logons. The time field indicates the first and last time a system reported a user logged into a given system. This means that activity could be intermittent between the times given and should not be considered a duration.
kb-author: MITRE
kb-organization: MITRE
kb-reference-title: CAR-2015-07-001: All Logins Since Last Boot

Reference - System and methods thereof for detection of persistent threats in a computerized environment background - Palo Alto Networks IncCyber Secdo Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170206358A1/en
kb-abstract: A system is used for detection of advanced persistent and non-persistent threats in a computerized environment. The system is connected to a plurality of user devices coupled to an enterprise's network. The system receives via an interface an electronic notification of at least one event in the operating system of the computer. The system then analyzes the at least one event. The system then generates a causality chain for the at least one event respective of the analysis. The causality chain comprises all the threads that attributed to the at least one event in a chronological order. The system then identifies a main thread that started the causality chain that led to the at least one event. Then, the system determines whether the main thread is associated with malicious software. Upon determination that the main thread is associated with malicious software, the causality chain is marked as infected.
kb-author: Gil BARAK
kb-mitre-analysis: The patent describes detecting malicious events on a host. For each new event (e.x. new file request received from a user device, a change in an existing file in a container) a causality chain is developed for all threads associated with the event. The causality chain identifies the thread that started the process of the event (main thread). If a thread in the causality chain has no parent, i.e. no main thread associated with it, the process is identified as malicious.
kb-organization: Palo Alto Networks IncCyber Secdo Ltd
kb-reference-title: System and methods thereof for detection of persistent threats in a computerized environment background

Reference - Systems and methods for detecting credential theft - Symantec Corp
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10162962B1
kb-abstract: The disclosed computer-implemented method for detecting credential theft may include (i) monitoring a secured computing system's credential store that may include at least one sensitive credential that may be used to facilitate authentication of a user that is attempting to access the secured computing system, (ii) gathering, while monitoring the credential store, primary evidence of an attempted theft of the sensitive credential from the credential store, (iii) gathering corroborating evidence of the attempted theft of the sensitive credential, and (iv) performing a security action in response to gathering the primary evidence and the corroborating evidence of the attempted theft. The primary evidence of the attempted theft of the sensitive credential may include evidence of any suspicious access of the sensitive credential from the credential store that occurs outside of a procedure of authenticating the user. Various other methods, systems, and computer-readable media are also disclosed.
kb-author: Adam Glick; Brian Schlatter; Feng Li; Akshata Krishnamoorthy Rao
kb-organization: Symantec Corp
kb-reference-title: Systems and methods for detecting credential theft

Reference - Trusted Communications With Child Processes - Microsoft Technology Licensing LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120174210A1
kb-abstract: A method to identify a child process to a parent process in an operating system includes obtaining a token and login identifier from the operating system. The parent process creates a remote procedure call communications endpoint to communicate with the child process. Thereafter, a child process is spawned by the parent process. A child-initiated request to communicate with the parent process is then received by the parent process. In order to verify the identity of the child-initiated request, the parent process impersonates the child process and receives as identifier that identifies the requestor child process. The requestor process identifier and the spawned child identifier are compared. Based on the comparison, the parent process responds to the child-initiated request. In another embodiment, process identifiers are used by the parent process to verify the identity of a child process the requests communication with the parent process.
kb-author: Kedarnath Atmaram Dubhashi, Jonathan D. Schwartz, Sambavi Muthukrishnan, Simon Skaria
kb-mitre-analysis: This patent describes a technique for detecting malicious processes that claim to be the child process of a legitimate parent process. During the spawning of a child process, a child process identifier is generated. The child process identifier is a unique identifier that can be used to identify a child process. The child process identifier is transmitted by the security system of the operating system to the parent process. The parent process keeps track of the child process identifier. When a new child-initiated communications request is received by the parent process, the parent process checks if the requesting child process identifier and the child process identifier that the parent process is tracking are the same. If the identifiers are not the same, the parent process refuses the request.
kb-organization: Microsoft Technology Licensing LLC
kb-reference-title: Trusted Communications With Child Processes

Remote Authentication Service
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A remote authentication service provides for the authentication of a user across a network (i.e., remotely).
subclass of: Authentication Service

Remote Authorization Service
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A remote authorization service provides for the authorization of a user across a network (i.e., remotely).
subclass of: Authorization Service

Remote Database Query
type: Class
type: NamedIndividual
contains: Network Packet
may-contain: Domain Name
originates-from: Physical Location
comment: A remote query session enabling a user to make an SQL, SPARQL, or similar query over the network from one host to another.
subclass of: Database Query
subclass of: Remote Command

Remote Procedure Call
type: Class
type: NamedIndividual
contains: Network Packet
may-contain: Domain Name
originates-from: Physical Location
comment: In distributed computing a remote procedure call (RPC) is when a computer program causes a procedure (subroutine) to execute in another address space (commonly on another computer on a shared network), which is coded as if it were a normal (local) procedure call, without the programmer explicitly coding the details for the remote interaction. That is, the programmer writes essentially the same code whether the subroutine is local to the executing program, or remote. This is a form of client–server interaction (caller is client, executor is server), typically implemented via a request–response message-passing system. The object-oriented programming analog is remote method invocation (RMI). The RPC model implies a level of location transparency.
subclass of: Remote Command

Remote Terminal Session
type: Class
type: NamedIndividual
contains: Network Packet
may-contain: Domain Name
originates-from: Physical Location
comment: A remote terminal session is a session that provides a user access from one host to another host via a terminal.
subclass of: Network Session

Reverse Proxy Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: In computer networks, a reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client, appearing as if they originated from the proxy server itself. Unlike a forward proxy, which is an intermediary for its associated clients to contact any server, a reverse proxy is an intermediary for its associated servers to be contacted by any client. In other words, a proxy acts on behalf of the client(s), while a reverse proxy acts on behalf of the server(s); a reverse proxy is usually an internal-facing proxy used as a 'front-end' to control and protect access to a server on a private network.
subclass of: Proxy Server

Reverse Resolution Domain Denylisting
type: DNS Denylisting
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
blocks: Inbound Internet DNS Response Traffic
d3fend-id: D3-RRDD
definition: Blocking a reverse DNS lookup's answer’s domain name value.
enables: Isolate
kb-article: ## How it works In reverse resolution requests, the client sends to a nameserver (such as a DNS server) a query of an IP address, to get a response of the associated domain name(s). This technique drops reverse lookup responses where a domain name matches an entry in the blacklist, either verbatim or as a wildcard subdomain of a higher-level domain on the list. Such domain names might be unwanted because Forward Domain Name Resolution requests to such a blacklisted domain might return an unwanted IP address. This technique is useful because relying solely on Forward Resolution Domain Blacklisting will miss instances where the domain in question is forward-resolved in a manner that is not inspected via a subsequent technique (as is likely the case if that resolution is performed with DoH (DNS over HTTPS) or DoT (DNS over TLS)). Additionally, note that responses to forward lookups of that domain are *not* necessarily equal to the original IP in the reverse lookup request, and that future lookups of a string based on this domain may even employ a less-common name resolution protocol, such as NBNS. The DNS response can either be blocked by dropping the network traffic with an inline device, or by modifying the value of the response sent by the DNS server. To prevent client applications from hanging on a request, it is common practice to replace malicious values, either with names like "localhost." or the address of a honeypot maintained by the network administrators. ## Considerations * This technique does not prevent the client from contacting the blacklisted domain or any IP addresses that it might resolve to, only from learning about this domain name via a nameserver lookup. * DNS response traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS answer domain name value(s). * DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of respon…
synonym: Reverse Resolution Domain Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: Inbound Internet DNS Response Traffic
subclass of: DNS Denylisting

Reverse Resolution IP Denylisting
type: DNS Denylisting
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
blocks: Outbound Internet DNS Lookup Traffic
d3fend-id: D3-RRID
definition: Blocking a reverse lookup based on the query’s IP address value.
enables: Isolate
kb-article: ## How it works This technique prevents a client from learning domains deemed to be potentially malicious, which would have been delivered via reverse resolution responses over the DNS protocol. Queries for reverse resolution requests (that is, requests where IP(s) are sent and a domain is returned) are collected, and the IP address(es) included in the query are examined. If the IP address(es) are in a range included in the blacklist, then the query is dropped. ## Considerations - The blacklist will have to be maintained and will need to be kept up to date with identified maintenance cycles to ensure lists are not stale. - DNS query traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS query IP address value(s). - DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of response over UDP. - Usage of new protocols to provide confidentiality for DNS traffic, such as DoH (DNS over HTTPS) and DoT (DNS over TLS), complicates collection of the IP address(es) in DNS queries. These protocols have often been enabled in browser settings transparently after a browser update, with DNS queries proxied over one of these cryptographic protocols through a specified host.
kb-reference: Reference - Use DNS Policy for Applying Filters on DNS Queries
synonym: Reverse Resolution IP Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: DNS Denylisting

Ruby Script File
type: Executable Script
type: NamedIndividual

Saved Instruction Pointer
type: Class
comment: A saved instruction pointer points to the instruction that generated an exception (trap or fault).
subclass of: Pointer
subclass of: Stack Component

Second-stage Boot Loader
type: Class
subclass of: Boot Loader

Software Artifact Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A software artifact server provides access to the software artifacts in a software repository. A software repository, or “repo” for short, is a storage location for software packages. Often a table of contents is stored, as well as metadata. Repositories group packages. Sometimes the grouping is for a programming language, such as CPAN for the Perl programming language, sometimes for an entire operating system, sometimes the license of the contents is the criteria. At client side, a package manager helps installing from and updating the repositories.
subclass of: Artifact Server

Software Patch
type: Class
type: NamedIndividual
contains: Executable File
comment: A patch is a piece of software designed to update a computer program or its supporting data, to fix or improve it. This includes fixing security vulnerabilities and other bugs, with such patches usually called bugfixes or bug fixes, and improving the usability or performance. Although meant to fix problems, poorly designed patches can sometimes introduce new problems (see software regressions). In some special cases updates may knowingly break the functionality, for instance, by removing components for which the update provider is no longer licensed or disabling a device.
subclass of: Software
alternative label: Patch

Software Update
type: Platform Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-SU
definition: Replacing old software on a computer system component.
enables: Harden
kb-reference: Reference - Method and system for providing software updates to local machines
modifies: Software
subclass of: Restriction
  on property: modifies
  some values from: Software
subclass of: Platform Hardening

Source Code
type: Reference Type
type: NamedIndividual

Source Code Analyzer Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A source code analyzer tool is a static analysis tool that operates specifically on source code, but not object code.
subclass of: Static Analysis Tool

Stack Segment
type: Class
type: NamedIndividual
contains: Stack Frame
comment: The stack segment contains the program stack, a last-in-first-out structure, typically allocated in the higher parts of memory for the process.
subclass of: Restriction
  on property: contains
  some values from: Stack Frame
subclass of: Process Segment

Startup Directory
type: Class
type: NamedIndividual
may-contain: File
comment: A startup directory is a directory containing executable files or links to executable files which are run when a user logs in or when a system component or service is started.
subclass of: Directory
subclass of: Local Resource

Switch
type: Class
type: NamedIndividual
runs: Operating System
comment: A network switch (also called switching hub, bridging hub, and by the IEEE MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A network switch is a multiport network bridge that uses MAC addresses to forward data at the data link layer (layer 2) of the OSI model. Some switches can also forward data at the network layer (layer 3) by additionally incorporating routing functionality. Such switches are commonly known as layer-3 switches or multilayer switches.
subclass of: Network Node
alternative label: Bridging Hub
alternative label: MAC Bridge
alternative label: Network Switch
alternative label: Switching Hub

Symmetric Key
type: Class
comment: A symmetric key is a single key used for both encryption and decryption and used with a symmetric-key algorithm. Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext. The keys may be identical or there may be a simple transformation to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. This requirement that both parties have access to the secret key is one of the main drawbacks of symmetric key encryption, in comparison to public-key encrytption (also known as asymmetric key encryption).
subclass of: Cryptographic Key

System Init Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: A system initialization process is a process that executes to initialize (boot) an operating system.
subclass of: Operating System Process
alternative label: System Initialization Process
alternative label: System Startup Process

System Utilization Record
type: Class
comment: A system utilization record is a record for the tracking of resource utilization e.g. CPU, Disk, Network, Memory Bandwidth, GPU, or other resources for a given time period.
subclass of: Record

Junk Data
type: Class
type: NamedIndividual
attack-id: T1001.001
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Data Obfuscation

Steganography
type: Class
type: NamedIndividual
attack-id: T1001.002
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Data Obfuscation

Protocol Impersonation
type: Class
type: NamedIndividual
attack-id: T1001.003
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Data Obfuscation

LSASS Memory
type: Class
type: NamedIndividual
accesses: Authentication Service
accesses: Credential
accesses: Process
attack-id: T1003.001
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Process
subclass of: Restriction
  on property: accesses
  some values from: Authentication Service
subclass of: OS Credential Dumping

Security Account Manager
type: Class
type: NamedIndividual
accesses: Credential
attack-id: T1003.002
enables: Credential Access
may-access: Authentication Service
may-access: Process
may-access: System Password Database
subclass of: Restriction
  on property: may-access
  some values from: Process
subclass of: Restriction
  on property: may-access
  some values from: System Password Database
subclass of: Restriction
  on property: may-access
  some values from: Authentication Service
subclass of: OS Credential Dumping

NTDS
type: Class
type: NamedIndividual
accesses: Credential
accesses: Encrypted Credential
attack-id: T1003.003
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
subclass of: OS Credential Dumping

LSA Secrets
type: Class
type: NamedIndividual
accesses: Credential
attack-id: T1003.004
enables: Credential Access
may-access: Process
may-access: System Password Database
subclass of: Restriction
  on property: may-access
  some values from: Process
subclass of: Restriction
  on property: may-access
  some values from: System Password Database
subclass of: OS Credential Dumping

Cached Domain Credentials
type: Class
type: NamedIndividual
accesses: Credential
accesses: Encrypted Credential
attack-id: T1003.005
enables: Credential Access
may-modify: Log
subclass of: Restriction
  on property: may-modify
  some values from: Log
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
subclass of: OS Credential Dumping

DCSync
type: Class
type: NamedIndividual
accesses: Credential
attack-id: T1003.006
enables: Credential Access
may-modify: Event Log
produces: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: OS Credential Dumping

Proc Filesystem
type: Class
type: NamedIndividual
accesses: Credential
accesses: Operating System File
accesses: Process Image
attack-id: T1003.007
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Operating System File
subclass of: Restriction
  on property: accesses
  some values from: Process Image
subclass of: OS Credential Dumping

/etc/passwd and /etc/shadow
type: Class
type: NamedIndividual
accesses: Credential
accesses: Encrypted Credential
accesses: Password File
attack-id: T1003.008
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Password File
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
subclass of: OS Credential Dumping

Data from Local System
type: Class
type: NamedIndividual
accesses: Local Resource
attack-id: T1005
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Local Resource
subclass of: Collection Technique

Direct Volume Access
type: Class
type: NamedIndividual
accesses: Volume
attack-id: T1006
enables: Defense Evasion
subclass of: Restriction
  on property: accesses
  some values from: Volume
subclass of: Defense Evasion Technique

System Service Discovery
type: Class
type: NamedIndividual
attack-id: T1007
enables: Discovery
subclass of: Discovery Technique

Fallback Channels
type: Class
type: NamedIndividual
attack-id: T1008
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Application Window Discovery
type: Class
type: NamedIndividual
attack-id: T1010
enables: Discovery
subclass of: Discovery Technique

Exfiltration Over Other Network Medium
type: Class
type: NamedIndividual
attack-id: T1011
enables: Exfiltration
produces: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
subclass of: Exfiltration Technique

Query Registry
type: Class
type: NamedIndividual
attack-id: T1012
enables: Discovery
subclass of: Discovery Technique

Rootkit
type: Class
type: NamedIndividual
attack-id: T1014
enables: Defense Evasion
may-modify: Boot Sector
may-modify: Firmware
may-modify: Kernel
may-modify: Kernel Module
may-modify: Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Firmware
subclass of: Restriction
  on property: may-modify
  some values from: Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Kernel Module
subclass of: Restriction
  on property: may-modify
  some values from: Kernel
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Defense Evasion Technique

System Network Configuration Discovery
type: Class
type: NamedIndividual
attack-id: T1016
enables: Discovery
subclass of: Discovery Technique

Remote System Discovery
type: Class
type: NamedIndividual
attack-id: T1018
enables: Discovery
subclass of: Discovery Technique

Automated Exfiltration
type: Class
type: NamedIndividual
attack-id: T1020
enables: Exfiltration
produces: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
subclass of: Exfiltration Technique

Remote Desktop Protocol
type: Class
type: NamedIndividual
attack-id: T1021.001
creates: RDP Session
enables: Lateral Movement
produces: Administrative Network Traffic
produces: Intranet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Administrative Network Traffic
subclass of: Restriction
  on property: creates
  some values from: RDP Session
subclass of: Remote Services

SMB/Windows Admin Shares
type: Class
type: NamedIndividual
attack-id: T1021.002
enables: Lateral Movement
produces: Intranet Network Traffic
subclass of: Remote Services

Distributed Component Object Model
type: Class
type: NamedIndividual
attack-id: T1021.003
enables: Lateral Movement
produces: Intranet Network Traffic
subclass of: Remote Services

SSH
type: Class
type: NamedIndividual
attack-id: T1021.004
creates: SSH Session
enables: Lateral Movement
produces: Administrative Network Traffic
produces: Intranet Network Traffic
subclass of: Restriction
  on property: creates
  some values from: SSH Session
subclass of: Restriction
  on property: produces
  some values from: Administrative Network Traffic
subclass of: Remote Services

VNC
type: Class
type: NamedIndividual
attack-id: T1021.005
enables: Lateral Movement
produces: Intranet Network Traffic
subclass of: Remote Services

Windows Remote Management
type: Class
type: NamedIndividual
attack-id: T1021.006
enables: Lateral Movement
produces: Intranet Network Traffic
subclass of: Remote Services

Data from Removable Media
type: Class
type: NamedIndividual
accesses: Removable Media Device
attack-id: T1025
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Removable Media Device
subclass of: Collection Technique

Binary Padding
type: Class
type: NamedIndividual
attack-id: T1027.001
enables: Defense Evasion
modifies: Executable Binary
subclass of: Restriction
  on property: modifies
  some values from: Executable Binary
subclass of: Obfuscated Files or Information

Software Packing
type: Class
type: NamedIndividual
attack-id: T1027.002
enables: Defense Evasion
obfuscates: Executable File
subclass of: Restriction
  on property: obfuscates
  some values from: Executable File
subclass of: Obfuscated Files or Information

Compile After Delivery
type: Class
type: NamedIndividual
attack-id: T1027.004
creates: Executable File
enables: Defense Evasion
subclass of: Restriction
  on property: creates
  some values from: Executable File
subclass of: Obfuscated Files or Information

Indicator Removal from Tools
type: Class
type: NamedIndividual
attack-id: T1027.005
enables: Defense Evasion
subclass of: Defense Evasion Technique

Scheduled Transfer
type: Class
type: NamedIndividual
attack-id: T1029
enables: Exfiltration
produces: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
subclass of: Exfiltration Technique

Data Transfer Size Limits
type: Class
type: NamedIndividual
attack-id: T1030
enables: Exfiltration
produces: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
subclass of: Exfiltration Technique

System Owner/User Discovery
type: Class
type: NamedIndividual
attack-id: T1033
enables: Discovery
subclass of: Discovery Technique

Invalid Code Signature
type: Class
type: NamedIndividual
attack-id: T1036.001
creates: Executable Binary
enables: Defense Evasion
subclass of: Restriction
  on property: creates
  some values from: Executable Binary
subclass of: Masquerading

Right-to-Left Override
type: Class
type: NamedIndividual
attack-id: T1036.002
enables: Defense Evasion
modifies: File System Metadata
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
subclass of: Masquerading

Rename System Utilities
type: Class
type: NamedIndividual
attack-id: T1036.003
enables: Defense Evasion
may-create: Executable File
may-modify: Operating System Executable File
subclass of: Restriction
  on property: may-create
  some values from: Executable File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Executable File
subclass of: Masquerading

Masquerade Task or Service
type: Class
type: NamedIndividual
attack-id: T1036.004
enables: Defense Evasion
modifies: Task Schedule
subclass of: Restriction
  on property: modifies
  some values from: Task Schedule
subclass of: Masquerading

Match Legitimate Name or Location
type: Class
type: NamedIndividual
attack-id: T1036.005
enables: Defense Evasion
invokes: Move File
may-create: File
subclass of: Restriction
  on property: invokes
  some values from: Move File
subclass of: Restriction
  on property: may-create
  some values from: File
subclass of: Masquerading

Space after Filename
type: Class
type: NamedIndividual
attack-id: T1036.006
creates: File
enables: Defense Evasion
subclass of: Restriction
  on property: creates
  some values from: File
subclass of: Masquerading

Logon Script (Windows)
type: Class
type: NamedIndividual
attack-id: T1037.001
enables: Persistence
enables: Privilege Escalation
modifies: User Init Script
subclass of: Restriction
  on property: modifies
  some values from: User Init Script
subclass of: Boot or Logon Initialization Scripts

Logon Script (Mac)
type: Class
type: NamedIndividual
attack-id: T1037.002
enables: Persistence
enables: Privilege Escalation
modifies: User Init Script
subclass of: Restriction
  on property: modifies
  some values from: User Init Script
subclass of: Boot or Logon Initialization Scripts

Network Logon Script
type: Class
type: NamedIndividual
attack-id: T1037.003
enables: Persistence
enables: Privilege Escalation
modifies: Network Init Script File Resource
comment: Group Policy Object / Active Directory Users and Computers are both Active Directory-based
subclass of: Restriction
  on property: modifies
  some values from: Network Init Script File Resource
subclass of: Boot or Logon Initialization Scripts

Rc.common
type: Class
type: NamedIndividual
attack-id: T1037.004
enables: Persistence
enables: Privilege Escalation
modifies: System Init Script
subclass of: Restriction
  on property: modifies
  some values from: System Init Script
subclass of: Boot or Logon Initialization Scripts

Startup Items
type: Class
type: NamedIndividual
attack-id: T1037.005
enables: Persistence
enables: Privilege Escalation
modifies: System Startup Directory
subclass of: Restriction
  on property: modifies
  some values from: System Startup Directory
subclass of: Boot or Logon Initialization Scripts

Data from Network Shared Drive
type: Class
type: NamedIndividual
accesses: Network File Share Resource
attack-id: T1039
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Network File Share Resource
subclass of: Collection Technique

Network Sniffing
type: Class
type: NamedIndividual
attack-id: T1040
enables: Credential Access
enables: Discovery
may-produce: DNS Lookup
subclass of: Restriction
  on property: may-produce
  some values from: DNS Lookup
subclass of: Credential Access Technique
subclass of: Discovery Technique

Exfiltration Over C2 Channel
type: Class
type: NamedIndividual
attack-id: T1041
enables: Exfiltration
produces: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
subclass of: Exfiltration Technique

Network Service Scanning
type: Class
type: NamedIndividual
attack-id: T1046
enables: Discovery
subclass of: Discovery Technique

Windows Management Instrumentation Execution
type: Class
type: NamedIndividual
attack-id: T1047
enables: Execution
subclass of: Execution Technique

Exfiltration Over Symmetric Encrypted Non-C2 Protocol
type: Class
type: NamedIndividual
attack-id: T1048.001
enables: Exfiltration
produces: Internet Network Traffic
produces: Outbound Internet Encrypted Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Traffic
subclass of: Exfiltration Over Alternative Protocol

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
type: Class
type: NamedIndividual
attack-id: T1048.002
enables: Exfiltration
produces: Internet Network Traffic
produces: Outbound Internet Encrypted Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Traffic
subclass of: Exfiltration Over Alternative Protocol

Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
type: Class
type: NamedIndividual
attack-id: T1048.003
enables: Exfiltration
produces: Internet Network Traffic
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Exfiltration Over Alternative Protocol

System Network Connections Discovery
type: Class
type: NamedIndividual
attack-id: T1049
enables: Discovery
subclass of: Discovery Technique

Exfiltration over USB
type: Class
type: NamedIndividual
attack-id: T1052.001
enables: Exfiltration
modifies: Removable Media Device
subclass of: Restriction
  on property: modifies
  some values from: Removable Media Device
subclass of: Exfiltration Over Physical Medium

At (Linux) Execution
type: Class
type: NamedIndividual
attack-id: T1053.001
creates: Process
enables: Execution
enables: Persistence
enables: Privilege Escalation
invokes: Create Process
modifies: Task Schedule
subclass of: Scheduled Task/Job Execution

At (Windows) Execution
type: Class
type: NamedIndividual
attack-id: T1053.002
creates: Process
enables: Execution
enables: Persistence
enables: Privilege Escalation
invokes: Create Process
modifies: Task Schedule
subclass of: Scheduled Task/Job Execution

Cron Execution
type: Class
type: NamedIndividual
attack-id: T1053.003
creates: Process
enables: Execution
enables: Persistence
enables: Privilege Escalation
invokes: Create Process
modifies: Task Schedule
subclass of: Scheduled Task/Job Execution

Launchd
type: Class
type: NamedIndividual
attack-id: T1053.004
creates: Process
creates: Property List File
enables: Execution
enables: Persistence
enables: Privilege Escalation
invokes: Create Process
modifies: Task Schedule
subclass of: Restriction
  on property: creates
  some values from: Property List File
subclass of: Scheduled Task/Job Execution

Schtasks Execution
type: Class
type: NamedIndividual
attack-id: T1053.005
creates: Process
enables: Execution
enables: Persistence
enables: Privilege Escalation
invokes: Create Process
modifies: Task Schedule
comment: Renamed from ATT&CK to be consistent with at, launchd, cron siblings; name as is looks like parent. Not sure why parent is not just Scheduled Task [Execution[.
subclass of: Scheduled Task/Job Execution

Dynamic-link Library Injection
type: Class
type: NamedIndividual
adds: Shared Library File
attack-id: T1055.001
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
loads: Shared Library File
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Restriction
  on property: adds
  some values from: Shared Library File
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
subclass of: Process Injection

Portable Executable Injection
type: Class
type: NamedIndividual
attack-id: T1055.002
enables: Defense Evasion
enables: Privilege Escalation
may-add: Object File
subclass of: Restriction
  on property: may-add
  some values from: Object File
subclass of: Process Injection

Thread Execution Hijacking
type: Class
type: NamedIndividual
attack-id: T1055.003
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
may-add: Executable Binary
subclass of: Restriction
  on property: may-add
  some values from: Executable Binary
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Process Injection

Asynchronous Procedure Call
type: Class
type: NamedIndividual
attack-id: T1055.004
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
may-create: Process
subclass of: Restriction
  on property: may-create
  some values from: Process
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Process Injection

Thread Local Storage
type: Class
type: NamedIndividual
attack-id: T1055.005
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Process Injection

Ptrace System Calls
type: Class
type: NamedIndividual
attack-id: T1055.008
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Process Injection

Proc Memory
type: Class
type: NamedIndividual
accesses: Operating System File
attack-id: T1055.009
enables: Defense Evasion
enables: Privilege Escalation
may-modify: Operating System File
subclass of: Restriction
  on property: accesses
  some values from: Operating System File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System File
subclass of: Process Injection

Extra Window Memory Injection
type: Class
type: NamedIndividual
attack-id: T1055.011
enables: Defense Evasion
enables: Privilege Escalation
subclass of: Process Injection

Process Hollowing
type: Class
type: NamedIndividual
attack-id: T1055.012
enables: Defense Evasion
enables: Privilege Escalation
modifies: Process Code Segment
subclass of: Restriction
  on property: modifies
  some values from: Process Code Segment
subclass of: Restriction
  on property: enables
  some values from: Defense Evasion
subclass of: Process Injection

Process Doppelgänging
type: Class
type: NamedIndividual
attack-id: T1055.013
creates: Process
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Process Injection

VDSO Hijacking
type: Class
type: NamedIndividual
accesses: Shared Library File
attack-id: T1055.014
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Restriction
  on property: accesses
  some values from: Shared Library File
subclass of: Process Injection

Keylogging
type: Class
type: NamedIndividual
accesses: Digital Artifact
accesses: Keyboard Input Device
attack-id: T1056.001
enables: Collection
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Keyboard Input Device
subclass of: Input Capture

GUI Input Capture
type: Class
type: NamedIndividual
accesses: Digital Artifact
accesses: Graphical User Interface
attack-id: T1056.002
enables: Collection
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Graphical User Interface
subclass of: Input Capture

Web Portal Capture
type: Class
type: NamedIndividual
accesses: Digital Artifact
attack-id: T1056.003
enables: Collection
enables: Credential Access
modifies: Web Server Application
subclass of: Restriction
  on property: modifies
  some values from: Web Server Application
subclass of: Input Capture

Credential API Hooking
type: Class
type: NamedIndividual
accesses: Digital Artifact
attack-id: T1056.004
enables: Collection
enables: Credential Access
may-modify: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Input Capture

Process Discovery
type: Class
type: NamedIndividual
attack-id: T1057
enables: Discovery
subclass of: Discovery Technique

PowerShell Execution
type: Class
type: NamedIndividual
attack-id: T1059.001
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

AppleScript Execution
type: Class
type: NamedIndividual
attack-id: T1059.002
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

Windows Command Shell Execution
type: Class
type: NamedIndividual
attack-id: T1059.003
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

Unix Shell Execution
type: Class
type: NamedIndividual
attack-id: T1059.004
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution
alternative label: Bash Execution

VBScript Execution
type: Class
type: NamedIndividual
attack-id: T1059.005
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

Python Execution
type: Class
type: NamedIndividual
attack-id: T1059.006
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

JavaScript/JScript
type: Class
type: NamedIndividual
attack-id: T1059.007
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

Network Device CLI
type: Class
type: NamedIndividual
attack-id: T1059.008
enables: Execution
executes: Executable Script
subclass of: Command and Scripting Interpreter Execution

Exploitation for Privilege Escalation
type: Class
type: NamedIndividual
attack-id: T1068
enables: Privilege Escalation
may-modify: Stack Frame
modifies: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
subclass of: Restriction
  on property: modifies
  some values from: Process Code Segment
subclass of: Restriction
  on property: enables
  some values from: Privilege Escalation
subclass of: Privilege Escalation Technique

Permission Groups Discovery
type: Class
type: NamedIndividual
attack-id: T1069
enables: Discovery
subclass of: Discovery Technique

Clear Windows Event Logs
type: Class
type: NamedIndividual
attack-id: T1070.001
enables: Defense Evasion
modifies: Event Log
subclass of: Restriction
  on property: modifies
  some values from: Event Log
subclass of: Indicator Removal on Host

Clear Linux or Mac System Logs
type: Class
type: NamedIndividual
attack-id: T1070.002
enables: Defense Evasion
modifies: Operating System Log File
subclass of: Restriction
  on property: modifies
  some values from: Operating System Log File
subclass of: Indicator Removal on Host

Clear Command History
type: Class
type: NamedIndividual
attack-id: T1070.003
enables: Defense Evasion
modifies: Command History Log
subclass of: Restriction
  on property: modifies
  some values from: Command History Log
subclass of: Indicator Removal on Host

File Deletion
type: Class
type: NamedIndividual
attack-id: T1070.004
deletes: File
enables: Defense Evasion
may-modify: File
subclass of: Restriction
  on property: may-modify
  some values from: File
subclass of: Restriction
  on property: deletes
  some values from: File
subclass of: Indicator Removal on Host

Network Share Connection Removal
type: Class
type: NamedIndividual
attack-id: T1070.005
enables: Defense Evasion
unmounts: Network File Share Resource
subclass of: Restriction
  on property: unmounts
  some values from: Network File Share Resource
subclass of: Indicator Removal on Host

Timestomp
type: Class
type: NamedIndividual
attack-id: T1070.006
enables: Defense Evasion
forges: File System Metadata
subclass of: Restriction
  on property: forges
  some values from: File System Metadata
subclass of: Indicator Removal on Host

Web Protocols
type: Class
type: NamedIndividual
attack-id: T1071.001
enables: Command And Control
produces: Outbound Internet Network Traffic
produces: Outbound Internet Web Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
subclass of: Application Layer Protocol

File Transfer Protocols
type: Class
type: NamedIndividual
attack-id: T1071.002
enables: Command And Control
produces: Outbound Internet File Transfer Traffic
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet File Transfer Traffic
subclass of: Application Layer Protocol

Mail Protocols
type: Class
type: NamedIndividual
attack-id: T1071.003
enables: Command And Control
produces: Outbound Internet Mail Traffic
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Mail Traffic
subclass of: Application Layer Protocol

DNS
type: Class
type: NamedIndividual
attack-id: T1071.004
enables: Command And Control
produces: Outbound Internet DNS Lookup Traffic
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: Application Layer Protocol

Software Deployment Tools Execution
type: Class
type: NamedIndividual
adds: File
attack-id: T1072
enables: Execution
enables: Lateral Movement
executes: Software Deployment Tool
installs: Software
subclass of: Restriction
  on property: adds
  some values from: File
subclass of: Restriction
  on property: installs
  some values from: Software
subclass of: Restriction
  on property: executes
  some values from: Software Deployment Tool
subclass of: Execution Technique
subclass of: Lateral Movement Technique

Local Data Staging
type: Class
type: NamedIndividual
attack-id: T1074.001
enables: Collection
modifies: Local Resource
reads: Resource
subclass of: Restriction
  on property: modifies
  some values from: Local Resource
subclass of: Data Staged

Remote Data Staging
type: Class
type: NamedIndividual
attack-id: T1074.002
enables: Collection
modifies: Network Resource
reads: Resource
subclass of: Restriction
  on property: modifies
  some values from: Network Resource
subclass of: Data Staged

Default Accounts
type: Class
type: NamedIndividual
attack-id: T1078.001
enables: Defense Evasion
enables: Initial Access
enables: Persistence
enables: Privilege Escalation
produces: Authentication
produces: Authorization
uses: Default User Account
uses: User Account
subclass of: Restriction
  on property: uses
  some values from: Default User Account
subclass of: Valid Accounts

Domain Accounts
type: Class
type: NamedIndividual
attack-id: T1078.002
enables: Defense Evasion
enables: Initial Access
enables: Persistence
enables: Privilege Escalation
produces: Authentication
produces: Authorization
uses: Domain User Account
uses: User Account
subclass of: Restriction
  on property: uses
  some values from: Domain User Account
subclass of: Valid Accounts

Local Accounts
type: Class
type: NamedIndividual
attack-id: T1078.003
enables: Defense Evasion
enables: Initial Access
enables: Persistence
enables: Privilege Escalation
produces: Authentication
produces: Authorization
uses: Local User Account
uses: User Account
subclass of: Restriction
  on property: uses
  some values from: Local User Account
subclass of: Valid Accounts

Cloud Accounts
type: Class
type: NamedIndividual
attack-id: T1078.004
enables: Defense Evasion
enables: Initial Access
enables: Persistence
enables: Privilege Escalation
produces: Authentication
produces: Authorization
uses: Cloud User Account
uses: User Account
subclass of: Restriction
  on property: uses
  some values from: Cloud User Account
subclass of: Valid Accounts

Taint Shared Content
type: Class
type: NamedIndividual
attack-id: T1080
enables: Lateral Movement
modifies: Network Resource
subclass of: Restriction
  on property: modifies
  some values from: Network Resource
subclass of: Lateral Movement Technique

System Information Discovery
type: Class
type: NamedIndividual
attack-id: T1082
enables: Discovery
subclass of: Discovery Technique

File and Directory Discovery
type: Class
type: NamedIndividual
attack-id: T1083
enables: Discovery
subclass of: Discovery Technique

Account Discovery
type: Class
type: NamedIndividual
attack-id: T1087
enables: Discovery
subclass of: Discovery Technique

Local Account
type: Class
type: NamedIndividual
attack-id: T1087.001
creates: Local User Account
creates: User Account
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Local User Account
subclass of: Create Account

Domain Account
type: Class
type: NamedIndividual
attack-id: T1087.002
creates: Domain User Account
creates: User Account
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Domain User Account
subclass of: Create Account

Cloud Account
type: Class
type: NamedIndividual
attack-id: T1087.004
creates: Cloud User Account
creates: User Account
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Cloud User Account
subclass of: Create Account

Internal Proxy
type: Class
type: NamedIndividual
attack-id: T1090.001
enables: Command And Control
produces: Intranet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
subclass of: Proxy

External Proxy
type: Class
type: NamedIndividual
attack-id: T1090.002
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Proxy

Multi-hop Proxy
type: Class
type: NamedIndividual
attack-id: T1090.003
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Proxy

Domain Fronting
type: Class
type: NamedIndividual
attack-id: T1090.004
enables: Command And Control
produces: Outbound Internet Encrypted Web Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Web Traffic
subclass of: Proxy

Replication Through Removable Media
type: Class
type: NamedIndividual
attack-id: T1091
enables: Initial Access
enables: Lateral Movement
executes: Removable Media Device
subclass of: Restriction
  on property: executes
  some values from: Removable Media Device
subclass of: Initial Access Technique
subclass of: Lateral Movement Technique

Communication Through Removable Media
type: Class
type: NamedIndividual
attack-id: T1092
enables: Command And Control
modifies: Removable Media Device
subclass of: Restriction
  on property: modifies
  some values from: Removable Media Device
subclass of: Command and Control Technique

Non-Application Layer Protocol
type: Class
type: NamedIndividual
attack-id: T1095
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Additional Azure Service Principal Credentials
type: Class
type: NamedIndividual
attack-id: T1098.001
creates: Credential
enables: Persistence
modifies: User Account
produces: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: creates
  some values from: Credential
subclass of: Account Manipulation

Exchange Email Delegate Permissions
type: Class
type: NamedIndividual
attack-id: T1098.002
enables: Persistence
modifies: Domain User Account
modifies: User Account
subclass of: Restriction
  on property: modifies
  some values from: Domain User Account
subclass of: Account Manipulation

Add Office 365 Global Administrator Role
type: Class
type: NamedIndividual
attack-id: T1098.003
enables: Persistence
modifies: Global User Account
modifies: User Account
subclass of: Restriction
  on property: modifies
  some values from: Global User Account
subclass of: Account Manipulation

SSH Authorized Keys
type: Class
type: NamedIndividual
attack-id: T1098.004
enables: Persistence
modifies: User Account
subclass of: Account Manipulation

Dead Drop Resolver
type: Class
type: NamedIndividual
attack-id: T1102.001
enables: Command And Control
produces: Outbound Internet Web Traffic
subclass of: Web Service

Bidirectional Communication
type: Class
type: NamedIndividual
attack-id: T1102.002
enables: Command And Control
produces: Outbound Internet Web Traffic
subclass of: Web Service

One-Way Communication
type: Class
type: NamedIndividual
attack-id: T1102.003
enables: Command And Control
produces: Outbound Internet Web Traffic
subclass of: Web Service

Multi-Stage Channels
type: Class
type: NamedIndividual
attack-id: T1104
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Ingress Tool Transfer
type: Class
type: NamedIndividual
attack-id: T1105
enables: Command And Control
produces: Outbound Internet Network Traffic
comment: Session is initiated by the client, and may be a custom protocol which is why it is related to generic network traffic instead of file transfer network traffic.
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Native API Execution
type: Class
type: NamedIndividual
attack-id: T1106
enables: Execution
invokes: System Call
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Execution Technique

Password Guessing
type: Class
type: NamedIndividual
attack-id: T1110.001
enables: Credential Access
modifies: Authentication Log
produces: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Brute Force

Password Cracking
type: Class
type: NamedIndividual
accesses: Encrypted Credential
attack-id: T1110.002
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Encrypted Credential
subclass of: Brute Force

Password Spraying
type: Class
type: NamedIndividual
attack-id: T1110.003
enables: Credential Access
may-create: Intranet Administrative Network Traffic
modifies: Authentication Log
produces: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Brute Force

Credential Stuffing
type: Class
type: NamedIndividual
attack-id: T1110.004
enables: Credential Access
may-create: Intranet Administrative Network Traffic
modifies: Authentication Log
produces: Authentication
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Brute Force

Two-Factor Authentication Interception
type: Class
type: NamedIndividual
attack-id: T1111
enables: Credential Access
may-access: Security Token
subclass of: Restriction
  on property: may-access
  some values from: Security Token
subclass of: Credential Access Technique

Modify Registry
type: Class
type: NamedIndividual
attack-id: T1112
enables: Defense Evasion
modifies: Windows Registry
subclass of: Restriction
  on property: modifies
  some values from: Windows Registry
subclass of: Defense Evasion Technique

Screen Capture
type: Class
type: NamedIndividual
accesses: Display Server
attack-id: T1113
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Display Server
subclass of: Collection Technique

Local Email Collection
type: Class
type: NamedIndividual
accesses: Email
accesses: Resource
attack-id: T1114.001
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Email
subclass of: Email Collection

Remote Email Collection
type: Class
type: NamedIndividual
accesses: Mail Server
accesses: Resource
attack-id: T1114.002
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Mail Server
subclass of: Email Collection

Email Forwarding Rule
type: Class
type: NamedIndividual
accesses: Resource
attack-id: T1114.003
enables: Collection
modifies: Application Configuration
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration
subclass of: Email Collection

Clipboard Data
type: Class
type: NamedIndividual
attack-id: T1115
enables: Collection
reads: Clipboard
subclass of: Restriction
  on property: reads
  some values from: Clipboard
subclass of: Collection Technique

Automated Collection
type: Class
type: NamedIndividual
accesses: File
attack-id: T1119
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Collection Technique

Peripheral Device Discovery
type: Class
type: NamedIndividual
attack-id: T1120
enables: Discovery
subclass of: Discovery Technique

Audio Capture
type: Class
type: NamedIndividual
accesses: Audio Input Device
attack-id: T1123
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Audio Input Device
subclass of: Collection Technique

System Time Discovery
type: Class
type: NamedIndividual
attack-id: T1124
enables: Discovery
subclass of: Discovery Technique

Video Capture
type: Class
type: NamedIndividual
accesses: Video Input Device
attack-id: T1125
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Video Input Device
subclass of: Collection Technique

MSBuild
type: Class
type: NamedIndividual
attack-id: T1127.001
enables: Defense Evasion
modifies: Compiler Configuration File
runs: Compiler
subclass of: Restriction
  on property: modifies
  some values from: Compiler Configuration File
subclass of: Restriction
  on property: runs
  some values from: Compiler
subclass of: Trusted Developer Utilities Proxy Execution

Shared Modules Execution
type: Class
type: NamedIndividual
attack-id: T1129
enables: Execution
subclass of: Execution Technique

Standard Encoding
type: Class
type: NamedIndividual
attack-id: T1132.001
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Data Encoding

Non-Standard Encoding
type: Class
type: NamedIndividual
attack-id: T1132.002
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Data Encoding

External Remote Services
type: Class
type: NamedIndividual
attack-id: T1133
enables: Initial Access
enables: Persistence
produces: Authentication
produces: Authorization
produces: Network Session
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: produces
  some values from: Network Session
subclass of: Restriction
  on property: produces
  some values from: Authorization
subclass of: Initial Access Technique
subclass of: Persistence Technique

Token Impersonation/Theft
type: Class
type: NamedIndividual
attack-id: T1134.001
copies: Access Token
enables: Defense Evasion
enables: Privilege Escalation
subclass of: Restriction
  on property: copies
  some values from: Access Token
subclass of: Access Token Manipulation

Create Process with Token
type: Class
type: NamedIndividual
attack-id: T1134.002
copies: Access Token
enables: Defense Evasion
enables: Privilege Escalation
may-modify: Event Log
subclass of: Restriction
  on property: copies
  some values from: Access Token
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: Access Token Manipulation

Make and Impersonate Token
type: Class
type: NamedIndividual
attack-id: T1134.003
copies: Access Token
creates: Login Session
enables: Defense Evasion
enables: Privilege Escalation
may-modify: Event Log
subclass of: Restriction
  on property: creates
  some values from: Login Session
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: Restriction
  on property: copies
  some values from: Access Token
subclass of: Access Token Manipulation

Parent PID Spoofing
type: Class
type: NamedIndividual
attack-id: T1134.004
enables: Defense Evasion
enables: Privilege Escalation
invokes: Create Process
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Access Token Manipulation

SID-History Injection
type: Class
type: NamedIndividual
attack-id: T1134.005
enables: Defense Evasion
enables: Privilege Escalation
modifies: Access Control Information
subclass of: Restriction
  on property: modifies
  some values from: Access Control Information
subclass of: Access Token Manipulation

Network Share Discovery
type: Class
type: NamedIndividual
attack-id: T1135
enables: Discovery
subclass of: Discovery Technique

Office Template Macros
type: Class
type: NamedIndividual
attack-id: T1137.001
enables: Persistence
may-add: Executable Script
may-modify: Executable Script
may-modify: System Configuration Database Record
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: may-add
  some values from: Executable Script
subclass of: Restriction
  on property: may-modify
  some values from: Executable Script
subclass of: Office Application Startup

Office Test
type: Class
type: NamedIndividual
attack-id: T1137.002
enables: Persistence
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Office Application Startup

Outlook Forms
type: Class
type: NamedIndividual
adds: Office Application File
attack-id: T1137.003
enables: Persistence
subclass of: Restriction
  on property: adds
  some values from: Office Application File
subclass of: Office Application Startup

Outlook Home Page
type: Class
type: NamedIndividual
attack-id: T1137.004
enables: Persistence
modifies: Application Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration Database
subclass of: Office Application Startup

Outlook Rules
type: Class
type: NamedIndividual
attack-id: T1137.005
enables: Persistence
modifies: Application Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration Database
subclass of: Office Application Startup

Add-ins
type: Class
type: NamedIndividual
adds: Software
attack-id: T1137.006
enables: Persistence
may-modify: System Configuration Database
modifies: Office Application
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: Office Application
subclass of: Restriction
  on property: adds
  some values from: Software
subclass of: Office Application Startup

Deobfuscate/Decode Files or Information
type: Class
type: NamedIndividual
attack-id: T1140
creates: Process
enables: Defense Evasion
may-add: Executable File
may-modify: Event Log
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: Restriction
  on property: may-add
  some values from: Executable File
subclass of: Defense Evasion Technique

Browser Extensions
type: Class
type: NamedIndividual
attack-id: T1176
enables: Persistence
modifies: Browser Extension
subclass of: Restriction
  on property: modifies
  some values from: Browser Extension
subclass of: Persistence Technique

Man in the Browser
type: Class
type: NamedIndividual
attack-id: T1185
enables: Collection
produces: Web Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Web Network Traffic
subclass of: Collection Technique

Forced Authentication
type: Class
type: NamedIndividual
attack-id: T1187
enables: Credential Access
may-modify: Windows Shortcut File
modifies: Authentication Log
produces: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: modifies
  some values from: Authentication Log
subclass of: Restriction
  on property: may-modify
  some values from: Windows Shortcut File
subclass of: Credential Access Technique

Drive-by Compromise
type: Class
type: NamedIndividual
attack-id: T1189
enables: Initial Access
modifies: Process Segment
produces: Outbound Internet Network Traffic
produces: URL
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: URL
subclass of: Restriction
  on property: modifies
  some values from: Process Segment
subclass of: Initial Access Technique

Exploit Public-Facing Application
type: Class
type: NamedIndividual
attack-id: T1190
enables: Initial Access
injects: Database Query
modifies: Process Segment
produces: Inbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Network Traffic
subclass of: Restriction
  on property: modifies
  some values from: Process Segment
subclass of: Restriction
  on property: injects
  some values from: Database Query
subclass of: Initial Access Technique

Compromise Software Dependencies and Development Tools
type: Class
type: NamedIndividual
attack-id: T1195.001
enables: Initial Access
modifies: Digital Artifact
modifies: Software
subclass of: Restriction
  on property: modifies
  some values from: Software
subclass of: Supply Chain Compromise

Compromise Software Supply Chain
type: Class
type: NamedIndividual
attack-id: T1195.002
enables: Initial Access
modifies: Digital Artifact
modifies: Software
subclass of: Restriction
  on property: modifies
  some values from: Software
subclass of: Supply Chain Compromise

Compromise Hardware Supply Chain
type: Class
type: NamedIndividual
attack-id: T1195.003
enables: Initial Access
modifies: Digital Artifact
modifies: Hardware Device
subclass of: Restriction
  on property: modifies
  some values from: Hardware Device
subclass of: Supply Chain Compromise

BITS Jobs
type: Class
type: NamedIndividual
attack-id: T1197
enables: Defense Evasion
enables: Persistence
may-produce: Intranet IPC Network Traffic
may-produce: Intranet Web Network Traffic
may-produce: Outbound Internet Web Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Intranet Web Network Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Outbound Internet Web Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Intranet IPC Network Traffic
subclass of: Defense Evasion Technique
subclass of: Persistence Technique

Trusted Relationship
type: Class
type: NamedIndividual
attack-id: T1199
creates: Login Session
enables: Initial Access
produces: Intranet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
subclass of: Restriction
  on property: creates
  some values from: Login Session
subclass of: Initial Access Technique

Hardware Additions
type: Class
type: NamedIndividual
attack-id: T1200
connects: Hardware Device
enables: Initial Access
subclass of: Restriction
  on property: connects
  some values from: Hardware Device
subclass of: Initial Access Technique

Password Policy Discovery
type: Class
type: NamedIndividual
attack-id: T1201
enables: Discovery
subclass of: Discovery Technique

Indirect Command Execution
type: Class
type: NamedIndividual
attack-id: T1202
enables: Defense Evasion
subclass of: Defense Evasion Technique

Exploitation for Client Execution
type: Class
type: NamedIndividual
attack-id: T1203
enables: Execution
modifies: Process Code Segment
modifies: Stack Frame
subclass of: Restriction
  on property: modifies
  some values from: Stack Frame
subclass of: Restriction
  on property: modifies
  some values from: Process Code Segment
subclass of: Execution Technique

Malicious Link Execution
type: Class
type: NamedIndividual
accesses: URL
attack-id: T1204.001
enables: Execution
produces: Outbound Internet Web Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
subclass of: Restriction
  on property: accesses
  some values from: URL
subclass of: User Execution

Malicious File Execution
type: Class
type: NamedIndividual
attack-id: T1204.002
enables: Execution
executes: Executable File
subclass of: Restriction
  on property: executes
  some values from: Executable File
subclass of: User Execution

Port Knocking
type: Class
type: NamedIndividual
attack-id: T1205.001
enables: Command And Control
enables: Defense Evasion
enables: Persistence
produces: Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
subclass of: Traffic Signaling

Rogue Domain Controller
type: Class
type: NamedIndividual
attack-id: T1207
enables: Defense Evasion
modifies: System Configuration Database
produces: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
subclass of: Defense Evasion Technique

Exploitation of Remote Services
type: Class
type: NamedIndividual
attack-id: T1210
enables: Lateral Movement
may-modify: Process Code Segment
may-modify: Process Segment
may-modify: Stack Frame
produces: Intranet Network Traffic
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Process Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
subclass of: Lateral Movement Technique

Exploitation for Defense Evasion
type: Class
type: NamedIndividual
attack-id: T1211
enables: Defense Evasion
may-modify: Process Code Segment
may-modify: Stack Frame
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
subclass of: Defense Evasion Technique

Exploitation for Credential Access
type: Class
type: NamedIndividual
attack-id: T1212
enables: Credential Access
may-access: Authentication Service
may-access: Credential Management System
may-modify: Process Code Segment
may-modify: Stack Frame
subclass of: Restriction
  on property: may-access
  some values from: Authentication Service
subclass of: Restriction
  on property: may-modify
  some values from: Process Code Segment
subclass of: Restriction
  on property: may-modify
  some values from: Stack Frame
subclass of: Restriction
  on property: may-access
  some values from: Credential Management System
subclass of: Credential Access Technique

Confluence
type: Class
type: NamedIndividual
accesses: Resource
accesses: Web File Resource
attack-id: T1213.001
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Web File Resource
subclass of: Data from Information Repositories

Sharepoint
type: Class
type: NamedIndividual
accesses: Resource
accesses: Web File Resource
attack-id: T1213.002
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Web File Resource
subclass of: Data from Information Repositories

PubPrn Execution
type: Class
type: NamedIndividual
attack-id: T1216.001
enables: Defense Evasion
enables: Execution
subclass of: Signed Script Proxy Execution

Browser Bookmark Discovery
type: Class
type: NamedIndividual
attack-id: T1217
enables: Discovery
subclass of: Discovery Technique

Compiled HTML File Execution
type: Class
type: NamedIndividual
attack-id: T1218.001
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Control Panel Execution
type: Class
type: NamedIndividual
attack-id: T1218.002
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

CMSTP Execution
type: Class
type: NamedIndividual
attack-id: T1218.003
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

InstallUtil Execution
type: Class
type: NamedIndividual
attack-id: T1218.004
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Mshta Execution
type: Class
type: NamedIndividual
attack-id: T1218.005
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Msiexec Execution
type: Class
type: NamedIndividual
attack-id: T1218.007
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Odbcconf Execution
type: Class
type: NamedIndividual
attack-id: T1218.008
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Regsvcs/Regasm Execution
type: Class
type: NamedIndividual
attack-id: T1218.009
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Regsvr32 Execution
type: Class
type: NamedIndividual
attack-id: T1218.010
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Rundll32 Execution
type: Class
type: NamedIndividual
attack-id: T1218.011
enables: Defense Evasion
enables: Execution
subclass of: Signed Binary Proxy Execution

Remote Access Software
type: Class
type: NamedIndividual
attack-id: T1219
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

XSL Script Processing
type: Class
type: NamedIndividual
attack-id: T1220
enables: Defense Evasion
subclass of: Defense Evasion Technique

Template Injection
type: Class
type: NamedIndividual
attack-id: T1221
enables: Defense Evasion
subclass of: Defense Evasion Technique

Windows File and Directory Permissions Modification
type: Class
type: NamedIndividual
attack-id: T1222.001
enables: Defense Evasion
modifies: Access Control Information
subclass of: File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification
type: Class
type: NamedIndividual
attack-id: T1222.002
enables: Defense Evasion
modifies: Access Control Information
subclass of: File and Directory Permissions Modification

Environmental Keying
type: Class
type: NamedIndividual
attack-id: T1480.001
enables: Defense Evasion
subclass of: Execution Guardrails

Domain Trust Discovery
type: Class
type: NamedIndividual
attack-id: T1482
enables: Discovery
subclass of: Discovery Technique

Group Policy Modification
type: Class
type: NamedIndividual
attack-id: T1484
enables: Defense Evasion
enables: Privilege Escalation
modifies: Group Policy
subclass of: Restriction
  on property: modifies
  some values from: Group Policy
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique

Data Destruction
type: Class
type: NamedIndividual
attack-id: T1485
enables: Impact
subclass of: Impact Technique

Data Encrypted for Impact
type: Class
type: NamedIndividual
attack-id: T1486
enables: Impact
subclass of: Impact Technique

Service Stop
type: Class
type: NamedIndividual
attack-id: T1489
enables: Impact
subclass of: Impact Technique

Inhibit System Recovery
type: Class
type: NamedIndividual
attack-id: T1490
enables: Impact
subclass of: Impact Technique

Internal Defacement
type: Class
type: NamedIndividual
attack-id: T1491.001
enables: Impact
modifies: Resource
subclass of: Restriction
  on property: modifies
  some values from: Resource
subclass of: Defacement

External Defacement
type: Class
type: NamedIndividual
attack-id: T1491.002
enables: Impact
modifies: Network Resource
subclass of: Restriction
  on property: modifies
  some values from: Network Resource
subclass of: Defacement

Firmware Corruption
type: Class
type: NamedIndividual
attack-id: T1495
enables: Impact
subclass of: Impact Technique

Resource Hijacking
type: Class
type: NamedIndividual
attack-id: T1496
enables: Impact
subclass of: Impact Technique

Time Based Evasion
type: Class
type: NamedIndividual
attack-id: T1497.003
enables: Defense Evasion
may-invoke: Get System Time
may-run: System Time Application
subclass of: Restriction
  on property: may-run
  some values from: System Time Application
subclass of: Restriction
  on property: may-invoke
  some values from: Get System Time
subclass of: Virtualization/Sandbox Evasion

Direct Network Flood
type: Class
type: NamedIndividual
attack-id: T1498.001
creates: Inbound Internet Network Traffic
enables: Impact
subclass of: Restriction
  on property: creates
  some values from: Inbound Internet Network Traffic
subclass of: Network Denial of Service

Reflection Amplification
type: Class
type: NamedIndividual
attack-id: T1498.002
enables: Impact
produces: Inbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Network Traffic
subclass of: Network Denial of Service

Endpoint Denial of Service
type: Class
type: NamedIndividual
attack-id: T1499
enables: Impact
subclass of: Impact Technique

Service Exhaustion Flood
type: Class
type: NamedIndividual
attack-id: T1499.002
enables: Impact
produces: Inbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Network Traffic
subclass of: Network Denial of Service

SQL Stored Procedures
type: Class
type: NamedIndividual
attack-id: T1505.001
creates: Process
creates: Stored Procedure
enables: Persistence
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Restriction
  on property: creates
  some values from: Stored Procedure
subclass of: Server Software Component

Transport Agent
type: Class
type: NamedIndividual
adds: Message Transfer Agent
attack-id: T1505.002
enables: Persistence
modifies: Mail Server
subclass of: Restriction
  on property: modifies
  some values from: Mail Server
subclass of: Restriction
  on property: adds
  some values from: Message Transfer Agent
subclass of: Server Software Component

Web Shell
type: Class
type: NamedIndividual
adds: Web Script File
attack-id: T1505.003
enables: Persistence
modifies: Web Server
produces: Process
subclass of: Restriction
  on property: modifies
  some values from: Web Server
subclass of: Restriction
  on property: adds
  some values from: Web Script File
subclass of: Restriction
  on property: produces
  some values from: Process
subclass of: Server Software Component

Security Software Discovery
type: Class
type: NamedIndividual
attack-id: T1518.001
enables: Discovery
may-access: File System Metadata
may-access: Kernel Process Table
may-access: System Configuration Database Record
may-access: System Firewall Configuration
subclass of: Restriction
  on property: may-access
  some values from: File System Metadata
subclass of: Restriction
  on property: may-access
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: may-access
  some values from: Kernel Process Table
subclass of: Restriction
  on property: may-access
  some values from: System Firewall Configuration
subclass of: Software Discovery

Implant Container Image
type: Class
type: NamedIndividual
adds: Container Image
attack-id: T1525
enables: Persistence
subclass of: Restriction
  on property: adds
  some values from: Container Image
subclass of: Persistence Technique

Cloud Service Discovery
type: Class
type: NamedIndividual
attack-id: T1526
enables: Discovery
reads: Cloud Configuration Information
subclass of: Restriction
  on property: reads
  some values from: Cloud Configuration Information
subclass of: Discovery Technique

Steal Application Access Token
type: Class
type: NamedIndividual
accesses: Access Token
attack-id: T1528
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Access Token
subclass of: Credential Access Technique

System Shutdown/Reboot
type: Class
type: NamedIndividual
attack-id: T1529
enables: Impact
subclass of: Impact Technique

Data from Cloud Storage Object
type: Class
type: NamedIndividual
attack-id: T1530
enables: Collection
subclass of: Collection Technique

Account Access Removal
type: Class
type: NamedIndividual
attack-id: T1531
enables: Impact
subclass of: Impact Technique

Internal Spearphishing
type: Class
type: NamedIndividual
attack-id: T1534
enables: Lateral Movement
produces: Email
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: Lateral Movement Technique

Unused/Unsupported Cloud Regions
type: Class
type: NamedIndividual
attack-id: T1535
enables: Defense Evasion
subclass of: Defense Evasion Technique

Cloud Service Dashboard
type: Class
type: NamedIndividual
accesses: Cloud Configuration Information
attack-id: T1538
enables: Discovery
subclass of: Restriction
  on property: accesses
  some values from: Cloud Configuration Information
subclass of: Discovery Technique

Steal Web Session Cookie
type: Class
type: NamedIndividual
accesses: Session Cookie
attack-id: T1539
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Session Cookie
subclass of: Credential Access Technique

System Firmware
type: Class
type: NamedIndividual
attack-id: T1542.001
enables: Defense Evasion
enables: Persistence
modifies: System Firmware
subclass of: Restriction
  on property: modifies
  some values from: System Firmware
subclass of: Pre-OS Boot

Component Firmware
type: Class
type: NamedIndividual
attack-id: T1542.002
enables: Defense Evasion
enables: Persistence
modifies: Firmware
subclass of: Restriction
  on property: modifies
  some values from: Firmware
subclass of: Pre-OS Boot

Bootkit
type: Class
type: NamedIndividual
attack-id: T1542.003
enables: Defense Evasion
enables: Persistence
may-modify: Boot Loader
may-modify: Boot Sector
may-modify: Volume Boot Record
subclass of: Restriction
  on property: may-modify
  some values from: Volume Boot Record
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Restriction
  on property: may-modify
  some values from: Boot Loader
subclass of: Pre-OS Boot

Launch Agent
type: Class
type: NamedIndividual
attack-id: T1543.001
creates: Property List File
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Property List File
subclass of: Create or Modify System Process

Systemd Service
type: Class
type: NamedIndividual
attack-id: T1543.002
enables: Persistence
enables: Privilege Escalation
may-create: Operating System Configuration File
may-modify: Operating System Configuration File
subclass of: Restriction
  on property: may-create
  some values from: Operating System Configuration File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Configuration File
subclass of: Create or Modify System Process

Windows Service
type: Class
type: NamedIndividual
attack-id: T1543.003
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
subclass of: Create or Modify System Process

Launch Daemon
type: Class
type: NamedIndividual
attack-id: T1543.004
enables: Persistence
enables: Privilege Escalation
modifies: Property List File
subclass of: Restriction
  on property: modifies
  some values from: Property List File
subclass of: Create or Modify System Process

Change Default File Association
type: Class
type: NamedIndividual
attack-id: T1546.001
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Event Triggered Execution

Screensaver
type: Class
type: NamedIndividual
attack-id: T1546.002
creates: Executable File
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: creates
  some values from: Executable File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Event Triggered Execution

Windows Management Instrumentation Event Subscription
type: Class
type: NamedIndividual
attack-id: T1546.003
enables: Persistence
enables: Privilege Escalation
modifies: Event Log
produces: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Administrative Network Traffic
subclass of: Restriction
  on property: modifies
  some values from: Event Log
subclass of: Event Triggered Execution

.bash_profile and .bashrc
type: Class
type: NamedIndividual
attack-id: T1546.004
enables: Persistence
enables: Privilege Escalation
modifies: User Init Configuration File
subclass of: Restriction
  on property: modifies
  some values from: User Init Configuration File
subclass of: Event Triggered Execution

Trap
type: Class
type: NamedIndividual
attack-id: T1546.005
enables: Persistence
enables: Privilege Escalation
may-create: Executable Script
may-modify: Executable Script
modifies: Event Log
produces: Command
subclass of: Restriction
  on property: produces
  some values from: Command
subclass of: Restriction
  on property: may-create
  some values from: Executable Script
subclass of: Restriction
  on property: modifies
  some values from: Event Log
subclass of: Restriction
  on property: may-modify
  some values from: Executable Script
subclass of: Event Triggered Execution

LC_LOAD_DYLIB Addition
type: Class
type: NamedIndividual
attack-id: T1546.006
enables: Persistence
enables: Privilege Escalation
modifies: Executable Binary
subclass of: Restriction
  on property: modifies
  some values from: Executable Binary
subclass of: Event Triggered Execution

Netsh Helper DLL
type: Class
type: NamedIndividual
attack-id: T1546.007
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
produces: Process
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: produces
  some values from: Process
subclass of: Event Triggered Execution

Accessibility Features
type: Class
type: NamedIndividual
attack-id: T1546.008
enables: Persistence
enables: Privilege Escalation
may-create: Intranet Administrative Network Traffic
may-modify: Executable Binary
may-modify: System Configuration Database Record
subclass of: Restriction
  on property: may-modify
  some values from: Executable Binary
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: may-create
  some values from: Intranet Administrative Network Traffic
subclass of: Event Triggered Execution

AppCert DLLs
type: Class
type: NamedIndividual
attack-id: T1546.009
creates: Process
enables: Persistence
enables: Privilege Escalation
loads: Shared Library File
modifies: System Configuration Database Record
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Event Triggered Execution

AppInit DLLs
type: Class
type: NamedIndividual
attack-id: T1546.010
creates: Process
enables: Persistence
enables: Privilege Escalation
loads: Shared Library File
modifies: System Configuration Database Record
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Restriction
  on property: loads
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Event Triggered Execution

Application Shimming
type: Class
type: NamedIndividual
attack-id: T1546.011
creates: Shim
enables: Persistence
enables: Privilege Escalation
modifies: Shim Database
subclass of: Restriction
  on property: modifies
  some values from: Shim Database
subclass of: Restriction
  on property: creates
  some values from: Shim
subclass of: Event Triggered Execution

Image File Execution Options Injection
type: Class
type: NamedIndividual
attack-id: T1546.012
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
subclass of: Event Triggered Execution

PowerShell Profile
type: Class
type: NamedIndividual
attack-id: T1546.013
enables: Persistence
enables: Privilege Escalation
modifies: PowerShell Profile Script
subclass of: Restriction
  on property: modifies
  some values from: PowerShell Profile Script
subclass of: Event Triggered Execution

Emond
type: Class
type: NamedIndividual
attack-id: T1546.014
enables: Persistence
enables: Privilege Escalation
may-create: Property List File
may-modify: Property List File
modifies: Configuration Information
subclass of: Restriction
  on property: may-modify
  some values from: Property List File
subclass of: Restriction
  on property: modifies
  some values from: Configuration Information
subclass of: Restriction
  on property: may-create
  some values from: Property List File
subclass of: Event Triggered Execution

Component Object Model Hijacking
type: Class
type: NamedIndividual
attack-id: T1546.015
enables: Persistence
enables: Privilege Escalation
loads: Executable Binary
modifies: System Configuration Database
subclass of: Restriction
  on property: loads
  some values from: Executable Binary
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database
subclass of: Event Triggered Execution

Registry Run Keys / Startup Folder
type: Class
type: NamedIndividual
attack-id: T1547.001
enables: Persistence
enables: Privilege Escalation
may-modify: System Configuration Init Database Record
may-modify: User Startup Script File
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Init Database Record
subclass of: Restriction
  on property: may-modify
  some values from: User Startup Script File
subclass of: Boot or Logon Autostart Execution

Authentication Package
type: Class
type: NamedIndividual
attack-id: T1547.002
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Boot or Logon Autostart Execution

Time Providers
type: Class
type: NamedIndividual
attack-id: T1547.003
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Boot or Logon Autostart Execution

Winlogon Helper DLL
type: Class
type: NamedIndividual
attack-id: T1547.004
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Boot or Logon Autostart Execution

Security Support Provider
type: Class
type: NamedIndividual
attack-id: T1547.005
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Boot or Logon Autostart Execution

Kernel Modules and Extensions
type: Class
type: NamedIndividual
attack-id: T1547.006
enables: Persistence
enables: Privilege Escalation
modifies: Kernel Module
subclass of: Restriction
  on property: modifies
  some values from: Kernel Module
subclass of: Boot or Logon Autostart Execution

Re-opened Applications
type: Class
type: NamedIndividual
attack-id: T1547.007
enables: Persistence
enables: Privilege Escalation
modifies: Application Configuration File
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration File
subclass of: Boot or Logon Autostart Execution

LSASS Driver
type: Class
type: NamedIndividual
attack-id: T1547.008
enables: Persistence
enables: Privilege Escalation
may-create: Shared Library File
modifies: System Service Software
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Service Software
subclass of: Boot or Logon Autostart Execution

Shortcut Modification
type: Class
type: NamedIndividual
attack-id: T1547.009
enables: Persistence
enables: Privilege Escalation
modifies: User Startup Script File
subclass of: Restriction
  on property: modifies
  some values from: User Startup Script File
subclass of: Boot or Logon Autostart Execution

Port Monitors
type: Class
type: NamedIndividual
attack-id: T1547.010
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Boot or Logon Autostart Execution

Plist Modification
type: Class
type: NamedIndividual
attack-id: T1547.011
enables: Persistence
enables: Privilege Escalation
modifies: Application Configuration File
subclass of: Restriction
  on property: modifies
  some values from: Application Configuration File
subclass of: Boot or Logon Autostart Execution

Setuid and Setgid
type: Class
type: NamedIndividual
attack-id: T1548.001
enables: Defense Evasion
enables: Privilege Escalation
modifies: Access Control Information
subclass of: Restriction
  on property: modifies
  some values from: Access Control Information
subclass of: Abuse Elevation Control Mechanism

Bypass User Access Control
type: Class
type: NamedIndividual
attack-id: T1548.002
creates: Process
enables: Defense Evasion
enables: Privilege Escalation
executes: Executable File
may-modify: System Configuration Database Record
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Restriction
  on property: executes
  some values from: Executable File
subclass of: Abuse Elevation Control Mechanism

Sudo and Sudo Caching
type: Class
type: NamedIndividual
attack-id: T1548.003
enables: Defense Evasion
enables: Privilege Escalation
may-modify: Event Log
modifies: Operating System Configuration File
subclass of: Restriction
  on property: may-modify
  some values from: Event Log
subclass of: Restriction
  on property: modifies
  some values from: Operating System Configuration File
subclass of: Abuse Elevation Control Mechanism

Elevated Execution with Prompt
type: Class
type: NamedIndividual
attack-id: T1548.004
creates: System Configuration Database
enables: Defense Evasion
enables: Privilege Escalation
invokes: System Call
subclass of: Restriction
  on property: creates
  some values from: System Configuration Database
subclass of: Restriction
  on property: invokes
  some values from: System Call
subclass of: Abuse Elevation Control Mechanism

Application Access Token
type: Class
type: NamedIndividual
accesses: Authentication Service
attack-id: T1550.001
enables: Defense Evasion
enables: Lateral Movement
may-produce: Network Traffic
uses: Access Token
subclass of: Restriction
  on property: uses
  some values from: Access Token
subclass of: Restriction
  on property: may-produce
  some values from: Network Traffic
subclass of: Use Alternate Authentication Material

Pass The Hash
type: Class
type: NamedIndividual
accesses: Authentication Service
attack-id: T1550.002
creates: Authentication
enables: Defense Evasion
enables: Lateral Movement
subclass of: Restriction
  on property: creates
  some values from: Authentication
subclass of: Use Alternate Authentication Material

Pass The Ticket
type: Class
type: NamedIndividual
accesses: Authentication Service
attack-id: T1550.003
creates: Authentication
enables: Defense Evasion
enables: Lateral Movement
subclass of: Restriction
  on property: creates
  some values from: Authentication
subclass of: Use Alternate Authentication Material

Web Session Cookie
type: Class
type: NamedIndividual
accesses: Authentication Service
adds: Session Cookie
attack-id: T1550.004
enables: Defense Evasion
enables: Lateral Movement
produces: Web Network Traffic
subclass of: Restriction
  on property: adds
  some values from: Session Cookie
subclass of: Restriction
  on property: produces
  some values from: Web Network Traffic
subclass of: Use Alternate Authentication Material

Credentials in Files
type: Class
type: NamedIndividual
accesses: Credential
accesses: File
attack-id: T1552.001
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Unsecured Credentials

Credentials in Registry
type: Class
type: NamedIndividual
accesses: Credential
accesses: System Configuration Database
attack-id: T1552.002
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: System Configuration Database
subclass of: Unsecured Credentials

Bash History
type: Class
type: NamedIndividual
accesses: Credential
accesses: Event Log
attack-id: T1552.003
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Event Log
subclass of: Unsecured Credentials

Private Keys
type: Class
type: NamedIndividual
accesses: Credential
accesses: Private Key
attack-id: T1552.004
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Private Key
subclass of: Unsecured Credentials

Cloud Instance Metadata API
type: Class
type: NamedIndividual
accesses: Cloud Instance Metadata
accesses: Credential
attack-id: T1552.005
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Cloud Instance Metadata
subclass of: Unsecured Credentials

Group Policy Preferences
type: Class
type: NamedIndividual
accesses: Credential
accesses: Group Policy
attack-id: T1552.006
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Group Policy
subclass of: Unsecured Credentials

Gatekeeper Bypass
type: Class
type: NamedIndividual
attack-id: T1553.001
enables: Defense Evasion
modifies: File System Metadata
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
subclass of: Subvert Trust Controls

Code Signing
type: Class
type: NamedIndividual
attack-id: T1553.002
enables: Defense Evasion
subclass of: Restriction
  on property: enables
  some values from: Defense Evasion
subclass of: Subvert Trust Controls

SIP and Trust Provider Hijacking
type: Class
type: NamedIndividual
attack-id: T1553.003
enables: Defense Evasion
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Subvert Trust Controls

Install Root Certificate
type: Class
type: NamedIndividual
attack-id: T1553.004
enables: Defense Evasion
modifies: Certificate Trust Store
subclass of: Restriction
  on property: modifies
  some values from: Certificate Trust Store
subclass of: Subvert Trust Controls

Compromise Client Software Binary
type: Class
type: NamedIndividual
attack-id: T1554
enables: Persistence
modifies: Client Application
subclass of: Restriction
  on property: modifies
  some values from: Client Application
subclass of: Persistence Technique

Keychain
type: Class
type: NamedIndividual
accesses: MacOS Keychain
accesses: Password Store
attack-id: T1555.001
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: MacOS Keychain
subclass of: Credentials from Password Stores

Securityd Memory
type: Class
type: NamedIndividual
accesses: In-memory Password Store
accesses: Password Store
attack-id: T1555.002
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: In-memory Password Store
subclass of: Credentials from Password Stores

Credentials from Web Browsers
type: Class
type: NamedIndividual
accesses: Password Store
attack-id: T1555.003
enables: Credential Access
may-access: In-memory Password Store
subclass of: Restriction
  on property: may-access
  some values from: In-memory Password Store
subclass of: Credentials from Password Stores

Domain Controller Authentication
type: Class
type: NamedIndividual
attack-id: T1556.001
enables: Credential Access
enables: Defense Evasion
modifies: Authentication Service
subclass of: Modify Authentication Process

Password Filter DLL
type: Class
type: NamedIndividual
attack-id: T1556.002
creates: Shared Library File
enables: Credential Access
enables: Defense Evasion
modifies: Authentication Service
modifies: System Configuration Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Restriction
  on property: creates
  some values from: Shared Library File
subclass of: Modify Authentication Process

Pluggable Authentication Modules
type: Class
type: NamedIndividual
attack-id: T1556.003
enables: Credential Access
enables: Defense Evasion
may-modify: Operating System Configuration File
may-modify: Operating System Shared Library File
modifies: Authentication Service
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Configuration File
subclass of: Modify Authentication Process

Network Device Authentication
type: Class
type: NamedIndividual
attack-id: T1556.004
enables: Credential Access
enables: Defense Evasion
modifies: Authentication Service
subclass of: Modify Authentication Process

LLMNR/NBT-NS Poisoning and SMB Relay
type: Class
type: NamedIndividual
attack-id: T1557.001
enables: Collection
enables: Credential Access
produces: Intranet Multicast Network Traffic
produces: Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Multicast Network Traffic
subclass of: Man-in-the-Middle

Golden Ticket
type: Class
type: NamedIndividual
attack-id: T1558.001
enables: Credential Access
forges: Kerberos Ticket Granting Ticket
may-access: Kerberos TIcket
may-create: Kerberos TIcket
subclass of: Restriction
  on property: forges
  some values from: Kerberos Ticket Granting Ticket
subclass of: Steal or Forge Kerberos Tickets

Silver Ticket
type: Class
type: NamedIndividual
attack-id: T1558.002
enables: Credential Access
may-access: Kerberos TIcket
may-create: Kerberos TIcket
subclass of: Steal or Forge Kerberos Tickets

Kerberoasting
type: Class
type: NamedIndividual
attack-id: T1558.003
enables: Credential Access
may-access: Kerberos TIcket
may-create: Kerberos TIcket
may-produce: RPC Network Traffic
comment: Service Provider Name (SPN) scanning is one way to gather hashes, which results in RPC calls conforming to the NSPI protocol.
subclass of: Restriction
  on property: may-produce
  some values from: RPC Network Traffic
subclass of: Steal or Forge Kerberos Tickets

Component Object Model Execution
type: Class
type: NamedIndividual
attack-id: T1559.001
enables: Execution
injects: Interprocess Communication
subclass of: Inter-Process Communication Execution

Dynamic Data Exchange Execution
type: Class
type: NamedIndividual
attack-id: T1559.002
enables: Execution
injects: Interprocess Communication
subclass of: Inter-Process Communication Execution

Archive via Utility
type: Class
type: NamedIndividual
attack-id: T1560.001
creates: Archive File
enables: Collection
subclass of: Restriction
  on property: creates
  some values from: Archive File
subclass of: Archive Collected Data

Archive via Library
type: Class
type: NamedIndividual
attack-id: T1560.002
creates: Archive File
enables: Collection
subclass of: Restriction
  on property: creates
  some values from: Archive File
subclass of: Archive Collected Data

Archive via Custom Method
type: Class
type: NamedIndividual
attack-id: T1560.003
creates: Archive File
creates: Custom Archive File
enables: Collection
subclass of: Restriction
  on property: creates
  some values from: Custom Archive File
subclass of: Archive Collected Data

Disk Content Wipe
type: Class
type: NamedIndividual
attack-id: T1561.001
enables: Impact
may-modify: Boot Sector
may-modify: Partition
may-modify: Partition Table
may-modify: Volume
modifies: Block Device
subclass of: Restriction
  on property: may-modify
  some values from: Partition Table
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Restriction
  on property: may-modify
  some values from: Volume
subclass of: Restriction
  on property: modifies
  some values from: Block Device
subclass of: Restriction
  on property: may-modify
  some values from: Partition
subclass of: Disk Wipe

Disk Structure Wipe
type: Class
type: NamedIndividual
attack-id: T1561.002
enables: Impact
may-modify: Boot Sector
may-modify: Partition Table
subclass of: Restriction
  on property: may-modify
  some values from: Partition Table
subclass of: Restriction
  on property: may-modify
  some values from: Boot Sector
subclass of: Disk Wipe

Disable or Modify Tools
type: Class
type: NamedIndividual
attack-id: T1562.001
disables: Operating System Process
enables: Defense Evasion
subclass of: Restriction
  on property: disables
  some values from: Operating System Process
subclass of: Impair Defenses

Disable Windows Event Logging
type: Class
type: NamedIndividual
attack-id: T1562.002
enables: Defense Evasion
may-modify: Application Configuration
may-modify: Operating System Configuration Component
subclass of: Restriction
  on property: may-modify
  some values from: Operating System Configuration Component
subclass of: Restriction
  on property: may-modify
  some values from: Application Configuration
subclass of: Impair Defenses

Impair Command History Logging
type: Class
type: NamedIndividual
attack-id: T1562.003
enables: Defense Evasion
may-modify: User Init Script
may-modify: Windows Registry Key
modifies: Process Environment Variable
subclass of: Restriction
  on property: may-modify
  some values from: Windows Registry Key
subclass of: Restriction
  on property: modifies
  some values from: Process Environment Variable
subclass of: Restriction
  on property: may-modify
  some values from: User Init Script
subclass of: Impair Defenses

Disable or Modify System Firewall
type: Class
type: NamedIndividual
attack-id: T1562.004
enables: Defense Evasion
modifies: System Firewall Configuration
subclass of: Restriction
  on property: modifies
  some values from: System Firewall Configuration
subclass of: Impair Defenses

Indicator Blocking
type: Class
type: NamedIndividual
attack-id: T1562.006
enables: Defense Evasion
subclass of: Defense Evasion Technique

SSH Hijacking
type: Class
type: NamedIndividual
accesses: Remote Session
accesses: SSH Session
attack-id: T1563.001
enables: Lateral Movement
produces: Administrative Network Traffic
subclass of: Restriction
  on property: accesses
  some values from: SSH Session
subclass of: Remote Service Session Hijacking

RDP Hijacking
type: Class
type: NamedIndividual
accesses: RDP Session
accesses: Remote Session
attack-id: T1563.002
enables: Lateral Movement
produces: Administrative Network Traffic
subclass of: Restriction
  on property: accesses
  some values from: RDP Session
subclass of: Remote Service Session Hijacking

Hidden Files and Directories
type: Class
type: NamedIndividual
attack-id: T1564.001
enables: Defense Evasion
modifies: File System Metadata
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
subclass of: Hide Artifacts

Hidden Users
type: Class
type: NamedIndividual
attack-id: T1564.002
enables: Defense Evasion
modifies: User Init Configuration File
subclass of: Restriction
  on property: modifies
  some values from: User Init Configuration File
subclass of: Hide Artifacts

Hidden Window
type: Class
type: NamedIndividual
attack-id: T1564.003
enables: Defense Evasion
may-modify: Property List File
may-modify: System Configuration Database
subclass of: Restriction
  on property: may-modify
  some values from: Property List File
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
subclass of: Hide Artifacts

NTFS File Attributes
type: Class
type: NamedIndividual
attack-id: T1564.004
enables: Defense Evasion
modifies: File System Metadata
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
subclass of: Hide Artifacts

Hidden File System
type: Class
type: NamedIndividual
attack-id: T1564.005
enables: Defense Evasion
may-modify: System Configuration Database
modifies: Storage
subclass of: Restriction
  on property: modifies
  some values from: Storage
subclass of: Restriction
  on property: may-modify
  some values from: System Configuration Database
subclass of: Hide Artifacts

Run Virtual Instance
type: Class
type: NamedIndividual
attack-id: T1564.006
creates: File
enables: Defense Evasion
executes: Virtualization Software
may-add: Virtualization Software
may-create: Directory
subclass of: Restriction
  on property: executes
  some values from: Virtualization Software
subclass of: Restriction
  on property: may-add
  some values from: Virtualization Software
subclass of: Restriction
  on property: may-create
  some values from: Directory
subclass of: Restriction
  on property: creates
  some values from: File
subclass of: Hide Artifacts

Stored Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565.001
enables: Impact
modifies: File
subclass of: Restriction
  on property: modifies
  some values from: File
subclass of: Data Manipulation

Transmitted Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565.002
enables: Impact
may-modify: Network Traffic
subclass of: Restriction
  on property: may-modify
  some values from: Network Traffic
subclass of: Data Manipulation

Runtime Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565.003
enables: Impact
may-modify: Executable File
subclass of: Restriction
  on property: may-modify
  some values from: Executable File
subclass of: Data Manipulation

Spearphishing Attachment
type: Class
type: NamedIndividual
attack-id: T1566.001
enables: Initial Access
produces: Email
produces: Inbound Internet Mail Traffic
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Mail Traffic
subclass of: Phishing

Spearphishing Link
type: Class
type: NamedIndividual
attack-id: T1566.002
enables: Initial Access
produces: Email
produces: Inbound Internet Mail Traffic
produces: URL
subclass of: Restriction
  on property: produces
  some values from: URL
subclass of: Restriction
  on property: produces
  some values from: Inbound Internet Mail Traffic
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: Phishing

Spearphishing Via Service
type: Class
type: NamedIndividual
attack-id: T1566.003
enables: Initial Access
produces: File
produces: URL
subclass of: Restriction
  on property: produces
  some values from: File
subclass of: Restriction
  on property: produces
  some values from: URL
subclass of: Phishing

Exfiltration to Code Repository
type: Class
type: NamedIndividual
attack-id: T1567.001
enables: Exfiltration
may-produce: Outbound Internet Encrypted Remote Terminal Traffic
may-produce: Outbound Internet Encrypted Web Traffic
produces: Outbound Internet Web Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Outbound Internet Encrypted Web Traffic
subclass of: Restriction
  on property: may-produce
  some values from: Outbound Internet Encrypted Remote Terminal Traffic
subclass of: Exfiltration Over Web Service

Exfiltration to Cloud Storage
type: Class
type: NamedIndividual
attack-id: T1567.002
enables: Exfiltration
produces: Outbound Internet Encrypted Web Traffic
produces: Outbound Internet Web Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Web Traffic
subclass of: Exfiltration Over Web Service

Fast Flux DNS
type: Class
type: NamedIndividual
attack-id: T1568.001
enables: Command And Control
produces: Outbound Internet DNS Lookup Traffic
subclass of: Dynamic Resolution

Domain Generation Algorithms
type: Class
type: NamedIndividual
attack-id: T1568.002
enables: Command And Control
produces: Outbound Internet DNS Lookup Traffic
subclass of: Dynamic Resolution

DNS Calculation
type: Class
type: NamedIndividual
attack-id: T1568.003
enables: Command And Control
produces: Outbound Internet DNS Lookup Traffic
subclass of: Dynamic Resolution

LaunchCtl
type: Class
type: NamedIndividual
attack-id: T1569.001
enables: Execution
subclass of: System Services Execution

Service Execution
type: Class
type: NamedIndividual
attack-id: T1569.002
enables: Execution
comment: This sub-technique reads just like more detailed description of parent "System Services [Execution]" which enumerates malware as examples internally that reference a large set of sub-techniques (siblings to Launchctl, like PsExec, svchost.exe), rather than a distinct sub-technique itself. But PsExec is listed as software... which begs question why so many other items are not software then (at/cron... etc. etc.)
subclass of: System Services Execution

Lateral Tool Transfer
type: Class
type: NamedIndividual
attack-id: T1570
enables: Lateral Movement
produces: Intranet File Transfer Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet File Transfer Traffic
subclass of: Lateral Movement Technique

Non-Standard Port
type: Class
type: NamedIndividual
attack-id: T1571
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Protocol Tunneling
type: Class
type: NamedIndividual
attack-id: T1572
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Symmetric Cryptography
type: Class
type: NamedIndividual
attack-id: T1573.001
creates: Outbound Internet Encrypted Traffic
enables: Command And Control
produces: Outbound Internet Encrypted Traffic
subclass of: Restriction
  on property: creates
  some values from: Outbound Internet Encrypted Traffic
subclass of: Encrypted Channel

Asymmetric Cryptography
type: Class
type: NamedIndividual
attack-id: T1573.002
creates: Outbound Internet Encrypted Traffic
enables: Command And Control
produces: Outbound Internet Encrypted Traffic
subclass of: Restriction
  on property: creates
  some values from: Outbound Internet Encrypted Traffic
subclass of: Encrypted Channel

DLL Search Order Hijacking
type: Class
type: NamedIndividual
attack-id: T1574.001
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
may-create: Shared Library File
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Hijack Execution Flow

DLL Side-Loading
type: Class
type: NamedIndividual
attack-id: T1574.002
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
may-create: Shared Library File
may-modify: Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Shared Library File
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Hijack Execution Flow

Dylib Hijacking
type: Class
type: NamedIndividual
attack-id: T1574.004
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
may-create: Shared Library File
may-modify: Shared Library File
subclass of: Restriction
  on property: may-create
  some values from: Shared Library File
subclass of: Restriction
  on property: may-modify
  some values from: Shared Library File
subclass of: Hijack Execution Flow

Executable Installer File Permissions Weakness
type: Class
type: NamedIndividual
attack-id: T1574.005
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
modifies: Service Application
subclass of: Restriction
  on property: modifies
  some values from: Service Application
subclass of: Hijack Execution Flow

LD_PRELOAD
type: Class
type: NamedIndividual
attack-id: T1574.006
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
modifies: Operating System Configuration File
subclass of: Restriction
  on property: modifies
  some values from: Operating System Configuration File
subclass of: Hijack Execution Flow

Path Interception by PATH Environment Variable
type: Class
type: NamedIndividual
attack-id: T1574.007
creates: Executable File
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Executable File
subclass of: Hijack Execution Flow

Path Interception by Search Order Hijacking
type: Class
type: NamedIndividual
attack-id: T1574.008
creates: Executable File
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Executable File
subclass of: Hijack Execution Flow

Path Interception by Unquoted Path
type: Class
type: NamedIndividual
attack-id: T1574.009
creates: Executable File
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: Executable File
subclass of: Hijack Execution Flow

Services File Permissions Weakness
type: Class
type: NamedIndividual
attack-id: T1574.010
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
modifies: Service Application
subclass of: Restriction
  on property: modifies
  some values from: Service Application
subclass of: Hijack Execution Flow
alternative label: Service Registry Permissions Weakness

Services Registry Permissions Weakness
type: Class
type: NamedIndividual
attack-id: T1574.011
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Init Database Record
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Init Database Record
subclass of: Hijack Execution Flow

COR_PROFILER
type: Class
type: NamedIndividual
adds: Shared Library File
attack-id: T1574.012
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
modifies: System Configuration Database Record
subclass of: Restriction
  on property: adds
  some values from: Shared Library File
subclass of: Restriction
  on property: modifies
  some values from: System Configuration Database Record
subclass of: Hijack Execution Flow

Tablet Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A tablet computer, commonly shortened to tablet, is a mobile device, typically with a mobile operating system and touchscreen display processing circuitry, and a rechargeable battery in a single, thin and flat package. Tablets, being computers, do what other personal computers do, but lack some input/output (I/O) abilities that others have. Modern tablets largely resemble modern smartphones, the only differences being that tablets are relatively larger than smartphones, with screens 7 inches (18 cm) or larger, measured diagonally, and may not support access to a cellular network.
subclass of: Personal Computer
alternative label: Tablet

Task Scheduler Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: A task scheduler process is an operating system process that executes scheduled tasks (time-scheduling in the sense of wall clock time; not operating system scheduling of processes for multitasking).
subclass of: Operating System Process

Task Scheduler Software
type: Class
type: NamedIndividual
contains: Executable File
contains: Operating System File
comment: A task scheduler software is operating system software that when run executes scheduled tasks (time-scheduling in the sense of wall clock time; not operating system scheduling of processes for multitasking). Processes running such software are task scheduler processes.
see also: Task Scheduler Process
subclass of: System Service Software

Unit Test Execution Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An unit test execution tool automatically performs unit testing. Unit testing is a software testing method by which individual units of source code are tested to determine whether they are fit for use. Unit test execution tools work with sets of one or more computer program modules together with associated control data, usage procedures, and operating procedures. This contrasts with integration testing, which tests inter-unit dependencies and the modules as a group.
subclass of: Test Execution Tool

Unix Hard Link
type: Class
comment: A Unix hard link is a hard link on a Unix file system.
subclass of: Hard Link
subclass of: Unix Link

User Behavior
type: Class
type: NamedIndividual
contains: User Action
comment: A user behavior is a pattern of user actions, or set of such patterns. Modeling and analyzing these patterns and monitoring a users actions for meaningful anomalies is known as user behavior analytics (UBA).
subclass of: Restriction
  on property: contains
  some values from: User Action
subclass of: Digital Artifact

User Manual
type: Reference Type
type: NamedIndividual

User Session Init Config Analysis
type: Operating System Monitoring
type: Class
type: NamedIndividual
analyzes: User Init Configuration File
d3fend-id: D3-USICA
definition: Analyzing modifications to user session config files such as .bashrc or .bash_profile.
enables: Detect
kb-reference: Reference - Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views
synonym: User Startup Config Analysis
subclass of: Restriction
  on property: analyzes
  some values from: User Init Configuration File
subclass of: Operating System Monitoring

User Startup Directory
type: Class
type: NamedIndividual
contains: User Startup Script File
comment: A user startup directory holds information necessary to start the users session with the system.
subclass of: Restriction
  on property: contains
  some values from: User Startup Script File
subclass of: User Logon Init Resource

VPN Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A VPN server is a type of server that enables hosting and delivery of VPN services. It is a combination of VPN hardware and software technologies that provides VPN clients with connectivity to a secure and/or private network, or rather, the VPN.
subclass of: Server

Version Control Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Version control tools are tools that used to conduct version control. A component of software configuration management, version control, also known as revision control, source control, or source code management systems are systems responsible for the management of changes to documents, computer programs, large web sites, and other collections of information. Changes are usually identified by a number or letter code, termed the "revision number", "revision level", or simply "revision". For example, an initial set of files is "revision 1". When the first change is made, the resulting set is "revision 2", and so on. Each revision is associated with a timestamp and the person making the change. Revisions can be compared, restored, and with some types of files, merged.
subclass of: Developer Application
alternative label: Revision Control
alternative label: Source Control

WHOIS Compatible Domain Registration
type: Domain Registration
type: NamedIndividual

Web Application Firewall
type: Class
type: NamedIndividual
runs: Operating System
comment: A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security misconfigurations.
subclass of: Application Layer Firewall
alternative label: WAF

Web Application Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A web application server is a web server that hosts applications. Application server frameworks are software frameworks for building application servers. An application server framework provides both facilities to create web applications and a server environment to run them. In the case of Java application servers, the server behaves like an extended virtual machine for running applications, transparently handling connections to the database on one side, and, often, connections to the Web client on the other.
subclass of: Web Server

Web Socket URL
type: URL
type: NamedIndividual

Wide Area Network
type: Class
comment: By contrast to a local area network (LAN), a wide area network (WAN), not only covers a larger geographic distance, but also generally involves leased telecommunication circuits or Internet links.
subclass of: Network
alternative label: WAN

Windows Batch File
type: Executable Script
type: NamedIndividual

Windows Process
type: Process
type: NamedIndividual

Wireless Router
type: Class
type: NamedIndividual
runs: Operating System
comment: A wireless router is a device that performs the functions of a router and also includes the functions of a wireless access point. It is used to provide access to the Internet or a private computer network. Depending on the manufacturer and model, it can function in a wired local area network, in a wireless-only LAN, or in a mixed wired and wireless network.
see also: Wireless Access Point
subclass of: Router
subclass of: Wireless Access Point

X86 Code Segment
type: Image Code Segment
type: Process Code Segment
type: NamedIndividual

Zero Client Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: Zero client is also referred as ultra thin client, contains no moving parts but centralizes all processing and storage to just what is running on the server. As a result, it requires no local driver to install, no patch management, and no local operating system licensing fees or updates. The device consumes very little power and is tamper-resistant and completely incapable of storing any data locally, providing a more secure endpoint.
subclass of: Thin Client Computer

abuses
type: ObjectProperty
comment: x abuses y: The entity x applies an artifact y to a wrong thing or person; x applies y badly or incorrectly.
sub property of: uses
alternative label: misapplies
alternative label: misuses

attack-id
type: AnnotationProperty
comment: x attack-id y: The offensive technique x has the att&ck unique id of y.
domain: Offensive Technique
range: string
sub property of: attack-kb-annotation

attack-kb-data-property
type: DatatypeProperty
sub property of: topDataProperty
alternative label: attack-kb-property

definition
type: AnnotationProperty
comment: x definition y: The d3fend object x has the definition y. Intended d3fend equivalent to http://purl.obolibrary.org/obo/IAO_0000115; will take over from use of rdfs:comment to hold definition.
sub property of: d3fend-annotation

employed-by
type: ObjectProperty
comment: x employed-by y: An entity x is put into service by a technique or agent y. Inverse of y employs x.
sub property of: associated-with

iOS Process
type: Process
type: NamedIndividual

kb-abstract
type: AnnotationProperty
comment: x kb-abstract y: The reference x has the abstract y.
domain: Reference
range: string
sub property of: d3fend-kb-reference-annotation

kb-article
type: AnnotationProperty
comment: The technique x has the kb-article y, where y is written in Markdown.
domain: Technique
range: string
sub property of: d3fend-kb-reference-annotation

kb-author
type: AnnotationProperty
comment: x kb-author y: The reference x has some author y.
domain: Reference
range: string
sub property of: d3fend-kb-reference-annotation

kb-is-example-of
type: ObjectProperty
comment: x kb-is-example-of y: The reference x is an example of technique y.
domain: Reference
range: Technique
sub property of: d3fend-kb-object-property

kb-mitre-analysis
type: AnnotationProperty
comment: x kb-mitre-analysis y: The reference x has the mitre d3fend analysis y.
domain: Reference
range: string
sub property of: d3fend-kb-annotation-property

kb-organization
type: AnnotationProperty
comment: x kb-organization y: The reference x was created or owned by the organization y.
sub property of: d3fend-kb-annotation-property

macOS Process
type: Process
type: NamedIndividual

modifies-part
type: ObjectProperty
comment: x modifies-part y: The entity x modifies a part of y. [Note: This is a rolification property for the rule 'if one modifies a part of a whole, they modify the whole.' Reasoning for this and similar semantics to come are under evaluation and not part of current d3fend inferences.]
sub property of: may-modify
property chain axiom: modifies
property chain axiom: contains

non-real-time-analytic
type: Analytic Latency
type: NamedIndividual

non-real-time-eviction
type: Eviction Latency
type: NamedIndividual

process-parent
type: ObjectProperty
comment: x process-parent y: The process y created the process x (directly) with a create process event.
sub property of: process-ancestor
alternative label: processParent

real-time-analytic
type: Analytic Latency
type: NamedIndividual

real-time-eviction
type: Eviction Latency
type: NamedIndividual

release-date
type: AnnotationProperty
comment: x release-date y: The object x has the release-date y.
sub property of: d3fend-annotation
sub property of: versionInfo

synonym
type: AnnotationProperty
comment: an equivalent term.
sub property of: d3fend-annotation

used-by
type: ObjectProperty
comment: x used-by y: is inverse of y uses x.
sub property of: associated-with
inverse of: uses

writes
type: ObjectProperty
comment: x writes y: The subject x takes the action of writing to a digital artifact y to store data and placing it into persistent memory for later reference.
sub property of: accesses

comment
type: AnnotationProperty

isDefinedBy
type: AnnotationProperty

Reference - CAR-2016-04-004: Successful Local Account Login
kb-organization: MITRE/NSA

Reference - DNS Whitelist (DNSWL) Email Authentication Method Extension
kb-author: Alessandro Vesely

Application Layer Firewall
type: Class
type: NamedIndividual
runs: Operating System
comment: An application firewall is a form of firewall that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. The application firewall is typically built to control all network traffic on any OSI layer up to the application layer. It is able to control applications or services specifically, unlike a stateful network firewall, which is - without additional software - unable to control network traffic regarding a specific application. There are two primary categories of application firewalls, network-based application firewalls and host-based application firewalls.
subclass of: Firewall
alternative label: Application Firewall

Application Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
runs: Application
comment: An application process is an instance of an application computer program that is being executed.
subclass of: Restriction
  on property: runs
  some values from: Application
subclass of: User Process

Boot Record
type: Class
subclass of: Digital Artifact

Bootloader Authentication
type: Platform Hardening
type: Class
type: NamedIndividual
authenticates: Boot Loader
d3fend-id: D3-BA
definition: Cryptographically authenticating the bootloader software before system boot.
enables: Harden
synonym: Secure Boot
subclass of: Restriction
  on property: authenticates
  some values from: Boot Loader
subclass of: Platform Hardening

Client-server Payload Profiling
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Network Traffic
d3fend-id: D3-CSPP
definition: Comparing client-server request and response payloads to a baseline profile to identify outliers.
enables: Detect
kb-article: ## How it works Profiling request and response payloads across multiple clients to a single server to develop a baseline of their characteristics. May take into account request/response sizes, entropy, frequency, and rhythm. Finally, identify outliers as they may indicate a malicious payload delivery and subsequent server exploitation. ## Considerations * Collecting metrics to establish a profile can be challenging since user behavior can change easily. * Employees may work different hours or inconsistent schedules which will cause false positives. * Collection of network activity to generate metrics is a computationally intensive process. * Users may log into different workstations which may cause false positives.
kb-reference: Reference - Method and system for detecting malicious payloads - Vectra Networks Inc
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
subclass of: Network Traffic Analysis

Cloud Service Authentication
type: Class
type: NamedIndividual
authenticates: User
may-create: Intranet Network Traffic
originates-from: Physical Location
subclass of: Authentication

Cloud Service Authorization
type: Class
type: NamedIndividual
authorizes: Network Resource Access
subclass of: Authorization

Connected Honeynet
type: Decoy Environment
type: Class
type: NamedIndividual
d3fend-id: D3-CHN
definition: A decoy service, system, or environment, that is connected to the enterprise network, and simulates or emulates certain functionality to the network, without exposing full access to a production system.
enables: Deceive
kb-article: ## How it works Decoy honeypots are deployed within the enterprise environment that emulate certain services or portions of an OS to attract attackers. ## Considerations A connected honeynet provides a tradeoff between emulating certain functionality but not being as sophisticated as an integrated honeynet. The connected honeynet may not provide enough functionality to detect new attack patterns or zero day exploits but could provide enough functionality for specific known vulnerabilities.
kb-reference: Reference - Modification of a Server to Mimic a Deception Mechanism - Acalvio Technologies Inc
manages: Decoy Object
spoofs: Local Area Network
subclass of: Restriction
  on property: spoofs
  some values from: Local Area Network
subclass of: Decoy Environment

Connection Attempt Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Intranet Network Traffic
d3fend-id: D3-CAA
definition: Analyzing failed connections in a network to detect unauthorized activity.
enables: Detect
kb-article: ## How it works Connection Attempt Analysis in multiple ways. ### Monitoring traffic to unallocated IP space One approach looks for failed connection attempts against unallocated IP space. First, network traffic is captured to map out the network to identify network assets as well as unallocated IP space. The map is then used to determine if connection attempts are being made to the unallocated IP space. ### Monitoring for sequentially transmitted traffic Another approach passively inspects network traffic with application protocol analyzers observing network activity characteristics such as volume of packets sent/ received, TCP session attributes, and connection information between hosts (start time, source/destination host, services, etc.). Then using pattern matching to identify traffic which appears to be probing for network hosts. ## Considerations * Implementations that rely on analysis of unallocated IP address space increase in their complexity with network size and decentralized network infrastructure. * Inventory of unallocated IP space should should be continuously updated to mitigate the risk of false positives. * IPv6 also introduces challenges including IPv6 traffic bypassing IPv4 specific protection systems (ex. firewalls and IDS) and complexity in managing both IPv6 and IPv4 addresses.
kb-reference: Reference - Detecting network reconnaissance by tracking intranet dark-net communications - VECTRA NETWORKS Inc
synonym: Network Scan Detection
subclass of: Restriction
  on property: analyzes
  some values from: Intranet Network Traffic
subclass of: Network Traffic Analysis

DNS Allowlisting
type: Network Isolation
type: Class
type: NamedIndividual
blocks: Outbound Internet DNS Lookup Traffic
d3fend-id: D3-DNSAL
definition: Permitting only approved domains and their subdomains to be resolved.
enables: Isolate
synonym: DNS Whitelisting
subclass of: Restriction
  on property: blocks
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: Network Isolation

Database Query String Analysis
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: Database Query
d3fend-id: D3-DQSA
definition: Analyzing database queries to detect [SQL Injection](https://capec.mitre.org/data/definitions/66.html).
enables: Detect
kb-article: ## How it works Some implementations use software hooks to intercept function calls related to database query operations. Other implementations might intercept or collect network traffic. The database query string is then extracted and analyzed with various methods, for example: * Detecting specific administrative SQL commands * Anomalous sequences of commands when compared to a statistical baseline. * Anomalous commands for a given user role. ## Considerations Some capabilities sanitize queries before permitting them to be transmitted to the database. This incurs risks such altering data in an undesired way or breaking application functionality.
kb-reference: Reference - System and method for internet security - Cylance Inc
subclass of: Restriction
  on property: analyzes
  some values from: Database Query
subclass of: Process Analysis

Dead Code Elimination
type: Application Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-DCE
definition: Removing unreachable or "dead code" from compiled source code.
enables: Harden
kb-article: ## How it works Dead code is code that is considered unreachable by normal program execution. Dead code can be created by adding code under a condition that never evaluates to true. Dead code should be removed since this type of code can produce unexpected results, if accidentally or maliciously forced to execute. Dead code identification is typically performed by algorithms that implement program flows analysis looking for unreachable code. The dead code is eliminated by instructing compilers to remove the code through compiler flags, i.e., ‘-fdce’ is used for Dead Code Elimination. ## Considerations Code can also be deemed unreachable for certain run-time conditions. Different deployed systems and environments may contain some code that is unreachable for the given environment. This technique does not consider run-time conditions for unreachable code.
kb-reference: Reference - Dead code elimination
subclass of: Application Hardening

Decoy Public Release
type: Decoy Object
type: Class
type: NamedIndividual
d3fend-id: D3-DPR
definition: Issuing publicly released media to deceive adversaries.
enables: Deceive
kb-article: ## How it works Publicly released media includes press release, videos, or other marketing collateral. The media may include URLs, points of contact, or other identifiers to entice interaction from adversaries. ## Considerations * Information used in decoy public released media must contain enough realism to deceive and provide interaction from adversaries. * Continuous development, creation, and distribution of media and identifiers are needed to ensure adversary interaction continues over time. * Decoy public releases could be placed on platforms with different degrees of ownership, including entirely enterprise-owned infrastructure, IaaS, and SaaS (including social applications). Platforms that are not entirely enterprise-owned may be more likely to gather information
kb-reference: Reference - Mock attack cybersecurity training system and methods - WOMBAT SECURITY TECHNOLOGIES Inc
subclass of: Decoy Object

Decoy Session Token
type: Decoy Object
type: Class
type: NamedIndividual
d3fend-id: D3-DST
definition: An authentication token created for the purposes of deceiving an adversary.
enables: Deceive
kb-article: ## How it works Usage of decoy session tokens may be monitored to track attacker behavior or otherwise control the beliefs of the attacker. ## Considerations * Interaction and activity with the decoy session token must be constantly monitored and analyzed to detect unauthorized activity. * Session tokens are typically short-lived and therefore the decoy must be continuously updated to provide the appearance of it being used in the production environment. * Automated tools can assist with maintenance and updates by automatically adjusting the decoy session token and environment to mimic the production environment.
kb-reference: Reference - Decoy and deceptive data object technology - Cymmetria Inc
spoofs: Access Token
subclass of: Restriction
  on property: spoofs
  some values from: Access Token
subclass of: Decoy Object

Disk Encryption
type: Platform Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-DENCR
definition: Encrypting a hard disk partition to prevent cleartext access to a file system.
enables: Harden
encrypts: Storage
kb-reference: LUKS1 On-Disk Format SpecificationVersion 1.2.3
subclass of: Restriction
  on property: encrypts
  some values from: Storage
subclass of: Platform Hardening

Domain Registration
type: Class
type: NamedIndividual
may-contain: Domain Name
comment: A domain registration, or domain name registration data, is the relevant registration data from Internet resources such as domain names, IP addresses, and autonomous system numbers. Registration data is typically retrieved by means of either the Registration Data Access Protocol (RDAP) or its predecessor, the WHOIS protocol.
subclass of: Restriction
  on property: may-contain
  some values from: Domain Name
subclass of: Digital Artifact
alternative label: Domain Name Registration Data

Encrypted Tunnels
type: Network Isolation
type: Class
type: NamedIndividual
d3fend-id: D3-ET
definition: Encrypted encapsulation of routable network traffic.
enables: Isolate
isolates: Intranet Network
kb-reference: Reference - Security Architecture for the Internet Protocol
subclass of: Restriction
  on property: isolates
  some values from: Intranet Network
subclass of: Network Isolation

Endpoint Health Beacon
type: Operating System Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-EHB
definition: Monitoring the security status of an endpoint by sending periodic messages with health status, where absence of a response may indicate that the endpoint has been compromised.
enables: Detect
kb-article: ## How it works Endpoints are configured to periodically generate and transmit a secure heartbeat that is delivered on a configured schedule and provides endpoint status information. Status information can include software details (version, configuration, etc), endpoint identification (MAC, IP address, machine ID) or other hardware/software configuration information. Interruption of the heartbeat can signal that the endpoint has been compromised. ## Considerations * Security of heartbeat messages to ensure message integrity * Disappearance of the heartbeat could simply mean that the endpoint is powered off or intentionally disconnected from the network. Therefore other criteria may need to be used to accurately detect endpoint compromise. * Attacker presence on the machine may leave the heartbeat intact. * An attacker may determine the format of the heartbeat and continue to send it even after the machine is compromised.
kb-reference: Reference - Intrusion detection using a heartbeat - Sophos Ltd
synonym: Endpoint Health Telemetry
subclass of: Operating System Monitoring

Exception Handler Pointer Validation
type: Application Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-EHPV
definition: Validates that a referenced exception handler pointer is a valid exception handler.
enables: Harden
kb-article: ## How It Works When a process encounters an exception, it calls an exception handler to deal with the exception. The method by which this exception handler is determined varies by the operating system. The exception handler is called, even if it is the default exception handler to terminate the program and display a message that the program stopped working. In the case that no valid exception handler is found, the program would fail to proceed as normal and could be programmed to terminate. In Windows, the address of the exception registration record is stored at the very start of the the Thread Information Block; the GS register points to this structure. The exception registration record contains two pointers: a pointer to the next exception registration record should this handler fail to handle the exception, and a pointer to the handler. A buffer overflow can overwrite the saved return pointer with an invalid location to execute memory; this often triggers the exception handler chain, which could also be corrupted by the buffer overflow. Although Process Exception Handler Validation does not make sure that the exception handler pointer or the code at the exception handler was unaltered, or that the exception handler code is secure, this technique does ensure that the pointer is at least an exception handler that could be called by the program. With Process Exception Handler Validation, before the handler is called, it checks the exception handler against a source of valid exception handlers. If the requested handler is not in this list, other techniques such as those in Process Eviction might be invoked, such as Process Termination to end the current process, or Executable Blacklisting to blacklist the potentially vulnerable or malfunctioning executable. ### Runtime valid exception handler source generation The source of valid exception handlers could be generated at runtime, with the risk of the information that is used to determine the validity of exception ha…
kb-reference: Reference - /SAFESEH (Image has Safe Exception Handlers) - Microsoft Docs
synonym: Exception Handler Validation
validates: Pointer
subclass of: Restriction
  on property: validates
  some values from: Pointer
subclass of: Application Hardening

File Access Pattern Analysis
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: Local Resource Access
d3fend-id: D3-FAPA
definition: Analyzing the files accessed by a process to identify unauthorized activity.
enables: Detect
kb-article: ## How it works File modifying malware such as wipers and ransomware are detected by identifying file access patterns that are associated with a malicious process. Examples of file access patterns include accessing a large number of files, accessing multiple file types, files being accessed located in multiple locations in a directory, and copying a file and encrypting the contents of that file into a copy. These patterns are used to a assign a risk score for the process behavior and if over a threshold, a preventive action is taken. ## Considerations Certain file access actions may not be statistically different from benign activity and therefore may not exceed the configured threshold.
kb-reference: Reference - File-modifying malware detection - Crowdstrike Inc
subclass of: Restriction
  on property: analyzes
  some values from: Local Resource Access
subclass of: Process Analysis

File Carving
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: File Transfer Network Traffic
d3fend-id: D3-FC
definition: Extracting files from network application protocols through the use of network stream reassembly software.
enables: Detect
kb-article: ## How it works Protocol stream reassembly software recreates a directional byte stream by analyzing captured network packets. Once the stream is reassembled pattern matching is applied to determine if it contains a file of interest. Files of interest range from executable, archive, or document file formats. Once the file is captured, it is then processed with standard File Analysis Techniques. Example network protocols include HTTP, SMTP, FTP, HTTP/2, and TLS/HTTP/Dropbox. ## Considerations This is an error prone process due to the intricacies of network protocols and network packet capture. For example reassembly may be done in real-time or streaming fashion, or packets may be written to disk, then bulk processed. The packets may arrive out of order, with fragmentation, duplicates, or re-transmissions. The reassembly software must compensate for the imperfect packet stream in order to recreate the well formed file which was transmitted.
kb-reference: Reference - Computer Worm Defense System and Method - FireEye Inc
subclass of: Restriction
  on property: analyzes
  some values from: File Transfer Network Traffic
subclass of: Network Traffic Analysis

Firewall
type: Class
type: NamedIndividual
runs: Operating System
comment: In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted internal network and untrusted external network, such as the Internet. Firewalls are often categorized as either network firewalls or host-based firewalls. Network firewalls filter traffic between two or more networks and run on network hardware. Host-based firewalls run on host computers and control network traffic in and out of those machines.
subclass of: Network Node

Homoglyph Denylisting
type: Forward Resolution Domain Denylisting
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
blocks: Outbound Internet DNS Lookup Traffic
d3fend-id: D3-HDL
definition: Blocking DNS queries that are deceptively similar to legitimate domain names.
enables: Isolate
kb-article: ## How it works Homoglyph domain blacklisting considers the domain and subdomain structure of a lookup and compares the named components to blacklisted named components. The blacklisted named components are typically crafted modifications of known good domains, e.g., gooogle.com versus google.com. The blacklisted domains typically resemble trusted domains, but have been altered slightly to deceive users. The blacklisted named components also include consideration for fonts or Unicode characters that can make certain characters appear very similar (zero vs capital O and the letter l vs the number one). The blacklisted domains under certain fonts will appear to be a trusted domain. ## Considerations * Maintaining the currency of the list can be a challenge especially with newly registered domain entries. * Blacklists should have identified maintenance cycles to ensure lists are not stale.
kb-reference: Reference - Detection of Malicious IDNHomoglyph Domains
synonym: Homoglyph Blacklisting
subclass of: Forward Resolution Domain Denylisting

IPC Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: IPC network traffic is network traffic related to inter-process communication (IPC) between network nodes..This includes only network traffic conforming to a standard IPC protocol; not custom protocols.
subclass of: Network Traffic

Indirect Branch Call Analysis
type: Process Analysis
type: Class
type: NamedIndividual
d3fend-id: D3-IBCA
definition: Analyzing vendor specific branch call recording in order to detect ROP style attacks.
enables: Detect
kb-article: ## How it works This technique is used to detect an attacker attempting to exploit and execute code on a target system’s call stack using return-oriented programming (ROP). Modern processors that have the ability to maintain a list of the branching calls, e.g., Intel's Last Branch Recording (LBR), can be used to track and analyze indirect branching calls that are indicative of malicious activity. In order to reduce the number of indirect branch calls to analyze to a manageable set it is assumed that malicious ROP activity will involve the use of system calls. The technique observes indirect branch calls that are part of paths that lead to system calls, all others are ignored. Branching calls chained together is often referred to as gadgets and gadgets are often used in ROP attacks. Indirect branch calls that involve a transfer from user-space to kernel-space are of interest for this technique. Identification of potential ROP exploit execution includes: - Inspecting the LBR when a system function call is made - The LBR is configured to return only instruction of interest (ret, indirect jmp, indirect calls) - Behavior is analyzed for - Ret instructions that appear to target areas not preceded by the call sites - Sequences of small code fragments that appear to be chained through the indirect branching calls (gadgets) - Of interest are returns that appear to not render control back after calls - Typical ret-call are paired - gadgets will appear to have ret followed by instruction of next instruction of the following gadget ## Considerations * May be operating system dependent since specific system calls are used to scope branching behavoir * Processors need to support access to a Last Branch Recording list feature * The size of the LBR stack can limit the expected size of the analyzed execution stack * If processor does not support LBR then overhead costs for the analysis can be significant
kb-reference: Reference - Indirect Branching Calls
subclass of: Process Analysis

Integrated Honeynet
type: Decoy Environment
type: Class
type: NamedIndividual
d3fend-id: D3-IHN
definition: The practice of setting decoys in a production environment to entice interaction from attackers.
enables: Deceive
kb-article: ## How it works Integrated honeynets use full production environments connected to the enterprise network, that utilize computing resources or software that attract attackers, and allow full interaction and access that provides a complete view of an attack. ## Considerations An attacker with control of a system on an Integrated Honeynet could: * try to attack other connected hosts on the network, its IP range of internal hosts not properly configured to react to connections from machines on the integrated honeynet, or position behind the firewall. * exploit its position by eavesdropping on network traffic If an attacker manages to stop the processes used to log an attack without setting off any alarms.
kb-reference: Reference - Synchronizing a honey network configuration to reflect a target network environment - Palo Alto Networks Inc
manages: Decoy Object
spoofs: Intranet Network
subclass of: Restriction
  on property: spoofs
  some values from: Intranet Network
subclass of: Decoy Environment

Intrusion Detection System
type: Class
type: NamedIndividual
runs: Operating System
comment: An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms.
subclass of: Network Node
alternative label: IDS

Javascript File
type: Executable Script
type: NamedIndividual

Job Function Access Pattern Analysis
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Authorization
d3fend-id: D3-JFAPA
definition: Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department.
enables: Detect
kb-article: ## How it works Peer group analysis identifies functionally similar groups of actors (users or resources) based on categorizations such as job title, organizational hierarchy, or other attribute that indicates similarity of job function. Current user access activity is then compared to the appropriate peer group behavior profile to identify anomalies. ## Considerations Potential for false positives from anomalies that are not associated with malicious activity.
kb-reference: Reference - Anomaly Detection Using Adaptive Behavioral Profiles - Securonix Inc
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
subclass of: User Behavior Analysis

LUKS1 On-Disk Format SpecificationVersion 1.2.3
type: Specification Reference
type: NamedIndividual
has-link: https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf
kb-abstract: LUKS is short for ”Linux Unified Key Setup”. It has initially been developed to remedy the unpleasantness a user experienced that arise from deriving the encryption setup from changing user space, and forgotten command line arguments. The result of this changes are an unaccessible encryption storage. The reason for this to happen was, a unstandardised way to read, process and set up encryption keys, and if the user was unlucky, he upgraded to an incompatible version of user space tools that needed a good deal of knowledge to use with old encryption volumes.
kb-author: Clemens Fruhwirth
kb-is-example-of: Disk Encryption
kb-reference-title: LUKS1 On-Disk Format SpecificationVersion 1.2.3

Local Account Monitoring
type: Operating System Monitoring
type: Class
type: NamedIndividual
analyzes: Local User Account
d3fend-id: D3-LAM
definition: Analyzing local user accounts to detect unauthorized activity.
enables: Detect
kb-reference: Reference - CAR-2016-04-004: Successful Local Account Login
kb-reference: Reference - OS Query Windows User Collection Code
subclass of: Restriction
  on property: analyzes
  some values from: Local User Account
subclass of: Operating System Monitoring

Mail Network Traffic
type: Class
type: NamedIndividual
contains: Email
may-contain: Domain Name
originates-from: Physical Location
comment: Mail traffic is network traffic that uses a standard mail transfer protocol.
subclass of: Restriction
  on property: contains
  some values from: Email
subclass of: Network Traffic

Memory Boundary Tracking
type: Operating System Monitoring
type: Class
type: NamedIndividual
analyzes: Process Code Segment
d3fend-id: D3-MBT
definition: Analyzing a call stack for return addresses which point to unexpected memory locations.
enables: Detect
kb-article: ## How it works This technique monitors for indicators of whether a return address is outside memory previously allocated for an object (i.e. function, module, process, or thread). If so, code that the return address points to is treated as malicious code. ## Considerations Kernel malware can manipulate memory contents, for example modifying pointers to hide processes, and thereby impact the accuracy of memory allocation information used to perform the analysis.
kb-reference: Reference - Inferential exploit attempt detection - Crowdstrike Inc
subclass of: Restriction
  on property: analyzes
  some values from: Process Code Segment
subclass of: Operating System Monitoring

Metadata
type: Class
comment: Metadata is "data [information] that provides information about other data". Three distinct types of metadata exist: structural metadata, descriptive metadata, and administrative metadata. Structural metadata is data about the containers of data. For instance a "book" contains data, and data about the book is metadata about that container of data. Descriptive metadata uses individual instances of application data or the data content.
subclass of: Digital Artifact

Multi-factor Authentication
type: Credential Hardening
type: Class
type: NamedIndividual
authenticates: User Account
d3fend-id: D3-MFA
definition: Requiring proof of two or more pieces of evidence in order to authenticate a user.
enables: Harden
kb-article: ## How it works When logging into an account users present two or more credentials that fall into different categories: something you know (password or PIN), something you have (smart card or phone), or something you are (fingerprint). ## Considerations MFA configuration steps may vary across accounts and in some cases left up to users to activate and implement.
kb-reference: Reference - Method and apparatus for utilizing a token for resource access - Rsa Security Inc.
subclass of: Restriction
  on property: authenticates
  some values from: User Account
subclass of: Credential Hardening

Network Flow
type: Class
type: NamedIndividual
summarizes: Network Traffic
subclass of: Restriction
  on property: summarizes
  some values from: Network Traffic
subclass of: Digital Artifact

Network Traffic Community Deviation
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Network Traffic
d3fend-id: D3-NTCD
definition: Establishing baseline communities of network hosts and identifying statistically divergent inter-community communication.
enables: Detect
kb-article: ## How it works Hosts/users within a computer network are analyzed to identify communities of hosts which frequently communicate. Future communications between communities that don't usually communicate can then be detected. For example, if a community of hosts that communicate in support of a company's finance division suddenly starts to access the code server usually accessed only by engineers, this may indicate unauthorized activity. ## Considerations * Potential for false positives in very dynamic network environments. * Attackers that move low and slow may not differentiate their behavior enough to trigger an alert.
kb-reference: Reference - System for implementing threat detection using daily network traffic community outliers - VECTRA NETWORKS Inc
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
subclass of: Network Traffic Analysis

One-time Password
type: Credential Hardening
type: Class
type: NamedIndividual
authenticates: User Account
d3fend-id: D3-OTP
definition: A one-time password is valid for only one user authentication.
enables: Harden
kb-article: ## How it works When a user initiates authentication, they are asked for a one-time password, often in addition to other credentials such as a traditional password or smart card. The one-time password may be from a list provided in advance, sent via a channel such as SMS or HTTPS to an app, or a generated token. In the case of a physical token which generates one-time passwords incrementally based on time elapsed, that token device need not be connected to the internet. In different implementations, an administrator of the system, or a user with additional verification, can adjust for clock skew between the token and the verification system as needed. ## Considerations ### Compromise of delivery channel - SIM Swapping - Secure token visual compromise - Insecure delivery channel ### Compromise of delivery device Physical loss of One-time Password device. ### Compromise of long-term backup codes These are often provided in the form of a downloadable document with a regular name, which can be searched for in the case that the user forgets where they put them. This digital file or printed document could be stolen. Additionally, after the code file is printed, it could be recovered from the system printer spool unless the spooler cache is cleared.
kb-reference: Reference - RFC 2289 - A One-Time Password System
synonym: OTP
use-limits: Password
subclass of: Restriction
  on property: authenticates
  some values from: User Account
subclass of: Restriction
  on property: use-limits
  some values from: Password
subclass of: Credential Hardening

Outbound Traffic Filtering
type: Network Isolation
type: Class
type: NamedIndividual
d3fend-id: D3-OTF
definition: Restricting network traffic originating from a private host or enclave destined towards untrusted networks.
enables: Isolate
filters: Network Traffic
kb-article: ## How it works Outbound traffic, in this context, is network traffic originating from a private host or enclave destined towards untrusted networks. For example: * An enterprise desktop intranet user connecting to www.example.com * An internal mail server connecting to an external mail server, mail.example.com Filtering is commonly implemented as firewall rulesets to limit outbound traffic permitted to egress a host or network. Firewalls are deployed either directly on hosts through kernel level software implementations or installed in-line directly on network links. There are benefits and disadvantages to each approach. There are various strategies for developing filtering rulesets: * Block everything by default * Limit destination hosts * Limit destination transport or application protocols * Restrict content outbound (Ex. strings formatted as social security numbers, or proprietary data) ## Considerations * Dynamic IP assignment creates challenges for Outbound Traffic Filtering because users are not necessarily associated with the same IP address. This can be addressed by linking IP address management information with the filtering logic. * Connections using non-standard transport layer ports may circumvent outbound traffic filtering technology which does not detect application protocol based on traffic content. * Business requirements typically drive the development of filtering rule sets. ## Implementations - iptables (Linux) - Windows Firewall - pf (BSD)
kb-reference: Reference - Automatically generating rules for connection security - Microsoft
subclass of: Restriction
  on property: filters
  some values from: Network Traffic
subclass of: Network Isolation

Output Device
type: Class
comment: An output device is any piece of computer hardware equipment which converts information into human-readable form. It can be text, graphics, tactile, audio, and video. Some of the output devices are Visual Display Units (VDU) i.e. a Monitor, Printer, Graphic Output devices, Plotters, Speakers etc. A new type of Output device is been developed these days, known as Speech synthesizer, a mechanism attached to the computer which produces verbal output sounding almost like human speeches.
subclass of: Hardware Device

Per Host Download-Upload Ratio Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Network Traffic
d3fend-id: D3-PHDURA
definition: Detecting anomalies that indicate malicious activity by comparing the amount of data downloaded versus data uploaded by a host.
enables: Detect
kb-article: ## How it works Aggregate pull vs. push ratios from metadata are used to develop a baseline for a given host over a specific time period, e.g., over a three-hour period, one day, one week, etc. Anomalies identified over a threshold produce an alert. ## Considerations Collection and analysis of large network packet captures requires large storage and intensive computing power. The time windows used to calculate the ratio may vary in implementations, this consideration should take into account a threat model and likely effects (impacts) delivered by an adversary.
kb-reference: Reference - System for detecting threats using scenario-based tracking of internal and external network traffic - VECTRA NETWORKS Inc
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
subclass of: Network Traffic Analysis

Physical Artifact
type: Class
subclass of: Artifact
subclass of: Physical Object

Physical Object
type: Class
subclass of: Restriction
  on property: has-location
  some values from: Physical Location
subclass of: D3FEND Thing

Policy Reference
type: Class
pref-label: Policy
subclass of: Technique Reference

Process Self-Modification Detection
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: Process
d3fend-id: D3-PSMD
definition: Detects processes that modify, change, or replace their own code at runtime.
enables: Detect
kb-article: ## How it Works A security agent installed on the host machine intercepts API calls between a process and operating system. Intercepted API calls are then compared against attack signatures/patterns to identify API calls that modify executable memory or modify the entry point address of a suspended child process. Attack patterns include: * Executable code of a suspended child process removed from memory by one or more API calls. * New executable code injected and / or loaded into memory of a suspended child process by one or more API calls. * Executable code modified by one or more API calls. * Next instruction pointer value in memory modified by one or more API calls. ## Considerations Comparing loaded code segments of processes with what is expected to have been loaded from a file can result in false positives, due to legitimate uses of self-modification for decrypting or uncompressing code segments.
kb-reference: Reference - System and Method for Process Hollowing Detection - Carbon Black Inc
subclass of: Restriction
  on property: analyzes
  some values from: Process
subclass of: Process Analysis

Reference – RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) – IETF
type: Specification Reference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc7489
kb-abstract: Domain-based Message Authentication, Reporting, and Conformance(DMARC) is a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting, that a mail-receiving organization can use to improve mail handling. Originators of Internet Mail need to be able to associate reliable and authenticated domain identifiers with messages, communicate policies about messages that use those identifiers, and report about mail using those identifiers. These abilities have several benefits: Receivers can provide feedback to Domain Owners about the use of their domains; this feedback can provide valuable insight about the management of internal operations and the presence of external domain name abuse. DMARC does not produce or encourage elevated delivery privilege of authenticated email. DMARC is a mechanism for policy distribution that enables increasingly strict handling of messages that fail authentication checks, ranging from no action, through altered delivery, up to message rejection.
kb-author: M. Kucherawy, E. Zwicky
kb-is-example-of: Transfer Agent Authentication
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-title: RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Reference - CAR-2016-04-004: Successful Local Account Login
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-004/
kb-is-example-of: Local Account Monitoring
kb-reference-title: Reference - CAR-2016-04-004: Successful Local Account Login

Reference - Certificate and Public Key Pinning
type: Technique Reference
type: NamedIndividual
has-link: https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning
kb-abstract: Certificate and Public Key Pinning technical guide to implementing certificate and public key pinning.
kb-author: OWASP
kb-is-example-of: Certificate Pinning
kb-organization: OWASP
kb-reference-title: Certificate and Public Key Pinning

Reference - Certificate Transparency
type: Technique Reference
type: NamedIndividual
has-link: https://www.certificate-transparency.org/
kb-abstract: Google's Certificate Transparency project fixes several structural flaws in the SSL certificate system, which is the main cryptographic system that underlies all HTTPS connections. These flaws weaken the reliability and effectiveness of encrypted Internet connections and can compromise critical TLS/SSL mechanisms, including domain validation, end-to-end encryption, and the chains of trust set up by certificate authorities.
kb-author: Google
kb-is-example-of: Passive Certificate Analysis
kb-organization: Google
kb-reference-title: Certificate Transparency

Reference - DNS Whitelist (DNSWL) Email Authentication Method Extension
type: Specification Reference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc8904
kb-is-example-of: DNS Allowlisting
kb-reference-title: DNS Whitelist (DNSWL) Email Authentication Method Extension

Reference - Dead code elimination
type: Academic Paper Reference
type: NamedIndividual
has-link: https://nebelwelt.net/files/15LangSec.pdf
kb-abstract: There is a significant body of work devoted to testing, verifying, and certifying the correctness of optimizing compilers. The focus of such work is to determine if source code and optimized code have the same functional semantics. In this paper, we introduce the correctness-security gap, which arises when a compiler optimization preserves the functionality of but violates a security guarantee made by source code. We show with concrete code examples that several standard optimizations, which have been formally proved correct, inhabit this correctness-security gap. We analyze this gap and conclude that it arises due to techniques that model the state of the program but not the state of the underlying machine. We propose a broad research program whose goal is to identify, understand, and mitigate the impact of security errors introduced by compiler optimizations. Our proposal includes research in testing, program analysis, theorem proving, and the development of new, accurate machine models for reasoning about the impact of compiler optimizations on security.
kb-author: Vijay D’Silva, Mathias Payer, Dawn Song
kb-is-example-of: Dead Code Elimination
kb-organization: Google Inc, Purdue University, UC Berkeley
kb-reference-title: The Correctness-Security Gap in Compiler Optimization

Reference - Decoy Network-Based Service for Deceiving Attackers - Amazon Technologies
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10873601B1
kb-abstract: A decoy network-based service uses a decoy credential to lure an attacker to access the decoy network-based service, and monitors the attacker's activity with respect to the decoy network-based service to determine the attacker's motivation. In various examples, a decoy credential is published on an Internet-accessible site, and a system that provides a network-based service (e.g., a service provider network) subsequently receives an access request from a computing device that includes the decoy credential. Based on the decoy credential, the computing device may be provided access to a decoy network-based service, and application programming interface (API) calls made by the computing device may be routed through a decoy control plane. The data relating to the API calls may be stored and analyzed to determine a motivation of the attacker, which may be used in various downstream applications to improve security for customers of the network-based service.
kb-author: Thomas Stickle
kb-is-example-of: Decoy User Credential
kb-mitre-analysis: MITRE analysis was not found.
kb-organization: Amazon Technologies
kb-reference-title: Decoy network-based service for deceiving attackers

Reference - Detection of Malicious IDNHomoglyph Domains
type: Internet Article Reference
type: NamedIndividual
has-link: http://essay.utwente.nl/79263/1/Yazdani_MA_EEMCS.pdf
kb-abstract: At early stages of Internet development, users were only able to register or access domains with ASCII characters. The introduction of IDN (Internationalized Domain Name) which uses the larger Unicode character set, made it possible for regional users to deal with domain names using their local language alphabet. Beside the advantages provided by IDN, a new type of network threats has also emerged. The reason behind this is that there are many similar-looking characters in Unicode system, called homoglyphs. These characters could be used by an attacker to lure users by replacing one or more characters of a benign domain.
kb-author: Ramin Yazdani
kb-is-example-of: Homoglyph Denylisting
kb-organization: University of Twente
kb-reference-title: Detection of Malicious IDN Homoglyph Domains Using Active DNS Measurements

Reference - Digital Identity Guidelines 800-63-3
type: Guideline Reference
type: NamedIndividual
has-link: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf
kb-author: NIST
kb-is-example-of: Strong Password Policy
kb-organization: NIST
kb-reference-title: Digital Identity Guidelines

Reference - End-to-end certificate pinning
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9847992B2/en
kb-abstract: Some embodiments implement end-to-end certificate pinning for content intake from various content providers and for content distribution to various end users. To ensure secure retrieval of content provider content, the content distributor pins the content provider to one or more certificate authorities.
kb-author: Tin Zaw, Reed Morrison, Robert J. Peters
kb-is-example-of: Certificate Pinning
kb-organization: Verizon Digital Media Services Inc
kb-reference-title: End-to-end Certificate Pinning

Reference - Firmware Behavior Analysis ConFirm
type: Academic Paper Reference
type: NamedIndividual
has-link: http://sites.nyuad.nyu.edu/moma/pdfs/pubs/C22.pdf
kb-abstract: The modernization of various critical infrastructure components has dictated the use of microprocessor-based embedded control systems in critical applications. It is often infeasible, however, to employ the same level of security measures used in general purpose computing systems, due to the stringent performance and resource constraints of embedded devices. Furthermore, as software relies on the firmware for proper operation, no software-level technique can detect malicious behavior of the firmware. In this work, we propose ConFirm, a low-cost technique to detect malicious modifications in the firmware of embedded systems by measuring the number of low-level hardware events that occur during the execution of the firmware.
kb-author: Xueyang Wang, Charalambos Konstantinou, Michail Maniatakos, Ramesh Karri
kb-is-example-of: Firmware Behavior Analysis
kb-organization: Department of Electrical and Computer Engineering, Polytechnic School of Engineering, New York University and Department of Electrical and Computer Engineering, New York University Abu Dhabi
kb-reference-title: ConFirm: Detecting Firmware Modifications in Embedded Systems using Hardware Performance Counters

Reference - Firmware Behavior Analysis VIPER
type: Academic Paper Reference
type: NamedIndividual
has-link: https://dl.acm.org/doi/pdf/10.1145/2046707.2046711
kb-abstract: Recent research demonstrates that malware can infect peripherals' firmware in a typical x86 computer system, e.g., by exploiting vulnerabilities in the firmware itself or in the firmware update tools. Verifying the integrity of peripherals' firmware is thus an important challenge. We propose software-only attestation protocols to verify the integrity of peripherals' firmware, and show that they can detect all known software-based attacks.
kb-author: Yanlin Li, Jonathan M. McCune, Adrian Perrig
kb-is-example-of: Firmware Behavior Analysis
kb-organization: CyLab, Carnegie Mellon University
kb-reference-title: VIPER: Verifying the Integrity of PERipherals’ Firmware

Reference - Firmware Embedded Monitoring Code Red Balloon
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10657262B1/en
kb-abstract: Systems and methods for securing embedded devices via both online and offline defensive strategies. One or more security software components may be injected into firmware binary to create a modified firmware binary, which is functionally- and size-equivalent to the original firmware binary. The security software components may retrieve live forensic information related to embedded devices for use in live hardening of the modified firmware binary while the embedded device is online, dynamically patching the firmware
kb-author: Ang Cui, Salvatore J. Stolfo
kb-is-example-of: Firmware Embedded Monitoring Code
kb-organization: Red Balloon Security, Inc
kb-reference-title: Method and apparatus for securing embedded device firmware

Reference - Firmware Embedded Monitoring Code Symbiotes
type: Academic Paper Reference
type: NamedIndividual
has-link: http://nsl.cs.columbia.edu/projects/minestrone/papers/Symbiotes.pdf
kb-abstract: A large number of embedded devices on the internet, such as routers and VOIP phones, are typically ripe for exploitation. Little to no defensive technology, such as AV scanners or IDS’s, are available to protect these devices. We propose a host-based defense mechanism, which we call Symbiotic Embedded Machines (SEM), that is specifically designed to inject intrusion detection functionality into the firmware of the device.
kb-author: Ang Cui, Salvatore J. Stolfo
kb-is-example-of: Firmware Embedded Monitoring Code
kb-organization: Department of Computer Science Columbia University
kb-reference-title: Defending Embedded Systems with Software Symbiotes

Reference - Firmware Verification Eclypsium
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20200074086A1/en
kb-abstract: Systems and methods are provided herein for monitoring and identifying potential security vulnerabilities in hardware and / or firmware of host devices .
kb-author: Yuriy Bulygin, Oleksandr Bazhaniuk
kb-is-example-of: Firmware Verification
kb-organization: ECLYPSIUM , Inc
kb-reference-title: Methods and systems for hardware and firmware security monitoring

Reference - Firmware Verification Trapezoid
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9674183B2/en
kb-abstract: A trust control management method for security, operable on a computer system generates a unique Trust ID value by combining user-defined values with hardware-specific values associated with the user's computer system and storing the Trust ID value in a memory register physically associated with the hardware of the computer system.
kb-author: Michael J. Dyer, Jose E. Gonzalez, Albert Caballero
kb-is-example-of: Firmware Verification
kb-organization: Trapezoid, Inc
kb-reference-title: System and method for hardware-based trust control management

Reference - Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20200004962A1/en
kb-abstract: A stackable filesystem that transparently tracks process file writes for forensic analysis. The filesystem comprises a base filesystem, and an overlay filesystem. Processes see the union of the upper and lower filesystems, but process writes are only reflected in the overlay. By providing per-process views of the filesystem using this stackable approach, a forensic analyzer can record a process's file-based activity—i.e., file creation, deletion, modification. These activities are then analyzed to identify indicators of compromise (IoCs). These indicators are then fed into a forensics analysis engine, which then quickly decides whether a subject (e.g., process, user) is malicious. If so, the system takes some proactive action to alert a proper authority, to quarantine the potential attack, or to provide other remediation. The approach enables forensic analysis without requiring file access mediation, or conducting system event-level collection and analysis, making it a lightweight, and non-intrusive solution.
kb-author: Frederico Araujo; Anne E. Kohlbrenner; Marc Philippe Stoecklin; Teryl Paul Taylor
kb-reference-title: Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views

Reference - Identifying a denial-of-service attack in a cloud-based proxy service - Cloudfare Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8613089B1
kb-abstract: A cloud-based proxy service identifies a denial-of-service (DoS) attack including determining that there is a potential DoS attack being directed to an IP address of the cloud-based proxy service; and responsive to determining that there are a plurality of domains that resolve to that IP address, identifying the one of the plurality of domains that is the target of the DoS attack. The domain that is under attack is identified by scattering the plurality of domains to resolve to different IP addresses, where a result of the scattering is that each of those domains resolves to a different IP address, and identifying one of those plurality of domains as the target of the DoS attack by determining that there is an abnormally high amount of traffic being directed to the IP address in which that domain resolves.
kb-author: Lee Hahn Holloway, Srikanth N. Rao, Matthew Browning Prince, Matthieu Philippe François Tourne, Ian Gerald Pye, Ray Raymond Bejjani, Terry Paul Rodery, Jr.
kb-is-example-of: Inbound Session Volume Analysis
kb-organization: Cloudfare Inc.
kb-reference-title: Identifying a denial-of-service attack in a cloud-based proxy service

Reference - Indirect Branching Calls
type: Academic Paper Reference
type: NamedIndividual
has-link: https://citeseerx.ist.psu.edu/viewdoc/download
kb-abstract: Return-oriented programming (ROP) has become the primary exploitation technique for system compromise in the presence of non-executable page protections. ROP exploits are facilitated mainly by the lack of complete address space randomization coverage or the presence of memory disclosure vulnerabilities, necessitating additional ROP-specific mitigations. In this paper we present a practical runtime ROP exploit prevention technique for the protection of thirdparty applications. Our approach is based on the detection of abnormal control transfers that take place during ROP code execution. This is achieved using hardware features of commodity processors, which incur negligible runtime overhead and allow for completely transparent operation without requiring any modifications to the protected applications. Our implementation for Windows 7, named kBouncer, can be selectively enabled for installed programs in the same fashion as user-friendly mitigation toolkits like Microsoft’s EMET. The results of our evaluation demonstrate that kBouncer has low runtime overhead of up to 4%, when stressed with specially crafted workloads that continuously trigger its core detection component, while it has negligible overhead for actual user applications. In our experiments with in-thewild ROP exploits, kBouncer successfully protected all tested applications, including Internet Explorer, Adobe Flash Player, and Adobe Reader.
kb-author: Vasilis Pappas, Michalis Polychronakis, Angelos D. Keromytis Columbia University
kb-is-example-of: Indirect Branch Call Analysis
kb-organization: Columbia University
kb-reference-title: Transparent ROP Exploit Mitigation using Indirect Branch Tracing

Reference - Method and system for providing software updates to local machines
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10474448B2/en
kb-author: John Melton Reynolds
kb-organization: Sophos Ltd
kb-reference-title: Method and system for providing software updates to local machines

Reference - Method and system for UDP flood attack detection - Riorey LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8307430B1
kb-abstract: A system and method is provided to identify UDP attacks. A processor determines a spectral density of packet timing intervals, a natural distance between the spectral density and a uniform distribution, and a non-linear amplifier applying a non-linear amplification to the natural distance to detect a denial-of-service attack. It uses the concept of traffic statistics analysis, i.e., spectral densities of arrived-packet timing intervals, calculates the KL-distance measurement and makes decision based on the output of a non-linear Gaussian amplifier, with which one can easily adjust the amplifier via selecting different parameters of mean and variance to satisfy system requirements of false-positive and false-negative UDP attack detections.
kb-author: Hongda Chen, Lijin Lu
kb-is-example-of: Inbound Session Volume Analysis
kb-reference-title: Method and system for UDP flood attack detection

Reference - Munin
type: Source Code Reference
type: NamedIndividual
has-link: https://github.com/Neo23x0/munin
kb-author: Florian Roth
kb-reference-title: Online Hash Checker for Virustotal and Other Services

Reference - OS Query Windows User Collection Code
type: NamedIndividual
has-link: https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/tables/system/windows/users.cpp
kb-reference-title: OS Query Windows User Collection Code

Reference - Pointer Authentication on ARMv8.3
type: Specification Reference
type: NamedIndividual
has-link: https://www.qualcomm.com/media/documents/files/whitepaper-pointer-authentication-on-armv8-3.pdf
kb-abstract: The pointer authentication scheme introduced by ARM is a software security primitive that makes it much harder for an attacker to modify protected pointers in memory without being detected. In this document, we will provide more details about the Pointer Authentication mechanism, provide a security analysis, and discuss the implementation of certain software security countermeasures, such as stack protection and control flow integrity, using the Pointer Authentication primitives.
kb-author: Qualcomm Technologies, Inc
kb-is-example-of: Pointer Authentication
kb-organization: Qualcomm Technologies, Inc
kb-reference-title: Pointer Authentication on ARMv8.3

Reference - Pointer Authentication Project Zero
type: Internet Article Reference
type: NamedIndividual
has-link: https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html
kb-abstract: In this post I examine Apple's implementation of Pointer Authentication on the A12 SoC used in the iPhone XS, with a focus on how Apple has improved over the ARM standard. I then demonstrate a way to use an arbitrary kernel read/write primitive to forge kernel PAC signatures for the A keys, which is sufficient to execute arbitrary code in the kernel using JOP. The technique I discovered was (mostly) fixed in iOS 12.1.3. In fact, this fix first appeared in the 16D5032a beta while my research was still ongoing.
kb-author: Brandon Azad
kb-is-example-of: Pointer Authentication
kb-organization: Project Zero, Google, Inc
kb-reference-title: Examining Pointer Authentication on the iPhone XS

Reference - Privacy and security systems and methods of use
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10128890B2/en
kb-author: Teddy David Thomas
kb-reference-title: Privacy and security systems and methods of use

Reference - Protecting against distributed denial of service attacks - Cisco Technology Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7171683B2
kb-abstract: A method for authenticating packet communication traffic includes receiving a data packet sent over a network from a source address to a destination address and reading from the packet a value of a field that is indicative of a number of hops traversed by the packet since having been sent from the source address. The authenticity of the source address is assessed responsive to the value.
kb-author: Guy Pazi, Anat Bremler-Bar, Rami Rivlin, Dan Touitou
kb-is-example-of: Inbound Session Volume Analysis
kb-organization: Cisco Technologies Inc.
kb-reference-title: Protecting against distributed denial of service attacks

Reference - Protecting against distributed network flood attacks - Juniper Networks Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8789173B2
kb-abstract: A network security device performs a three-stage analysis of traffic to identify malicious clients. In one example, a device includes an attack detection module to, during a first stage, monitor network connections to a protected network device, during a second stage, to monitor a plurality of types of transactions for the plurality of network sessions when a parameter for the connections exceeds a connection threshold, and during a third stage, to monitor communications associated with network addresses from which transactions of the at least one of type of transactions originate when a parameter associated with the at least one type of transactions exceeds a transaction-type threshold. The device executes a programmed action with respect to at least one of the network addresses when the transactions of the at least one of the plurality of types of transactions originating from the at least one network address exceeds a client-transaction threshold.
kb-author: Krishna Narayanaswamy, Bryan Burns, Venkata Rama Raju Manthena
kb-is-example-of: Inbound Session Volume Analysis
kb-organization: Juniper Networks Inc.
kb-reference-title: Protecting against distributed network flood attacks

Reference - RFC 2289 - A One-Time Password System
type: Specification Reference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc2289
kb-is-example-of: One-time Password
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-title: A One-Time Password System

Reference - RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email – IETF
type: Specification Reference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc7208
kb-abstract: Email on the Internet can be forged in a number of ways. In particular, existing protocols place no restriction on what a sending host can use as the "MAIL FROM" of a message or the domain given on the SMTP HELO/EHLO commands. This document describes version 1 of the Sender Policy Framework (SPF) protocol, whereby Administrative Management Domains (ADMDs) can explicitly authorize the hosts that are allowed to use their domain names, and a receiving host can check such authorization.
kb-author: S. Kitterman
kb-is-example-of: Transfer Agent Authentication
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-title: RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email

Reference - Security Architecture for the Internet Protocol
type: Specification Reference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc1825
kb-abstract: This memo describes the security mechanisms for IP version 4 (IPv4) and IP version 6 (IPv6) and the services that they provide. Each security mechanism is specified in a separate document. This document also describes key management requirements for systems implementing those security mechanisms. This document is not an overall Security Architecture for the Internet and is instead focused on IP-layer security.
kb-author: Randall Atkinson
kb-is-example-of: Encrypted Tunnels
kb-reference-title: Security Architecture for the Internet Protocol

Reference - StreamingPhish
type: Technique Reference
type: NamedIndividual
has-link: https://github.com/wesleyraptor/streamingphish
kb-abstract: This is a utility that uses supervised machine learning to detect phishing domains from the Certificate Transparency log network.
kb-author: Wes Connell
kb-is-example-of: Passive Certificate Analysis
kb-organization: Uber
kb-reference-title: StreamingPhish

Reference - UEFI Platform Initialization (PI) Specification
type: Specification Reference
type: NamedIndividual
has-link: https://uefi.org/sites/default/files/resources/PI_Spec_1_7_A_final_May1.pdf
kb-is-example-of: Bootloader Authentication
kb-reference-title: UEFI Platform Initialization (PI) Specification

Reference - /DYNAMICBASE (Use address space layout randomization) - Microsoft Docs
type: User Manual Reference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/cpp/build/reference/dynamicbase-use-address-space-layout-randomization
kb-author: Microsoft
kb-is-example-of: Segment Address Offset Randomization
kb-organization: Microsoft
kb-reference-title: /DYNAMICBASE (Use address space layout randomization)

Reference - /GS (Buffer Security Check) - Microsoft Docs
type: User Manual Reference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/cpp/build/reference/gs-buffer-security-check
kb-is-example-of: Stack Frame Canary Verification
kb-organization: Microsoft Docs
kb-reference-title: /GS (Buffer Security Check)

Reference - /SAFESEH (Image has Safe Exception Handlers) - Microsoft Docs
type: User Manual Reference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers
kb-abstract: When /SAFESEH is specified, the linker will only produce an image if it can also produce a table of the image's safe exception handlers. This table specifies for the operating system which exception handlers are valid for the image.
kb-author: Mike Blome, Saisang Cai, Colin Robertson, Mike Jones, NextTurn, Gordon Hogenson
kb-is-example-of: Exception Handler Pointer Validation
kb-organization: Microsoft
kb-reference-title: /SAFESEH (Image has Safe Exception Handlers)

Reference - Account monitoring - Forescout Technologies
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190205511A1
kb-abstract: Systems, methods, and related technologies for account access monitoring are described. In certain aspects, a login request associated with a device can be analyzed and a score determined. The score and a threshold can be used to determine whether to initiate an action.
kb-author: Chunhui Zhan, Siying Yang
kb-is-example-of: Account Locking
kb-organization: Forescout Technologies
kb-reference-title: Account monitoring

Reference - Active firewall system and methodology - McAfee LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US6550012B1
kb-abstract: System and methodology providing automated or “proactive” network security (“active” firewall) are described. The system implements methodology for verifying or authenticating communications, especially between network security components thereby allowing those components to share information. In one embodiment, a system implementing an active firewall is provided which includes methodology for verifying or authenticating communications between network components (e.g., sensor(s), arbiter, and actor(s)), using cryptographic keys or digital certificates. Certificates may be used to digitally sign a message or file and, in a complementary manner, to verify a digital signature. At the outset, particular software components that may participate in authenticated communication are specified, including creating a digital certificate for each such software component. Upon detection by a sensor that an event of interest that has occurred in the computer network system, the system may initiate authenticated communication between the sensor component and a central arbiter (e.g., “event orchestrator”) component, so that the sensor may report the event to the arbiter or “brain.” Thereafter, the arbiter (if it chooses to act on that information) initiates authenticated communication between itself and a third software component, an “actor” component (e.g., “firewall”). The arbiter may indicate to the actor how it should handle the event. The actor or firewall, upon receiving the information, may now undertake appropriate action, such as dynamically creating or modifying rules for appropriately handling the event, or it may choose to simply ignore the information.
kb-author: Emilio Villa, Adrian Zidaritz, Michael David Varga, Gerhard Eschelbeck, Michael Kevin Jones, Mark James McArdle
kb-is-example-of: Inbound Traffic Filtering
kb-organization: McAfee LLC
kb-reference-title: Active firewall system and methodology

Reference - Analysis of the Windows Vista Security Model - Symantec Corporation
type: Academic Paper Reference
type: NamedIndividual
has-link: https://web.archive.org/web/20140407025337/http://www.symantec.com/avcenter/reference/Windows_Vista_Security_Model_Analysis.pdf
kb-abstract: This paper provides an in-depth technical assessment of the security improvements implemented in Windows Vista, focusing primarily on the areas of User Account Protection and User Interface Privilege Isolation. This paper discusses these features and touches on several of their shortcomings. It then demonstrates how it is possible to combine these attacks to gain full control over the machine from low integrity, low privilege process.
kb-author: Matthew Conover
kb-is-example-of: Mandatory Access Control
kb-organization: Symantec Corporation
kb-reference-title: Analysis of the Windows Vista Security Model

Reference - Anomaly Detection Using Adaptive Behavioral Profiles - Securonix Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160226901A1
kb-abstract: The invention provides a system and method for automatic creation of adaptive behavioral profiles for observables associated with resource states and events in a computer network (IT) infrastructure of an enterprise and for detecting anomalies that represent potential malicious activity and threats as deviations from normal behavior. Separate profiles may be created for each behavioral indicator, as well as for each time series of measurements, and aggregated to create an overall behavioral profile. An anomaly probability is determined from the behavioral profile and used to evaluate the data values of observables. Outlier data values which deviate from normal behavior by more than a predetermined probability threshold are identified for risk analysis as possible threats while inliers within the range of normal behavior are used to update the behavioral profile. Behavioral profiles are created for behavioral indicators based upon observables measured over predetermined time periods using algorithms employing statistical analysis approaches that work for any type of data distribution, and profiles are adapted over time using data aging to more closely represent current behavior. Algorithm parameters for creating profiles are based on the type of data, i.e., its metadata.
kb-author: Igor A. Baikalov; Tanuj Gulati; Sachin Nayyar; Anjaneya Shenoy; Ganpatrao H. Patwardhan
kb-is-example-of: Job Function Access Pattern Analysis
kb-mitre-analysis: The patent describes a technique for detecting anomalous activity within an organization's IT infrastructure to identify threats. Behavioral profiles can be grouped by peer groups that identify functionally similar groups of actors (users or resources) based on their attributes and pre-defined grouping rules. For example, users can be grouped by their job title, organizational hierarchy, or location and can be observed for similarities in access patterns, based on granted access entitlements or actual logged resource access. Behavioral profiles are created from measurements of events over a time period for example: * Transaction counts * Concurrent users per hour * Daily volume of data Outlier data values which deviate from behavioral profile by more than a predetermined probability threshold are identified for risk analysis as possible threats.
kb-organization: Securonix Inc
kb-reference-title: Anomaly Detection Using Adaptive Behavioral Profiles

Reference - Anti-tamper system with self-adjusting guards - ARXAN TECHNOLOGIES Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150052603A1
kb-abstract: An anti-tamper system is disclosed that includes self-adjusting guards inserted in software. Self-adjusting guards include invocation criteria and guard function. During run-time, each time the self-adjusting guard is invoked, the invocation criteria is evaluated and the guard function is only executed if the invocation criteria is satisfied. The invocation criteria can be static or dynamic, satisfied randomly with fixed or varying probability, a monotonically or exponentially decreasing function or most any other type of function. The invocation criteria can be satisfied based on elapsed inter-guard invocation time (time since last guard function execution), target inter-guard invocation time, and/or guard execution time. A method is disclosed of inserting self-adjusting guards into software, and executing the software. Evaluating the invocation criteria can include adjusting the invocation criteria when satisfied. The self-adjusting guards can be inserted into the software at a source or object code level.
kb-author: Kevin Dale Morgan
kb-is-example-of: Process Code Segment Verification
kb-organization: ARXAN TECHNOLOGIES Inc
kb-reference-title: Anti-tamper system with self-adjusting guards

Reference - Approaches for securing an internet endpoint using fine-grained operating system virtualization - Bromium, Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20110296412A1
kb-abstract: Approaches for executing untrusted software on a client without compromising the client using micro-virtualization to execute untrusted software in isolated contexts. A template for instantiating a virtual machine on a client is identified in response to receiving a request to execute an application. After the template is identified, without human intervention, a virtual machine is instantiated, using the template, in which the application is to be executed. The template may be selected from a plurality of templates based on the nature of the request, as each template describe characteristics of a virtual machine suitable for a different type of activity. Selected resources such as files are displayed to the virtual machines according to user and organization policies and controls. When the client determines that the application has ceased to execute, the client ceases execution of the virtual machine without human intervention.
kb-author: Gaurav Banga, Ian Pratt, Kiran Bondalapati, Vikram Kapoor
kb-is-example-of: Hardware-based Process Isolation
kb-organization: Bromium, Inc.
kb-reference-title: Approaches for securing an internet endpoint using fine-grained operating system virtualization

Reference - Architecture of transparent network security for application containers - Neuvector Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170093922A1
kb-abstract: A system comprises one or more application containers, each application container including computer-readable instructions and initiated via a container service and isolated using operating system-level virtualization. The system also comprises one or more virtual switches configured to route traffic from the application containers. The system further comprises one or more security containers, each security container configured to transparently intercept traffic from the one or more application containers for analysis of network security. The system further comprises a user interface (UI) container configured to receive configuration settings from a user. The system also comprises an analytics container configured to perform analysis on data received from the one or more security containers. The system also comprises a management container configured to configure settings for the one or more security containers and the analytics container.
kb-author: Gang Duan
kb-is-example-of: Mandatory Access Control
kb-organization: Neuvector Inc
kb-reference-title: Architecture of transparent network security for application containers

Reference - Automatically generating network resource groups and assigning customized decoy policies thereto - Illusive Networks Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170310689A1
kb-abstract: A cyber security system comprising circuitry of a decoy deployer planting one or more decoy lateral attack vectors in each of a first and a second group of resources within a common enterprise network of resources, the first and second groups of resources having different characteristics in terms of subnets, naming conventions, DNS aliases, listening ports, users and their privileges, and installed applications, wherein a lateral attack vector is an object of a first resource within the network that has a potential to be used by an attacker who discovered the first resource to further discover information regarding a second resource within the network, the second resource being previously undiscovered by the attacker, and wherein the decoy lateral attack vectors in the first group conform to the characteristics of the first group, and the decoy lateral attack vectors in the second group conform to the characteristics of the second group.
kb-author: Shlomo Touboul; Hanan Levin; Stephane Roubach; Assaf Mischari; Itai Ben David; Itay Avraham; Adi Ozer; Chen Kazaz; Ofer Israeli; Olga Vingurt; Liad Gareh; Israel Grimberg; Cobby Cohen; Sharon Sultan; Matan Kubovsky
kb-is-example-of: Decoy Network Resource
kb-organization: Illusive Networks Ltd
kb-reference-title: Automatically generating network resource groups and assigning customized decoy policies thereto

Reference - Broadcast isolation and level 3 network switch - Hewlett Packard Enterprise Development LP
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5920699A
kb-abstract: A network switch comprising a switching Application Specific Integrated Circuit (ASIC) and a Virtual Switching Engine (VSE) connected to a plurality of ports. The switching ASIC has a high-speed memory table which enables it to look up addresses that it has previously obtained and to forward unicast packets to said addresses. The VSE is a CPU that makes switching decisions outside of the ASIC and keeps track of any unknown addresses, forwarding the packets out the appropriate ports and answers broadcast packets by proxy for all known addresses without forwarding any of the packets down the VLANs, thereby freeing the VLAN bandwidth from excessive traffic. The system requires no user configuration because the switching methodology is self-adaptive to the network in which it is inserted and has the ability to perform router functions such as level 2 and 3 switching, spanning tree protocols and compatibility with Internetwork Packet and Internetwork Packet Exchange networks.
kb-author: Ballard C. Bare
kb-is-example-of: Broadcast Domain Isolation
kb-organization: Hewlett Packard Enterprise Development LP
kb-reference-title: Broadcast isolation and level 3 network switch

Reference - CAR-2013-01-002: Autorun Differences -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-01-002/
kb-abstract: The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired. Utilizes the Sysinternals autoruns tool (ignoring validated Microsoft entries). Primarily not a detection analytic by itself but through analysis of results by an analyst can be used for such. Building another analytic on top of this one identifying unusual entries would likely be a beneficial alternative.
kb-author: MITRE
kb-is-example-of: System File Analysis
kb-organization: MITRE
kb-reference-title: CAR-2013-01-002: Autorun Differences

Reference - CAR-2013-01-003: SMB Events Monitoring -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-01-003/
kb-abstract: Server Message Block (SMB) is used by Windows to allow for file, pipe, and printer sharing over port 445/tcp. It allows for enumerating, and reading from and writing to file shares for a remote computer. Although it is heavily used by Windows servers for legitimate purposes and by users for file and printer sharing, many adversaries also use SMB to achieve Lateral Movement. Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise. Output Description: The source, destination, content, and time of each event.
kb-author: MITRE
kb-is-example-of: IPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2013-01-003: SMB Events Monitoring

Reference - CAR-2013-02-003: Processes Spawning cmd.exe -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-02-003/
kb-abstract: The Windows Command Prompt (cmd.exe) is a utility that provides a command line interface to Windows operating systems. It provides the ability to run additional programs and also has several built-in commands such as dir, copy, mkdir, and type, as well as batch scripts (.bat). Typically, when a user runs a command prompt, the parent process is explorer.exe or another instance of the prompt. There may be automated programs, logon scripts, or administrative tools that launch instances of the command prompt in order to run scripts or other built-in commands. Spawning the process cmd.exe from certain parents may be more indicative of malice. For example, if Adobe Reader or Outlook launches a command shell, this may suggest that a malicious document has been loaded and should be investigated. Thus, by looking for abnormal parent processes of cmd.exe, it may be possible to detect adversaries.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2013-02-003: Processes Spawning cmd.exe

Reference - CAR-2013-02-008: Simultaneous Logins on a Host - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-02-008/
kb-abstract: Multiple users logged into a single machine at the same time, or even within the same hour, do not typically occur in networks we have observed. Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista. Logon types 2, 3, 9 and 10 are of interest. For more details see the Logon Types table on Microsoft’s Audit Logon Events page.
kb-author: MITRE
kb-is-example-of: Authentication Event Thresholding
kb-organization: MITRE
kb-reference-title: CAR-2013-02-008: Simultaneous Logins on a Host

Reference - CAR-2013-03-001: Reg.exe called from Command Shell - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-03-001/
kb-abstract: Registry modifications are often essential in establishing persistence via known Windows mechanisms. Many legitimate modifications are done graphically via regedit.exe or by using the corresponding channels, or even calling the Registry APIs directly. The built-in utility reg.exe provides a command-line interface to the registry, so that queries and modifications can be performed from a shell, such as cmd.exe. When a user is responsible for these actions, the parent of cmd.exe will likely be explorer.exe. Occasionally, power users and administrators write scripts that do this behavior as well, but likely from a different process tree. These background scripts must be learned so they can be tuned out accordingly.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2013-03-001: Reg.exe called from Command Shell

Reference - CAR-2013-04-002: Quick execution of a series of suspicious commands - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-04-002/
kb-abstract: Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2013-04-002: Quick execution of a series of suspicious commands

Reference - CAR-2013-05-002: Suspicious Run Locations -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-002/
kb-abstract: In Windows, files should never execute out of certain directory locations. Any of these locations may exist for a variety of reasons, and executables may be present in the directory but should not execute. As a result, some defenders make the mistake of ignoring these directories and assuming that a process will never run from one. There are known TTPs that have taken advantage of this fact to go undetected. This fact should inform defenders to monitor these directories more closely, knowing that they should never contain running processes.
kb-is-example-of: Process Lineage Analysis
kb-reference-title: CAR-2013-05-002: Suspicious Run Locations

Reference - CAR-2013-05-003: SMB Write Request -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-003/
kb-abstract: As described in CAR-2013-01-003, SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files. It may be used for staging in Exfiltration or as a Lateral Movement technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files.
kb-is-example-of: IPC Traffic Analysis
kb-reference-title: CAR-2013-05-003: SMB Write Request

Reference - CAR-2013-05-004: Execution with AT -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-004/
kb-abstract: In order to gain persistence, privilege escalation, or remote execution, an adversary may use the Windows built-in command AT (at.exe) to schedule a command to be run at a specified time, date, and even host. This method has been used by adversaries and administrators alike. Its use may lead to detection of compromised hosts and compromised users if it is used to move laterally. The built-in Windows tool schtasks.exe (CAR-2013-08-001) offers greater flexibility when creating, modifying, and enumerating tasks. For these reasons, schtasks.exe is more commonly used by administrators, tools/scripts, and power users.
kb-is-example-of: Scheduled Job Analysis
kb-reference-title: CAR-2013-05-004: Execution with AT

Reference - CAR-2013-07-001: Suspicious Arguments -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-07-001/
kb-abstract: Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.
kb-is-example-of: Process Spawn Analysis
kb-reference-title: CAR-2013-07-001: Suspicious Arguments

Reference - CAR-2013-07-002: RDP Connection Detection - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-07-002
kb-abstract: The Remote Desktop Protocol (RDP), built in to Microsoft operating systems, allows a user to remotely log in to the desktop of another host. It allows for interactive access of the running windows, and forwards key presses, mouse clicks, etc. Network administrators, power users, and end-users may use RDP for day-to-day operations. From an adversary’s perspective, RDP provides a means to laterally move to a new host. Determining which RDP connections correspond to adversary activity can be a difficult problem in highly dynamic environments, but will be useful in identifying the scope of a compromise.
kb-author: MITRE
kb-is-example-of: Remote Terminal Session Detection
kb-organization: MITRE
kb-reference-title: CAR-2013-07-002: RDP Connection Detection

Reference - CAR-2013-07-005: Command Line Usage of Archiving Software -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-07-005/
kb-abstract: Before exfiltrating data that an adversary has collected, it is very likely that a compressed archive will be created, so that transfer times are minimized and fewer files are transmitted. There is variety between the tools used to compress data, but the command line usage and context of archiving tools, such as ZIP, RAR, and 7ZIP, should be monitored. In addition to looking for RAR or 7z program names, command line usage of 7Zip or RAR can be detected with the flag usage of “\* a \*”. This is helpful, as adversaries may change program names.
kb-is-example-of: Process Spawn Analysis
kb-reference-title: CAR-2013-07-005: Command Line Usage of Archiving Software

Reference - CAR-2013-08-001: Execution with schtasks -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-08-001/
kb-abstract: The Windows built-in tool schtasks.exe provides the creation, modification, and running of scheduled tasks on a local or remote computer. It is provided as a more flexible alternative to at.exe, described in CAR-2013-05-004. Although used by adversaries, the tool is also legitimately used by administrators, scripts, and software configurations. The scheduled tasks tool can be used to gain Persistence and can be used in combination with a Lateral Movement technique to remotely gain execution. Additionally, the command has parameters to specify the user and password responsible for creating the task, as well as the user and password combination that the task will run as. The /s flag will cause a task to run as the SYSTEM user, usually indicating privilege escalation.
kb-is-example-of: Scheduled Job Analysis
kb-reference-title: CAR-2013-08-001: Execution with schtasks

Reference - CAR-2013-09-005: Service Outlier Executables -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-09-005/
kb-abstract: New executables that are started as a service are suspicious. This analytic looks for anomalous service executables.
kb-is-example-of: Process Lineage Analysis
kb-reference-title: CAR-2013-09-005: Service Outlier Executables

Reference - CAR-2013-10-001: User Login Activity Monitoring - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-10-001/
kb-abstract: Monitoring logon and logoff events for hosts on the network is very important for situational awareness. This information can be used as an indicator of unusual activity as well as to corroborate activity seen elsewhere. Could be applied to a number of different types of monitoring depending on what information is desired. Some use cases include monitoring for all remote connections and building login timelines for users. Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista.
kb-author: MITRE
kb-is-example-of: Authentication Event Thresholding
kb-organization: MITRE
kb-reference-title: CAR-2013-10-001: User Login Activity Monitoring

Reference - CAR-2013-10-002: DLL Injection via Load Library - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-10-002/
kb-abstract: Microsoft Windows allows for processes to remotely create threads within other processes of the same privilege level. This functionality is provided via the Windows API CreateRemoteThread. Both Windows and third-party software use this ability for legitimate purposes. For example, the Windows process csrss.exe creates threads in programs to send signals to registered callback routines. Both adversaries and host-based security software use this functionality to inject DLLs, but for very different purposes. An adversary is likely to inject into a program to evade defenses or bypass User Account Control, but a security program might do this to gain increased monitoring of API calls. One of the most common methods of DLL Injection is through the Windows API LoadLibrary. Allocate memory in the target program with VirtualAllocEx Write the name of the DLL to inject into this program with WriteProcessMemory Create a new thread and set its entry point to LoadLibrary using the API CreateRemoteThread. This behavior can be detected by looking for thread creations across processes, and resolving the entry point to determine the function name. If the function is LoadLibraryA or LoadLibraryW, then the intent of the remote thread is clearly to inject a DLL. When this is the case, the source process must be examined so that it can be ignored when it is both expected and a trusted process.
kb-author: MITRE
kb-organization: MITRE
kb-reference-title: CAR-2013-10-002: DLL Injection via Load Library

Reference - CAR-2014-02-001: Service Binary Modifications - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-02-001/
kb-abstract: Adversaries may modify the binary file for an existing service to achieve Persistence while potentially evading defenses. If a newly created or modified runs as a service, it may indicate APT activity. However, services are frequently installed by legitimate software. A well-tuned baseline is essential to differentiating between benign and malicious service modifications.
kb-author: MITRE
kb-is-example-of: Service Binary Verification
kb-organization: MITRE
kb-reference-title: CAR-2014-02-001: Service Binary Modifications

Reference - CAR-2014-03-005: Remotely Launched Executables via Services - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-03-005/
kb-abstract: There are several ways to cause code to execute on a remote host. One of the most common methods is via the Windows Service Control Manager (SCM), which allows authorized users to remotely create and modify services. Several tools, such as PsExec, use this functionality. When a client remotely communicates with the Service Control Manager, there are two observable behaviors. First, the client connects to the RPC Endpoint Mapper over 135/tcp. This handles authentication, and tells the client what port the endpoint—in this case the SCM—is listening on. Then, the client connects directly to the listening port on services.exe. If the request is to start an existing service with a known command line, the the SCM process will run the corresponding command. This compound behavior can be detected by looking for services.exe receiving a network connection and immediately spawning a child process.
kb-author: MITRE
kb-is-example-of: RPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-03-005: Remotely Launched Executables via Services

Reference - CAR-2014-03-006: RunDLL32.exe monitoring - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-03-006/
kb-abstract: Adversaries may find it necessary to use Dyanamic-link Libraries (DLLs) to evade defenses. One way these DLLs can be “executed” is through the use of the built-in Windows utility RunDLL32, which allows a user to execute code in a DLL, providing the name and optional arguments to an exported entry point. Windows uses RunDll32 legitimately in its normal operation, but with a proper baseline and understanding of the environment, monitoring its usage could be fruitful.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-03-006: RunDLL32.exe monitoring

Reference - CAR-2014-04-003: Powershell Execution - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-04-003/
kb-abstract: PowerShell is a scripting environment included with Windows that is used by both attackers and administrators. Execution of PowerShell scripts in most Windows versions is opaque and not typically secured by antivirus which makes using PowerShell an easy way to circumvent security measures. This analytic detects execution of PowerShell scripts. Powershell can be used to hide monitored command line execution such as: * net use * sc start
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-04-003: Powershell Execution

Reference - CAR-2014-05-002: Services launching Cmd -
type: External Knowledge Base
type: NamedIndividual
kb-abstract: Windows runs the Service Control Manager (SCM) within the process services.exe. Windows launches services as independent processes or DLL loads within a svchost.exe group. To be a legitimate service, a process (or DLL) must have the appropriate service entry point SvcMain. If an application does not have the entry point, then it will timeout (default is 30 seconds) and the process will be killed. To survive the timeout, adversaries and red teams can create services that direct to cmd.exe with the flag /c, followed by the desired command. The /c flag causes the command shell to run a command and immediately exit. As a result, the desired program will remain running and it will report an error starting the service. This analytic will catch that command prompt instance that is used to launch the actual malicious executable. Additionally, the children and descendants of services.exe will run as a SYSTEM user by default. Thus, services are a convenient way for an adversary to gain Persistence and Privilege Escalation.
kb-is-example-of: Process Lineage Analysis
kb-reference-title: CAR-2014-05-002: Services launching Cmd

Reference - CAR-2014-07-001: Service Search Path Interception - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-07-001/
kb-abstract: According to ATT&CK, an adversary may escalate privileges by intercepting the search path for legitimately installed services. As a result, Windows will launch the target executable instead of the desired binary and command line. This can be done when there are spaces in the binary path and the path is unquoted. Search path interception should never happen legitimately and will likely be the result of an adversary abusing a system misconfiguration. With a few regular expressions, it is possible to identify the execution of services with intercepted search paths.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-07-001: Service Search Path Interception

Reference - CAR-2014-11-002: Outlier Parents of Cmd - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-002/
kb-abstract: Many programs create command prompts as part of their normal operation including malware used by attackers. This analytic attempts to identify suspicious programs spawning cmd.exe by looking for programs that do not normally create cmd.exe. While this analytic does not take the user into account, doing so could generate further interesting results. It is very common for some programs to spawn cmd.exe as a subprocess, for example to run batch files or windows commands. However many process don’t routinely launch a command prompt – for example Microsoft Outlook. A command prompt being launched from a process that normally doesn’t launch command prompts could be the result of malicious code being injected into that process, or of an attacker replacing a legitimate program with a malicious one.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-11-002: Outlier Parents of Cmd

Reference - CAR-2014-11-003: Debuggers for Accessibility Applications -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-003/
kb-abstract: The Windows Registry location HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options allows for parameters to be set for applications during execution. One feature used by malicious actors is the “Debugger” option. When a key has this value enabled, a Debugging command line can be specified. Windows will launch the Debugging command line, and pass the original command line in as an argument. Adversaries can set a Debugger for Accessibility Applications. The analytic looks for the original command line as an argument to the Debugger. When the strings “sethc.exe”, “utilman.exe”, “osk.exe”, “narrator.exe”, and “Magnify.exe” are detected in the arguments, but not as the main executable, it is very likely that a Debugger is set. This analytic could depend on the possibility of the known strings used as arguments for other applications used in the day-to-day environment. Although the chance of the string “sethc.exe” being used as an argument for another application is unlikely, it still is a possibility.
kb-is-example-of: Process Spawn Analysis
kb-reference-title: CAR-2014-11-003: Debuggers for Accessibility Applications

Reference - CAR-2014-11-003: Debuggers for Accessibility Applications - MITRE
type: External Knowledge Base
type: NamedIndividual
kb-abstract: The Windows Registry location HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options allows for parameters to be set for applications during execution. One feature used by malicious actors is the “Debugger” option. When a key has this value enabled, a Debugging command line can be specified. Windows will launch the Debugging command line, and pass the original command line in as an argument. Adversaries can set a Debugger for Accessibility Applications. The analytic looks for the original command line as an argument to the Debugger. When the strings “sethc.exe”, “utilman.exe”, “osk.exe”, “narrator.exe”, and “Magnify.exe” are detected in the arguments, but not as the main executable, it is very likely that a Debugger is set. This analytic could depend on the possibility of the known strings used as arguments for other applications used in the day-to-day environment. Although the chance of the string “sethc.exe” being used as an argument for another application is unlikely, it still is a possibility.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-11-003: Debuggers for Accessibility Applications

Reference - CAR-2014-11-005: Remote Registry - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-005/
kb-abstract: An adversary can remotely manipulate the registry of another machine if the RemoteRegistry service is enabled and valid credentials are obtained. While the registry is remotely accessed, it can be used to prepare a Lateral Movement technique, discover the configuration of a host, achieve Persistence, or anything that aids an adversary in achieving the mission. Like most ATT&CK techniques, this behavior can be used legitimately, and the reliability of an analytic depends on the proper identification of the pre-existing legitimate behaviors. Although this behavior is disabled in many Windows configurations, it is possible to remotely enable the RemoteRegistry service, which can be detected with CAR-2014-03-005. Remote access to the registry can be achieved via * Windows API function RegConnectRegistry * command line via reg.exe * graphically via regedit.exe All of these behaviors call into the Windows API, which uses the NamedPipe WINREG over SMB to handle the protocol information. This network can be decoded with wireshark or a similar sensor, and can also be detected by hooking the API function.
kb-author: MITRE
kb-is-example-of: Administrative Network Activity Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-11-005: Remote Registry

Reference - CAR-2014-11-006: Windows Remote Management (WinRM) - MITRE
type: External Knowledge Base
type: NamedIndividual
kb-author: MITRE
kb-is-example-of: Administrative Network Activity Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-11-006: Windows Remote Management (WinRM)

Reference - CAR-2014-11-007: Remote Windows Management Instrumentation (WMI) over RPC - MITRE
type: External Knowledge Base
type: NamedIndividual
kb-abstract: As described in ATT&CK, an adversary can use Windows Management Instrumentation (WMI) to view or manipulate objects on a remote host. It can be used to remotely edit configuration, start services, query files, and anything that can be done with a WMI class. When remote WMI requests are over RPC (CAR-2014-05-001), it connects to a DCOM interface within the RPC group netsvcs. To detect this activity, a sensor is needed at the network level that can decode RPC traffic or on the host where the communication can be detected more natively, such as Event Tracing for Windows. Using wireshark/tshark decoders, the WMI interfaces can be extracted so that WMI activity over RPC can be detected. Although the description details how to detect remote WMI precisely, a decent estimate has been to look for the string RPCSS within the initial RPC connection on 135/tcp. It returns a superset of this activity, and will trigger on all DCOM-related services running within RPC, which is likely to also be activity that should be detected between hosts. More about RPCSS at : rpcss_dcom_interfaces.html
kb-author: MITRE
kb-is-example-of: RPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-11-007: Remote Windows Management Instrumentation (WMI) over RPC

Reference - CAR-2014-11-008: Command Launched from WinLogon - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-008/
kb-abstract: An adversary can use accessibility features (Ease of Access), such as StickyKeys or Utilman, to launch a command shell from the logon screen and gain SYSTEM access. Since an adversary does not have physical access to the machine, this technique must be run within Remote Desktop. To prevent an adversary from getting to the login screen without first authenticating, Network-Level Authentication (NLA) must be enabled. If a debugger is set up for one of the accessibility features, then it will intercept the process launch of the feature and instead execute a new command line. This analytic looks for instances of cmd.exe or powershell.exe launched directly from the logon process, winlogon.exe. It should be used in tandem with CAR-2014-11-003, which detects the accessibility programs in the command line.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-11-008: Command Launched from WinLogon

Reference - CAR-2015-04-002: Remotely Scheduled Tasks via Schtasks - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2015-04-002/
kb-abstract: An adversary can move laterally using the schtasks command to remotely schedule tasks. Although these events can be detected with command line analytics CAR-2013-08-001, it is possible for an adversary to use the API directly, via the Task Scheduler GUI or with a scripting language such as PowerShell. In this cases, an additional source of data becomes necessary to detect adversarial behavior. When scheduled tasks are created remotely, Windows uses RPC (135/tcp) to communicate with the Task Scheduler on the remote machine. Once an RPC connection is established (CAR-2014-05-001), the client communicates with the Scheduled Tasks endpoint, which runs within the service group netsvcs. With packet capture and the right packet decoders or byte-stream based signatures, remote invocations of these functions can be identified. Certain strings can be identifiers of the schtasks, by looking up the interface UUID of ITaskSchedulerService in different formats * UUID 86d35949-83c9-4044-b424-db363231fd0c (decoded) * Hex 49 59 d3 86 c9 83 44 40 b4 24 db 36 32 31 fd 0c (raw) * ASCII IYD@$621 (printable bytes only) This identifier is present three times during the RPC request phase. Any sensor that has access to the byte code as raw, decoded, or ASCII could implement this analytic.
kb-author: MITRE
kb-is-example-of: RPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2015-04-002: Remotely Scheduled Tasks via Schtasks

Reference - CAR-2016-03-001: Host Discovery Commands - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-03-001/
kb-abstract: When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally. Because these commands are built in, they may be run frequently by power users or even by normal users. Thus, an analytic looking at this information should have well-defined white- or blacklists, and should consider looking at an anomaly detection approach, so that this information can be learned dynamically.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2016-03-001: Host Discovery Commands

Reference - CAR-2016-04-003: User Activity from Stopping Windows Defensive Services - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-003/
kb-abstract: Spyware and malware remain a serious problem and Microsoft developed security services, Windows Defender and Windows Firewall, to combat this threat. In the event Windows Defender or Windows Firewall is turned off, administrators should correct the issue immediately to prevent the possibility of infection or further infection and investigate to determine if caused by crash or user manipulation.
kb-author: MITRE
kb-is-example-of: System Daemon Monitoring
kb-organization: MITRE
kb-reference-title: CAR-2016-04-003: User Activity from Stopping Windows Defensive Services

Reference - CAR-2019-04-001: UAC Bypass - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-001/
kb-abstract: Bypassing user account control (UAC Bypass) is generally done by piggybacking on a system process that has auto-escalate privileges. This analytic looks to detect those cases as described by the open-source UACME tool.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-04-001: UAC Bypass

Reference - CAR-2019-04-002: Generic Regsvr32 - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-002/
kb-abstract: Regsvr32 can be used to execute arbitrary code in the context of a Windows signed binary, which can be used to bypass application whitelisting. This analytic looks for suspicious usage of the tool. It’s not likely that you’ll get millions of hits, but it does occur during normal activity so some form of baselining would be necessary for this to be an alerting analytic. Alternatively, it can be used for hunt by looking for new or anomalous DLLs manually.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-04-002: Generic Regsvr32

Reference - CAR-2019-04-003: Squiblydoo - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-003/
kb-abstract: Squiblydoo is a specific usage of regsvr32.dll to load a COM scriptlet directly from the internet and execute it in a way that bypasses application whitelisting. It can be seen by looking for regsvr32.exe executions that load the scrobj.dll (which execute the COM scriptlet) or, if that is too noisy, those that also load content directly via HTTP or HTTPS.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-04-003: Squiblydoo

Reference - CAR-2019-04-004: Credential Dumping via Mimikatz - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-004/
kb-abstract: Credential dumpers like Mimikatz can be loaded into memory and from there read data from another processes. This analytic looks for instances where processes are requesting specific permissions to read parts of the LSASS process in order to detect when credential dumping is occurring. One weakness is that all current implementations are “overtuned” to look for common access patterns used by Mimikatz.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-04-004: Credential Dumping via Mimikatz

Reference - CAR-2019-07-001: Access Permission Modification - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-07-001/
kb-abstract: Adversaries sometimes modify object access rights at the operating system level. There are varying motivations behind this action - they may not want some files/objects to be changed on systems for persistence reasons and therefore provide admin only rights; also, they may want files to be accessible with lower levels of permissions.
kb-author: MITRE
kb-is-example-of: System File Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-07-001: Access Permission Modification

Reference - CAR-2019-07-002: Lsass Process Dump via Procdump - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-07-002/
kb-abstract: ProcDump is a sysinternal command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. ProcDump may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching procdump.exe as a privileged user with command line options indicating that lsass.exe should be dumped to a file with an arbitrary name.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-07-002: Lsass Process Dump via Procdump

Reference - CAR-2019-08-001: Credential Dumping via Windows Task Manager - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-08-001/
kb-abstract: The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking “Create dump file”. This saves a dump file to disk with a deterministic name that includes the name of the process being dumped. This requires filesystem data to determine whether files have been created.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-08-001: Credential Dumping via Windows Task Manager

Reference - CAR-2019-08-002: Active Directory Dumping via NTDSUtil - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-08-002/
kb-abstract: The NTDSUtil tool may be used to dump a Microsoft Active Directory database to disk for processing with a credential access tool such as Mimikatz. This is performed by launching ntdsutil.exe as a privileged user with command line arguments indicating that media should be created for offline Active Directory installation and specifying a folder path. This process will create a copy of the Active Directory database, ntds.dit, to the specified folder path.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-organization: MITRE
kb-reference-title: CAR-2019-08-002: Active Directory Dumping via NTDSUtil

Reference - Computational modeling and classification of data streams - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180197089A1/en
kb-abstract: Example techniques described herein determine a signature or classification of a data stream such as a file. The classification can indicate whether the data stream is associated with malware. A processor can locate training analysis regions of training data streams based on predetermined structure data, and determining training model inputs based on the training analysis regions. The processor can determine a computational model based on the training model inputs. The computational model can receive an input vector and provide a corresponding feature vector. The processor can then locate a trial analysis region of a trial data stream based on the predetermined structure data and determine a trial model input. The processor can operate the computational model based on the trial model input to provide a trial feature vector, e.g., a signature. The processor can operate a second computational model to provide a classification based on the signature.
kb-author: Sven Krasser; David Elkind; Patrick Crenshaw; Brett Meyer
kb-is-example-of: File Content Rules
kb-mitre-analysis: Provides a mechanism to classify files using file signatures based on a computational model. Training data that comprises at least a portion of a file, e.g. number of bytes, is used as input to the computational model to develop a file signature and classify the file as malware.
kb-organization: Crowdstrike Inc
kb-reference-title: Computational modeling and classification of data streams

Reference - Computer-implemented methods and systems for identifying visually similar text character strings - Greathorn Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10320815B2/en
kb-abstract: Methods and systems are disclosed for selecting text character strings from a corpus of relevant strings that would commonly be considered to be visually similar to human viewer to an input string. The initial corpus may be any sufficiently broad or specific source of text, e.g., the names of users in a computer application system. The character strings in the corpus are classified such that direct, character-by-character comparisons may be limited to a small subset of likely-similar strings. The input string is then directly compared to strings that are likely to be similar to it, taking into account individual characters' similarities, combinations of characters that look similar to individual characters, transposition of characters, and simple additions and deletions.
kb-author: Raymond W. Wallace, III
kb-is-example-of: Homoglyph Detection
kb-mitre-analysis: Text input is compared to an engine of look-alike sets of text characters. An estimate of similar characters based on the engine is conducted, and an alert is triggered if the estimated similarity is lower than a given threshold.
kb-organization: Greathorn Inc
kb-reference-title: Computer-implemented methods and systems for identifying visually similar text character strings

Reference - Computer Worm Defense System and Method - FireEye Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20130036472A1
kb-abstract: "A computer worm defense system comprises multiple containment systems tied together by a management system. Each containment system is deployed on a separate communication network and contains a worm sensor and a blocking system. In various embodiments, the computer worm may be transported from a production network, where the computer worm is not readily identifiable, to an alternate network in the worm sensor where the computer worm may be readily identifiable. Computer worm identifiers generated by a worm sensor of one containment system can be provided not only to the blocking system of the same containment system, but can also be distributed by the management system to blocking systems of other containment systems."
kb-author: Ashar Aziz
kb-is-example-of: File Carving
kb-mitre-analysis: This patent describes network data being copied by a tap and then analyzed in an analysis environment to determine whether the network data is suspicious using a heuristic module. The analysis environment replays transmission of the suspicious network data between a configured replayer and a virtual machine to detect unauthorized activity.
kb-organization: FireEye Inc
kb-reference-title: Computer Worm Defense System and Method

Reference - Computing apparatus with automatic integrity reference generation and maintenance - Tripwire, Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20040060046A1
kb-abstract: An apparatus is equipped to automatically update one or more integrity references of a software entity, when the software entity is installed onto the apparatus. The apparatus is further equipped to periodically determine whether the integrity of the apparatus has been compromised based at least in part on the one or more integrity references of the software entity that are automatically updated during installation of the software entity.
kb-author: Thomas Good, Robert DiFalco, Gene Kim
kb-is-example-of: Executable Allowlisting
kb-organization: Tripwire, Inc.
kb-reference-title: Computing apparatus with automatic integrity reference generation and maintenance

Reference - Content extractor and analysis system - Bit 9 Inc, Carbon Black Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20070028110A1
kb-abstract: A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and unwanted software. The system can implement centralized policies that allow an administrator to approve, block, quarantine, and log file activities. The system can extract content of interest from a file container, repackage the content of interest as another valid file type, perform hashes on the content of interest, associate the hash of the container with the hash of the repackaged content, transfer the repackaged content, and store the hash with other security-related information.
kb-author: Todd Brennan
kb-is-example-of: Executable Denylisting
kb-organization: Bit 9 Inc, Carbon Black Inc
kb-reference-title: Content extractor and analysis system

Reference - Continuous authentication by analysis of keyboard typing characteristics - Bradford Univ., UK
type: Academic Paper Reference
type: NamedIndividual
has-link: https://ieeexplore.ieee.org/document/491588
kb-abstract: This paper describes a simple, software based keyboard monitoring system for the IBM PC for the continuous analysis of the typing characteristics of the user for the purpose of continuous authentication. By exploiting the electrical characteristics of the PC keyboard interface together with modifications to the internal system timer, very accurate measurements can be made of keystroke interval and duration, including measurements of rollover. Rollover patterns, particularly when typing common diphthongs, can be highly characteristic of individual users and provide quite an accurate indication of the users identity. Published in: European Convention on Security and Detection, 1995.
kb-author: S.J. Shepherd
kb-is-example-of: Input Device Analysis
kb-organization: Bradford Univ., UK
kb-reference-title: Continuous authentication by analysis of keyboard typing characteristics

Reference - DETECTING DDoS ATTACK USING Snort -
type: Academic Paper Reference
type: NamedIndividual
has-link: https://www.researchgate.net/publication/338660054_DETECTING_DDoS_ATTACK_USING_Snort
kb-abstract: A DDoS(distributed denial-of-service) attack is very common and easy toexecute and does not require any sophisticated tools. It can happen to anyone. In this project we deploy snort in our home network as a NIDS(Network Intrusion Detection System) to detect a DDoS attack and prevent it.
kb-author: Manas Gogoi, Sourav Mishra
kb-is-example-of: Inbound Session Volume Analysis
kb-organization: Indian Institute of Information Technology Allahabad
kb-reference-title: DETECTING DDoS ATTACK USING Snort

Reference - Deception-Based Responses to Security Attacks - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20140250524A1/en
kb-abstract: Deception-based techniques for responding to security attacks are described herein. The techniques include transitioning a security attack to a monitored computing device posing as a computing device impacted by the security attack and enabling the adversary to obtain deceptive information from the monitored computing device. Also, the adversary may obtain a document configured to report identifying information of an entity opening the document, thereby identifying the adversary associated with the attack. Further, the techniques include determining that a domain specified in a domain name request is associated with malicious activity and responding to the request with a network address of a monitored computing device to cause the requesting process to communicate with the monitored computing device in place of an adversary server. Additionally, a service may monitor dormant domains names associated with malicious activity and, in response to a change, respond with an alert or a configuration update.
kb-author: Adam S. Meyers; Dmitri Alperovitch; George Robert Kurtz; David F. Diehl; Sven Krasser
kb-is-example-of: Decoy Network Resource
kb-organization: Crowdstrike Inc
kb-reference-title: Deception-Based Responses to Security Attacks

Reference - Decoy and deceptive data object technology - Cymmetria, Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170134423A1
kb-abstract: A computer implemented method of detecting unauthorized access to a protected network by monitoring a dynamically updated deception environment, comprising launching, on one or more decoy endpoints, one or more decoy operating system (OS) managing one or more of a plurality of deception applications mapping a plurality of applications executed in a protected network, updating dynamically a usage indication for a plurality of deception data objects deployed in the protected network to emulate usage of the plurality of deception data objects for accessing the deception application(s) wherein the plurality of deception data objects are configured to trigger an interaction with the deception application(s) when used, detecting usage of data contained in the deception data object(s) by monitoring the interaction and identifying one or more potential unauthorized operations based on analysis of the detection. In order to convince the potential attacker that the deception environment is the real (valid) processing environment and/or part thereof, the campaign manager may construct the false identity according to the public information of the certain user that may typically be available to the potential attacker. By exposing the real (public) information of the certain user to the potential attacker, the false identity may seem consistent and legitimate to the potential attacker. For example, the campaign manager may create a false account, for example, a Facebook account of the certain user that includes the same public information that is publicly available to other Facebook users from the real (genuine) Facebook account of the certain user. The fake company account may include information specific to the role and/or job title of certain user within the company, for example, a programmer, an accountant, an IT person and/or the like.
kb-author: Dean Sysman, Gadi Evron, Imri Goldberg, Itamar Sher, Shmuel Ur
kb-is-example-of: Decoy Persona
kb-organization: Cymmetria, Inc.
kb-reference-title: Decoy and deceptive data object technology

Reference - Decoy Personas for Safeguarding Online Identity Using Deception -
type: Internet Article Reference
type: NamedIndividual
has-link: https://web.archive.org/web/20180407204216/https://isc.sans.edu/diary/Decoy+Personas+for+Safeguarding+Online+Identity+Using+Deception/16159
kb-abstract: What if online scammers weren't sure whether the user account they are targeting is really yours, or whether the information they compiled about you is real? It's worth considering whether decoy online personas might help in the quest to safeguard our digital identities and data. I believe deception tactics, such as selective and careful use of honeypots, holds promise for defending enterprise IT resources. Some forms of deception could also protect individuals against online scammers and other attackers. This approach might not be quite practical today for most people, but in the future we might find it both necessary and achievable. Human attackers and malicious software pursue user accounts and data on-line through harvesting, phishing, password-guessing, software vulnerabilities, and various other means. How might we use decoys to confuse, misdirect, slow down and detect adversaries engaged in such activities? ... The wealth of personal details available on social networking sites allows attackers to target individuals using social engineering, secret question-guessing and other techniques. For some examples of such approaches, see The Use of Fake or Fraudulent LinkedIn Profiles and Data Mining Resumes for Computer Attack Reconnaissance. Setting up one or more fake social network profiles (e.g., on Facebook) that use the person's real name can help the individual deflect the attack or can act as an early warning of an impending attack. A decoy profile could purposefully expose some inaccurate information, while the person's real profile would be more carefully concealed using the site's privacy settings. Decoy profiles would be associated with spamtrap email addresses. Similarly, the person could expose decoy profiles on other sites, for instance those reveal shopping habits (e.g., Amazon), musings (e.g., Twitter), skills (e.g., GitHub), travel (e.g., TripIt), affections (e.g., Pinterest), music taste (e.g., Pandora) and so on. The person's decoy identities coul…
kb-author: Lenny Zeltser
kb-is-example-of: Decoy Persona
kb-organization: SANS
kb-reference-title: Decoy Personas for Safeguarding Online Identity Using Deception

Reference - Detecting network reconnaissance by tracking intranet dark-net communications - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150264078A1
kb-abstract: A method and system for detecting network reconnaissance is disclosed wherein network traffic can be parsed into unidirectional flows that correspond to sessions. A learning module may categorize computing entities inside the network into assets and generate asset data to monitor the computing entities. If one or more computing entities address a flow to an address of a host that no longer exists, ghost asset data may be recorded and updated in the asset data. When a computing entity inside the network contacts an object in the dark-net, the computing entity may be recorded a potential mapper. When the computing entity tries to contact a number of objects in the dark-net, such that a computed threshold is exceeded, the computing entity is identified a malicious entity performing network reconnaissance.
kb-author: Nicolas BEAUCHESNE; Sungwook Yoon
kb-is-example-of: Connection Attempt Analysis
kb-mitre-analysis: This patent describes detecting an attacker performing internal reconnaissance within an organization’s network to gather intelligence about the configuration of the network or identify the next target. Network packets are collected (ex. tapped from a network switch) and processed to create flows that are used to map out the network to identify network assets as well as ghost assets (addresses not assigned to a device or an existing device that is temporarily disabled). Once this mapping is complete it is used to monitor the network to determine if an attacker is attempting to connect to a ghost asset. If an attacker attempts to connect to a ghost asset over a threshold (ex. contacting four ghost assets in less than seven minutes), an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: Detecting network reconnaissance by tracking intranet dark-net communications

Reference - Deterministic method for detecting and blocking of exploits on interpreted code - K2 Cyber Security Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190180036A1/en
kb-abstract: In one aspect, a method useful for preventing exploitation of a vulnerability in an interpreted code by monitoring and validating an execution of the interpreted code in a script file by an application server, includes the step of generating a mapping for an incoming network connection to a specified script file to be executed by an application server. The computerized method includes the step of inserting a hook for monitoring an application programming interface (API) call or a privileged instruction executed by the application server. The computerized method includes the step of inserting a validation code configured to validate the API call or the privileged instruction executed by the interpreted code in a script.
kb-author: Jayant Shukla
kb-is-example-of: System Call Analysis
kb-mitre-analysis: This patent describes a technique for monitoring API calls. During execution of interpreted code the observed API calls are validated against a whitelist of API calls for that interpreted code file. Action is taken if the observed API call is not in accordance with the list.
kb-organization: K2 Cyber Security Inc
kb-reference-title: Deterministic method for detecting and blocking of exploits on interpreted code

Reference - Distributed meta-information query in a network - Bit 9 Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20070028302A1/en
kb-abstract: A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and social engineering attacks. The system can implement centralized policies that allow an administrator to approve, block, quarantine, and log file activities. A server associated with a number of hosts can provide a query for host computers to access security-related meta-information in local host stores. The query is pulled from the server by the hosts. The results of the distributed host query are stored and merged on the server, and exported for display, reports, or security response.
kb-author: Todd Brennan; John Hanratty
kb-is-example-of: File Content Rules
kb-mitre-analysis: Provides a mechanism to detect, monitor, locate, and control files installed on host computers. Each host has a host agent that analyzes file system activity and takes action based on policies configured on a server. The policies identify whether to block, log, allow, or quarantine actions such as file accesses and execution of executables. Examples of policies include: * Block/log execution of new executables and detached scripts (e.g., .exe or .bat) * Block/log reading/execution of new embedded content (e.g., macros in .doc) * Block/log installation/modification of Web content (alteration of content in .html or .cgi files) * Block/log execution of new files in an administratively defined “class”; e.g., an administrator might want to block screen savers .scr, but not the entire class of executables .exe, .dll, .sys, etc . . .
kb-organization: Bit 9 Inc
kb-reference-title: Distributed meta-information query in a network

Reference - Domain age registration alert - Inc Rapid7 Inc RAPID7 Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170026400A1/
kb-abstract: Systems and methods of identifying a security risk by monitoring and generating alerts based on attempts to access web domains that have been registered within a short period of time and are therefore identified as “high-risk,” including identifying an attempt to access a domain; receiving a registration date of the domain; and detecting a security risk based on the registration date of the domain.
kb-author: Samuel Adams; H D. Moore
kb-is-example-of: DNS Traffic Analysis
kb-organization: Rapid7 Inc.
kb-reference-title: Domain age registration alert

Reference - Enhancing Network Security By Preventing User-Initiated Malware Execution -
type: Academic Paper Reference
type: NamedIndividual
has-link: https://ieeexplore.ieee.org/document/1425209
kb-abstract: In this paper, we describe characteristics of the most widely used defense techniques for the blocking of user-initiated malware and why these techniques are insufficient. We then introduce a module verification strategy that will eliminate, or at least severely reduce, this problem by extending the classic “defense in depth” network security strategy. We then describe how the augmentation of a standard operating system loader to include references to a database of cryptographic hashes of module executables can be used to implement this strategy. Finally, we describe our efforts towards the creation of a prototype system that implements the module verification strategy.
kb-author: John V. Harrison
kb-is-example-of: Executable Allowlisting
kb-mitre-analysis: This paper describes application whitelisting. New software executable code is compared to a database of allowed software to determine if the new executable code should be loaded and executed. A database of cryptographic hashes is first created for all allowed software executables. Prior to loading any new executable code, a hash is computed and compared against the hash database. If the hash for the new code does not appear in the database, the executable is not loaded and executed.
kb-reference-title: Enhancing Network Security By Preventing User-Initiated Malware Execution

Reference - FWTK - Firewall Toolkit -
type: Internet Article Reference
type: NamedIndividual
has-link: https://blogs.gartner.com/john_pescatore/2008/10/02/this-week-in-network-security-history-the-firewall-toolkit/
kb-abstract: delivered to DARPA in ~1993
kb-reference-title: FWTK - Firewall Toolkit

Reference - File-modifying malware detection - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180121650A1/en
kb-abstract: A security agent implemented on a computing device is described herein. The security agent is configured to detect file-modifying malware by detecting that a process is traversing a directory of the memory of the computing device and detecting that the process is accessing files in the memory according to specified file access patterns. The security agent can also be configured to correlate actions of multiple processes that correspond to a specified file access pattern and detect that one or more of the multiple processes are malware by correlating their behavior.
kb-author: Daniel W. Brown
kb-is-example-of: File Access Pattern Analysis
kb-mitre-analysis: This patent describes a technique for detecting file modifying malware such as wipers and ransomware that overwrite portions of files and encrypt portions of a computer’s memory, respectively. Processes that are traversing a directory are identified along with file access patterns. Processes executing on a computing device that are traversing a directory include: * changing a directory of a process (e.g., iteratively, systematically, repeatedly) * detecting that a process is conducting an “open directory” operation repeatedly * the same process traversing through a directory and recording the locations of data files encountered in each sub – directory In addition to identifying processes traversing a directory, particular file access patterns are also detected that may be indicative of malicious behavior including: * multiple file types being accessed * accessing a large number of files * files located in multiple locations in the directory being accessed If a process is conducting a traversal of the directory and accessing files according to a defined access pattern associated with malicious behavior, a preventative action is performed.
kb-organization: Crowdstrike Inc
kb-reference-title: File-modifying malware detection

Reference - Firewall for interent access - Secure Computing LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/GB2317539A
kb-abstract: Regulating the flow of internetwork connections through a firewall (10) having a network protocol stack (14,16,18) which includes an Internet Protocol (IP) layer (16). A determination is made of the parameters characteristic of a connection request, including a netelement parameter characteristic of where the connection request came from. A query is generated and a determination is made whether there is a rule corresponding to that query. If there is a rule corresponding to the query, a determination is made whether authentication is required by the rule. If authentication is required by the rule, an authentication protocol is activated and the connection is activated if the authentication protocol is completed successfully.
kb-author: Edward B Stockwell, Alan E Klietz
kb-is-example-of: Inbound Traffic Filtering
kb-organization: Secure Computing LLC
kb-reference-title: Firewall for interent access

Reference - Firewall for processing a connectionless network packet - National Security Agency
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7073196B1
kb-abstract: The present invention is a device for and method of accessing a network by initializing a database, an approved list, and a disapproved list; receiving an connectionless network packet; computing a flow tag based on the connectionless network packet; discarding the connectionless network packet and returning to the second step if the flow tag is on the disapproved list; allowing access to the network and returning to the second step if the flow tag is on the approved list; comparing the flow tag to the database if the flow tag is not on the approved list or the disapproved list; discarding the connectionless network packet, adding the flow tag to the disapproved list, and returning to the second step if the database rejects the flow tag; and allowing access to the network, adding the flow tag to the approved list, and returning to the second step if the database accepts the flow tag.
kb-author: Patrick W. Dowd, John T. McHenry
kb-is-example-of: Inbound Traffic Filtering
kb-organization: National Security Agency
kb-reference-title: Firewall for processing a connectionless network packet

Reference - Firewall for processing connection-oriented and connectionless datagrams over a connection-oriented network - National Security Agency
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US6615358B1
kb-abstract: The present invention is a device for and method of accessing an information network by initializing a database, an ATM approved list, an IP approved list, and an IP disapproved list; receiving a datagram; discarding the datagram if it is not on the ATM approved list; determining the datagram's type; allowing access to the network and comparing the connection request, if any, to the database if the datagram is ATM signaling; discarding the datagram if the datagram is ATM signaling and the database denies the request; adding the request to the ATM approved list if the datagram is ATM signaling and the database allows the request; allowing access to the network if the datagram is ATM data that excludes IP data and the request is on the ATM approved list; computing a flow tag if the datagram is ATM data that includes IP data; discarding the datagram if the flow tag is on the IP disapproved list; allowing access to the network if the flow tag is on the IP approved list; comparing the flow tag to the database if the flow tag is neither on the IP approved list nor on the IP disapproved list; discarding the datagram and adding the flow tag to the IP disapproved list if the database rejects the flow tag; and allowing access to the network and adding the flow tag to the corresponding approved list if the database accepts the flow tag; and performing these steps on the next datagram
kb-author: Patrick W. Dowd, John T. McHenry
kb-is-example-of: Inbound Traffic Filtering
kb-organization: National Security Agency
kb-reference-title: Firewall for processing connection-oriented and connectionless datagrams over a connection-oriented network

Reference - Firewalls that filter based upon protocol commands - Intel Corp
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US6832256B1
kb-abstract: Data transfer is controlled between a first network and a second network of computers by a firewall-proxy combination. Active interpretation of protocol commands exchanged between the first network and the second network is performed to determine specific actions concerning completion of the protocol request. This active firewall-proxy combination may exist on either the first or second network of computers. This method of control provides centralized control and administration for all potentially reachable resources within a network.
kb-author: James E. Toga
kb-is-example-of: Inbound Traffic Filtering
kb-organization: Intel Corp
kb-reference-title: Firewalls that filter based upon protocol commands

Reference - Framework for notifying a directory service of authentication events processed outside the directory service - Oracle International Corp
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20090077645A1
kb-abstract: Methods, systems and machine-readable media for authenticating an end user for a client application are disclosed. According to one embodiment of the invention, a method of authenticating an end user for a client application using a directory service having an authentication control policy that tracks failed authentication attempts and allows lock out of an account after a predetermined number of failures comprises receiving end user identity information and security information at the client application; sending a search request to the directory service for an entry associated with the end user identity information and, if a match is found, receiving a authentication token from the directory service associated with the end user identity information; comparing the received authentication token with the security information; if the authentication token matches the security information, sending a request to update the directory service to indicate that successful authentication of the end user has occurred; and if the authentication token does not match the security information, sending a request to update the directory service to indicate that a failed attempt at authentication of the end user has occurred.
kb-author: Buddhika Nandana Kottahachchi
kb-is-example-of: Account Locking
kb-organization: Oracle International Corp
kb-reference-title: Framework for notifying a directory service of authentication events processed outside the directory service

Reference - Guards for application in software tamperproofing - Purdue Research Foundation
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7287166B1/en
kb-abstract: A method of protecting a software program from unauthorized modification, and a system for practicing the method. The method utilizes self-protecting software code. Armed internally with self-defensive mechanisms, a self-protecting software program is tamper-resistant. Whenever its integrity is compromised, a self-protecting software program may become unusable due to software program crashes or other errors, or may generate subtle errors that do not immediately result render the program unusable but still result in incorrect software program execution. A self-protecting software program also may be able to repair itself to restore the integrity of its damaged code. The system comprises a computer program for automatically adding self-protection features to a software program.
kb-author: Hoi Chang; Mikhail J. Atallah; John R. Rice
kb-is-example-of: Process Code Segment Verification
kb-organization: Purdue Research Foundation
kb-reference-title: Guards for application in software tamperproofing

Reference - Hardware-assisted system and method for detecting and analyzing system calls made to an operting system kernel - Endgame Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180032728A1/en
kb-abstract: The present disclosure relates to a system and method for monitoring system calls to an operating system kernel. A performance monitoring unit is used to monitor system calls and to gather information about each system call. The information is gathered upon interrupting the system call and can include system call type, parameters, and information about the calling thread/process, in order to determine whether the system call was generated by malicious software code. Potentially malicious software code is nullified by a malicious code counter-attack module.
kb-author: Matthew D. Spisak
kb-is-example-of: System Call Analysis
kb-mitre-analysis: This patent describes a technique for monitoring system calls to detect malicious software code. A system call monitoring module operates at the kernel level and traps system calls. Monitoring data includes: * information about the path to the file to be accessed by a system call. * the memory address or range of addresses to be accessed by a system call. * the context for the thread within operating system that will be interrupted by a system call. * the type of system call information about the socket that is being used by system call in order to send or receive data. * the history of system calls in order to monitor for specific sequences of system calls. * the frequency or periodicity of a particular system call or set of systems calls. Captured system call data is analyzed using data analysis algorithms such as machine learning algorithms, artificial intelligence algorithms, pattern recognition algorithms, or other known data analysis techniques. An alert is generated if it is likely that the system call was generated by malicious software code.
kb-organization: Endgame Inc
kb-reference-title: Hardware-assisted system and method for detecting and analyzing system calls made to an operting system kernel

Reference - Heuristic botnet detection - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160156644A1
kb-abstract: In some embodiments, heuristic botnet detection is provided. In some embodiments, heuristic botnet detection includes monitoring network traffic to identify suspicious network traffic; and detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor, in which the suspicious network traffic behavior includes command and control traffic associated with a bot master. In some embodiments, heuristic botnet detection further includes assigning a score to the monitored network traffic, in which the score corresponds to a botnet risk characterization of the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); and determining the suspicious behavior is associated with a botnet based on the score.
kb-author: Xinran Wang; Huagang Xie
kb-is-example-of: DNS Traffic Analysis
kb-mitre-analysis: This patent describes detecting botnets using heuristic analysis techniques on collected network flows. The heuristic techniques include: * Identifying suspicious traffic patterns to detect command and control traffic ex. periodically visiting a known malware URL, a host visiting a malware domain twice every 5 hour and 14 minutes (this is a specific pattern for a variant of Swizzor botnets). * Identifying non-standard behaviors such as connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, communicating using HTTP header with a shorter than common length * Analyzing visited domain information to identify the following: visiting a domain with a domain name that is longer than a common domain name length, visiting a dynamic DNS domain, visiting a fast-flux domain, and visiting a recently created domain. A score is determined based on these factors and if the score is over a threshold, a responsive action is performed.
kb-organization: Palo Alto Networks Inc
kb-reference-title: Heuristic botnet detection

Reference - How ASLR protects Linux systems from buffer overflow attacks - Network World
type: Internet Article Reference
type: NamedIndividual
has-link: https://www.networkworld.com/article/3331199/what-does-aslr-do-for-linux.html
kb-abstract: ASLR (Address Space Layout Randomization) is a memory exploitation mitigation technique used on both Linux and Windows systems. Learn how to tell if it's running, enable/disable it, and get a view of how it works.
kb-author: Sandra Henry-Stocker
kb-is-example-of: Segment Address Offset Randomization
kb-organization: Network World
kb-reference-title: How ASLR protects Linux systems from buffer overflow attacks

Reference - http://www.biometric-solutions.com/keystroke-dynamics.html - biometric-solutions.com
type: Internet Article Reference
type: NamedIndividual
has-link: http://www.biometric-solutions.com/keystroke-dynamics.html
kb-abstract: Keystroke dynamics or typing dynamics refers to the automated method of identifying or confirming the identity of an individual based on the manner and the rhythm of typing on a keyboard. Keystroke dynamics is a behavioral biometric, this means that the biometric factor is ‘something you do’. Already during the second world war a technique known as The Fist of the Sender was used by military intelligence to distinguish based on the rhythm whether a morse code message was send by ally or enemy. These days each household has at least one computer keyboard, making keystroke dynamics the easiest biometric solution to implement in terms of hardware. With keystroke dynamics the biometric template used to identify an individual is based on the typing pattern, the rhythm and the speed of typing on a keyboard. The raw measurements used for keystroke dynamics are dwell time and flight time.
kb-author: Biometric Solutions
kb-is-example-of: Input Device Analysis
kb-organization: Biometric Solutions
kb-reference-title: Keystroke Dynamics

Reference - Inferential exploit attempt detection - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10216934B2/en
kb-abstract: A security agent implemented on a monitored computing device is described herein. The security agent is configured to detect an action of interest (AoI) that may be probative of a security exploit and to determine a context in which that AoI occurred. Based on that context, the security agent is further configured to decide whether the AoI is a security exploit and can take preventative action to prevent the exploit from being completed. Determining that the AoI includes the security exploit is based at least in part on one or more of: determining that the return address is outside memory previously allocated for an object; determining that the object identifier is associated with a vulnerable object; determining that permissions of the memory region include two or more of read, write, and execute; or determining that the memory region is one page in length. Determining that the return address is outside memory previously allocated for an object and the method further including treating code that the return address points to as malicious code.
kb-author: Daniel W. Brown; Ion-Alexandru Ionescu; Loren C. Robinson
kb-is-example-of: Memory Boundary Tracking
kb-organization: Crowdstrike Inc
kb-reference-title: Inferential exploit attempt detection

Reference - Instant process termination tool to recover control of an information handling system - Dell Products LP
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20060236108A1/en
kb-abstract: A method and system for automatic termination of unauthorized malevolent processes operating on an information handling system. A list of authenticated and essential process list is stored on the information handling system. Unauthorized processes not contained on the list can be automatically terminated by the user by invoking the present invention with a single click of a mouse or pointer device on an icon residing on the display screen of the information handling system. The offending processes are immediately terminated without generating a user prompt, which would ordinarily provide sufficient time for the malware to spawn additional offending processes. The present invention also provides significant means to recover control of a malware-infected information handling system in order to use repair tools and utilities. The present invention can be deployed at the time of manufacture of an information handling system or independently installed by a user.
kb-author: Carlton Andrews
kb-is-example-of: Process Termination
kb-organization: Dell Products LP
kb-reference-title: Instant process termination tool to recover control of an information handling system

Reference - Integrity assurance through early loading in the boot phase - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170061127A1
kb-abstract: Techniques utilizing library and pre-boot components to ensure that a driver associated with a kernel-mode component is initialized before other drivers during a boot phase are described herein. The library component is processed during a boot phase; the pre-boot component, which may be an alternative to the library component, is processed during a pre-boot phase. By ensuring that the driver is the first driver initialized, the components enable the driver to launch the kernel-mode component before other drivers are initialized. The library component may also determine whether another driver is to be initialized before the kernel-mode component driver, may ensure that kernel-mode component driver is initialized first, and may alert the kernel-mode component. Also, the library component may retrieve information that is to be deleted by the operating system before initialization of drivers and may provide that information to the kernel-mode component.
kb-author: Ion-Alexandru Ionescu
kb-is-example-of: Driver Load Integrity Checking
kb-mitre-analysis: To compromise software or to gain control of a host device, a security exploit can modify driver initialization order used by an operating system and place a driver associated with the security exploit first in a list of drivers initialized by the operating system. This patent describes ensuring that a driver associated with the agent is initialized first. To ensure the driver is initialized first, a dependent DLL associated with the driver is configured to be processed before other dependent DLLs. The dependent DLL can be configured to be processed first by various methods, for example if processing is done in alphabetical order, changing its name to be processed first. The dependent DLL, once processed, executes a number of operations to ensure the driver associated with the agent is initialized first. Furthermore, if the initialization order is modified, an alert is provided to the kernel-mode component that notifies the kernel-mode component it was not first and the order had to be altered. It can then take additional actions such as additional monitoring or remediation.
kb-organization: Crowdstrike Inc
kb-reference-title: Integrity assurance through early loading in the boot phase

Reference - Intrusion detection using a heartbeat - Sophos Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180191752A1
kb-abstract: A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.
kb-author: Kenneth D. Ray
kb-is-example-of: Endpoint Health Beacon
kb-mitre-analysis: This patent describes a health monitor deployed on an endpoint that uses a heartbeat to periodically communicate status to a gateway’s remote health monitor. The endpoint health monitor issues a heartbeat for satisfactory status of the endpoint using factors such as: * checking the status of individual software items executing on the endpoint * checking that antivirus and other security software is up to date (e. g., with current virus definition files) and running correctly * checking the integrity of cryptographic key stores * checking other hardware or software components of the endpoint as necessary or helpful for health monitoring A disappearance of the heartbeat from the endpoint may indicate that the endpoint has been compromised.
kb-organization: Sophos Ltd
kb-reference-title: Intrusion detection using a heartbeat

Reference - Isolation of applications within a virtual machine - Bromium, Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9921860B1
kb-abstract: Approaches for launching an application within a virtual machine. In response to receiving a request to launch an application, a device instantiates, without human intervention and based on a policy, a virtual machine in which the application is to be launched. The policy determines which resources of a device, such as a mobile device or computer system, are accessible to the virtual machine. The policy may, but need not, determine whether the virtual machine has access to a type of resource which obligates the user of the device to make a monetary payment for the user of the resource.
kb-author: Gaurav Banga, Sergei Vorobiev, Deepak Khajuria, Vikram Kapoor, Ian Pratt, Simon Crosby, Adrian Taylor
kb-is-example-of: Hardware-based Process Isolation
kb-organization: Bromium, Inc.
kb-reference-title: Isolation of applications within a virtual machine

Reference - Malicious relay detection on networks - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150264083A1
kb-abstract: A system and method for detecting malicious relay communications is disclosed. Network communications can be received and analyzed using such network components as a network switch. The received traffic can be parsed into sessions. Relay metadata can be extracted from the sessions and further be used to categorize the sessions into one or more types of relay metadata behaviors. Once a significant amount of sessions are detected an alarm may be triggered and/or alarm data may be generated for analysis by network security administrators.
kb-author: Ryan James PRENGER; Nicolas BEAUCHESNE; Karl Matthew LYNN
kb-is-example-of: Relay Pattern Analysis
kb-mitre-analysis: This patent describes a technique for detecting relay networks, i.e. an attacker outside of the organization’s network takes control of an internal host to be used as a source of attacks against other internal targets or exfiltrate data out of the organization. In this defensive technique, metadata from collected network packet captures is extracted to categorize network sessions using known relay behaviors. Information such as the number of bytes sent to and from a potential internal relay host, time of session initiation, packet contents, packet size, flow direction, and packet arrival time statistics are used to categorize the sessions and identify relay behavior. This technique assumes that relay network connections' inter-packet arrival times exhibit a high degree of variance in comparison to standard client-to-server connections. If enough evidence of relay behavior is gathered about a given internal host, the host is identified as suspicious and an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: Malicious relay detection on networks

Reference - Malware analysis system - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150319136A1
kb-abstract: In some embodiments, a malware analysis system includes receiving a potential malware sample from a firewall; analyzing the potential malware sample using a virtual machine to determine if the potential malware sample is malware; and automatically generating a signature if the potential malware sample is determined to be malware. In some embodiments, the potential malware sample does not match a preexisting signature, and the malware is a zero-day attack.
kb-author: Huagang Xie; Xinran Wang; Jiangxia Liu
kb-is-example-of: Dynamic Analysis
kb-mitre-analysis: This patent describes a VM sandbox environment that uses heuristic based analysis techniques performed in real-time during a file transfer to determine if the file is malicious. A new signature can then be generated and distributed to automatically block future file transfer requests to download the malicious file.
kb-organization: Palo Alto Networks Inc
kb-reference-title: Malware analysis system

Reference - Malware detection in event loops - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190205530A1
kb-abstract: Example techniques locate or identify malware based on events from or at monitored computing devices. A control unit can detect a sequence of events of various types. The control unit can locate a loop within the sequence of events based at least in part on relative frequencies of the event types. The control unit can determine a distribution of event types of the events within the loop, and determining that software running the sequence is associated with malware based at least in part on the distribution of event types within the loop. In some examples, the control unit can locate a point of commonality among a plurality of stack traces associated with respective events within the loop. The control unit can determine a malware module comprising the point of commonality.
kb-author: Daniel W. Brown
kb-is-example-of: System Call Analysis
kb-mitre-analysis: The patent describes determining if a sequence of events associated with a process are associated with malware. Based on the relative frequency of events, a loop within a sequence of events is located and a distribution of the events within the loop is determined. The distribution of events is then compared against a catalog of distributions to determine if it is associated with malware.
kb-organization: Crowdstrike Inc
kb-reference-title: Malware detection in event loops

Reference - Malware detection using local computational models - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190026466A1
kb-abstract: Example techniques herein determine that a trial data stream is associated with malware (“dirty”) using a local computational model (CM). The data stream can be represented by a feature vector. A control unit can receive a first, dirty feature vector (e.g., a false miss) and determine the local CM based on the first feature vector. The control unit can receive a trial feature vector representing the trial data stream. The control unit can determine that the trial data stream is dirty if a broad CM or the local CM determines that the trial feature vector is dirty. In some examples, the local CM can define a dirty region in a feature space. The control unit can determine the local CM based on the first feature vector and other clean or dirty feature vectors, e.g., a clean feature vector nearest to the first feature vector.
kb-author: Sven Krasser,David Elkind, Patrick Crenshaw, Kirby James Koster
kb-is-example-of: Process Termination
kb-organization: Crowdstrike Inc
kb-reference-title: Malware detection using local computational models

Reference - Method and Apparatus for Detecting Malicious Websites - Endgame Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20140331319A1
kb-abstract: A method and apparatus for detecting malicious websites is disclosed.
kb-author: John Burnet MUNRO, IV; Jason Aaron Trost; Zachary Daniel HANIF
kb-is-example-of: URL Analysis
kb-mitre-analysis: This patent describes a domain classification engine on the host computer that analyzes URLs clicked by a user or entered into a web browser to visit a website. URL analysis is done by using a combination of techniques: * Feature extraction: A URL is analyzed against features associated with suspicious URLs such as % of longest consecutive digits in a subdomain, % of longest repeated characters in a subdomain, % of vowels in a high level domain. * Markov analysis: The probability of a digit occurring in normal language given the preceding two digits is determined. For example, if the received URL is google.com, the probability of a 'g' occurring at the beginning of a word, the probability of an 'o' occurring after a “g, the probability of an “o’ occurring after a 'g' and “o, and so forth will be determined. The probability of each digit is then multiplied to get a probability for the whole domain name. Probabilities are determined based on a database of existing usage, such as a dictionary, or a list of known good domain names * Domain names are compared against an existing dataset of known unauthorized domain names. A rating is developed based on the results of these techniques, and if the rating is over a set threshold, an action is taken such as blocking access or generating an alert.
kb-organization: Endgame Inc
kb-reference-title: Method and Apparatus for Detecting Malicious Websites

Reference - Method and apparatus for increasing the speed at which computer viruses are detected - McAfee LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5502815A
kb-abstract: The method and apparatus for increasing the speed at which computer viruses are detected stores initial state information concerning the file or volume which is being examined for a virus. This information is stored in a cache in a non-volatile storage medium and when files are subsequently scanned for viruses, the current state information is compared to the initial state information stored in the cache. If the initial state information differs from the current state information then the file or volume is scanned for viruses which change the state information of the file or volume. If the initial state information and current state information is the same then the file or volume is scanned for a subset of viruses which do not change the state information.
kb-author: Paul D. Cozza
kb-is-example-of: Executable Denylisting
kb-organization: McAfee LLC
kb-reference-title: Method and apparatus for increasing the speed at which computer viruses are detected

Reference - Method and apparatus for utilizing a token for resource access - Rsa Security Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5657388A/en
kb-abstract: A method and apparatus for utilizing a token which is preferably a "dumb token" to provide secure access by authorized users to a selected resource. The token stores a secret user code in machine readable form, which code is read by a token processor. The token processor also receives a time-varying value and an algorithm, both of which may be stored or generated at either the token or the token processor and preferably a secret personal identification code which may be inputted at the token, but is preferably inputted at the token processor. The secret user code, time-varying value and secret personal identification code are then algorithmically combined by the algorithm, preferably in the token processor, to generate a one-time nonpredictable code which is transmitted to a host processor. The host processor utilizes the received one-time nonpredictable code to determine if the user is authorized access to the resource and grants access to the resource if the user is determined to be authorized. The system may be modified to operate in query/response mode. The token processor may be any of a variety of available portable remote processors or may be a device such as a telephone which is equipped with card or other token reader and with processing capability.
kb-author: Kenneth P. Weiss
kb-is-example-of: Multi-factor Authentication
kb-organization: Rsa Security Inc.
kb-reference-title: Method and apparatus for utilizing a token for resource access

Reference - Method and system for detecting algorithm-generated domains - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150264070A1
kb-abstract: A method and system for detecting algorithm-generated domains (AGDs) is disclosed wherein domain names requested by an internal host are categorized or classified using curated data sets, active services (e.g. Internet services), and certainty scores to match domain names to domain names or IP addresses used by command and control servers.
kb-author: James Patrick HARLACHER; Aditya Sood; Oskar Ibatullin
kb-is-example-of: DNS Traffic Analysis
kb-mitre-analysis: This patent describes detecting algorithm generated domains (AGD). DNS requests and responses are analyzed by first checking whether the domain matches existing data sets that specify different types of AGDs with known characteristics, such as Evil Twin Domains, Sinkholed domains, sleeper cells, ghost domains, parked domains, and/or bulk-registered domains. In addition to comparing domains against known data sets, the following information is collected to perform analysis: * IP Information: checks for information known about the IP addresses returned in the DNS response, including the number of IP addresses returned, the registered owners of the IP addresses, or different IP addresses returned for the same domain (IP fluxing) * Domain Registration: examines the domain registration date, domain update date, domain expiration date, registrant identity, and authorized name servers associated with a specific domain name. * Domain Popularity: provides information on the popularity of a domain name. Based on analysis of these factors a score is developed; if the score is above a certain threshold, an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: Method and system for detecting algorithm-generated domains

Reference - Method and system for detecting external control of compromised hosts - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9407647B2/en
kb-abstract: A detection engine may be implemented by receiving network traffic and processing the traffic into one or more session datasets. Sessions not initiated by an internal host may be discarded. The frequency between the communication packets from the internal host to external host may be grouped or processed into rapid-exchange instances. The number of rapid-exchange instances, the time intervals between them, and/or the rhythm and directions of the initiation of the instances may be analyzed to determine that a human actor is manually controlling the external host. In some embodiments, when it is determined that only one human actor is involved, alarm data may be generated that indicates that a network intrusion involving manual remote control has occurred or is underway.
kb-author: Nicolas BEAUCHESNE; Ryan James PRENGER
kb-is-example-of: Remote Terminal Session Detection
kb-mitre-analysis: This patent describes detecting an external attacker taking remote control of an internal host. Detection includes identifying sessions where the external host controls the internal host in the opposite direction the session was initiated. The number of rapid-exchange communication instances (i.e, communications that occur between the two hosts with little silence gap), the time intervals between them, and/or the rhythm and direction of the instances, are analyzed to determine if an external human actor is manually controlling the internal host.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: Method and system for detecting external control of compromised hosts

Reference - Method and system for detecting malicious payloads - Vectra Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/EP3293937A1/en
kb-abstract: Disclosed is an improved method, system, and computer program product for identifying malicious payloads. The disclosed approach identifies potentially malicious payload exchanges which may be associated with payload injection or root-kit magic key usage. Some examples of data inputs: Information for clients and servers, such as IP address and host information Payloads for both clients and servers Amount of data being transferred Duration of communications Length of time delay between client request and server response
kb-author: Nicolas Beauchesne; John Steven Mancini
kb-is-example-of: Client-server Payload Profiling
kb-mitre-analysis: Extraction of network flow data and using unsupervised machine learning to create a standard baseline. During the monitoring phase, abnormal network metadata will result in an alert.
kb-organization: Vectra Networks Inc
kb-reference-title: Method and system for detecting malicious payloads

Reference - Method and system for detecting restricted content associated with retrieved content - Sophos Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160359883A1
kb-abstract: In embodiments of the present invention improved capabilities are described for detecting restricted content associated with retrieved content. The method and system may include receiving a client request for content, saving contextual information from the client request, presenting retrieved content in response to the client request, and presenting the contextual information from the client request, and retrieved content, to a scanning facility. The scanning facility may utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.
kb-author: Fraser Howard; Paul Baccas; Vanja Svajcer; Benjamin John Godwood; William James McCourt
kb-is-example-of: URL Analysis
kb-mitre-analysis: This patent describes analyzing contextual information of a Uniform Resource Identifier (URI), such as source or origin of the request URI, patterns in the way the URI is delivered, and the locale of the URI. The contextual information is sent to a scanning facility which uses that information along with a blacklist of known malicious domain names, locations, patterns, etc. to block retrieved content associated with the request URI.
kb-organization: Sophos Ltd
kb-reference-title: Method and system for detecting restricted content associated with retrieved content

Reference - Method and system for detecting suspicious administrative activity - Vectra Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180077186A1
kb-abstract: Disclosed is an improved approach for identifying suspicious administrative host activity within a network. Network traffic is examined to learn the behavior of hosts within a network. This provides an effective way of determining whether or not a host is performing suspicious activity over an administrative protocol.
kb-author: Nicolas Beauchesne; Kevin Song-Kai Ni
kb-is-example-of: Administrative Network Activity Analysis
kb-mitre-analysis: Collect network traffic metadata directed at administrative services over a period of time to establish a baseline. This baseline is then used to determine suspicious activity that falls outside of the established baseline.
kb-organization: Vectra Networks Inc
kb-reference-title: Method and system for detecting suspicious administrative activity

Reference - Method and system for detecting threats using metadata vectors - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191551A1
kb-abstract: An approach for detecting network attacks using metadata vectors may initially involve receiving network communications or packets, extracting metadata items from the packets. The metadata items describe the communications without requiring deep content inspection of the data payload or contents. The communications may be clustered into groups using the metadata items. If a cluster exceeds a threshold, an alarm may be generated.
kb-author: Nicolas BEAUCHESNE; David Lopes Pegna; Karl Lynn
kb-is-example-of: Protocol Metadata Anomaly Detection
kb-mitre-analysis: This patent describes detecting network threats by first passively collecting network traffic and storing it for processing. Metadata from network traffic such as packet header information or information about a session (ex. time between request/responses) is extracted. After the metadata is extracted, the data is grouped into cluster maps of matching events to track how many instances of a network communication have occurred, such as five requests sent and five responses received. Threshold limits are set on the clusters to monitor them and if a cluster grows too large (ex. ten instances of requests and responses) this can correspond to unauthorized behavior. This method might detect, for example, a network attack using malicious payloads with automated scripts, in which a bot sends replicated malicious payloads to the same destination port.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: Method and system for detecting threats using metadata vectors

Reference - Method and system for detecting threats using passive cluster mapping - Vectra Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160149936A1
kb-abstract: An approach for detecting network threats is disclosed, that may involve receiving network traffic, plotting the network traffic in a n-dimensional feature space to form a network map, generating a client signature at least by placing new client points in the map, setting a threshold, and generating an alarm if one or more client activity points exceed the threshold. In some embodiments, the network map and the client signature are updated using sliding windows and distance calculations.
kb-author: David Lopes PEGNA; Nicolas Beauchesne
kb-is-example-of: Protocol Metadata Anomaly Detection
kb-mitre-analysis: This patent describes detecting network threats by first passively collecting network traffic and storing it for processing. The stored network traffic data is used to map network events to create a cluster map. Events are network activity associated with clients, servers, or control modules such as a Kerberos Domain Controller (KDC); account information; services accessed by the client; or the number of times a service is accessed. Events that exceed a threshold from a center of gravity point of a cluster are identified as suspicious activity and an alert is generated.
kb-organization: Vectra Networks Inc
kb-reference-title: Method and system for detecting threats using passive cluster mapping

Reference - Method for controlling computer network security - Checkpoint Software Technologies Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/EP0658837B1/
kb-abstract: A method of operating a security system for a computer network in which data is passed in said network as data packets, said system controlling the passage of said data packets in the network according to a security rule, where each aspect of said network controlled by said security rule has been defined, said security rule has been defined in terms of said aspects and converted into a set of filter language instructions.
kb-author: Gil Shwed
kb-is-example-of: Inbound Traffic Filtering
kb-organization: Checkpoint Software Technologies Ltd
kb-reference-title: Method for controlling computer network security

Reference - Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system - Symantec Corporation
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8239947B1
kb-abstract: A user mode application component invokes the assistance of a kernel mode driver component to detect and/or remediate malicious code on a computer system. The user mode application may include code that detects, for example, spyware and computer viruses, from user mode and when appropriate takes protective action when malicious code is detected. In one aspect, when the user mode application is unable to perform a selected operation in attempting to detect and/or take protective action, the user mode application invokes a kernel mode driver for assistance. The kernel mode driver assists user mode application in detecting malicious code and/or taking protective action by enabling or otherwise performing a selected operation for the user mode application.
kb-author: Adam Glick, Patrick Gardner, Pieter Viljoen
kb-is-example-of: System Daemon Monitoring
kb-mitre-analysis: This patent describes detecting registry changes using a prohibited change heuristic or a database of prohibited functions/function parameters.
kb-organization: Symantec Corporation
kb-reference-title: Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system

Reference - Mitigate threats by using Windows 10 security features: Data Execution Prevention - Microsoft
type: User Manual Reference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#data-execution-prevention
kb-abstract: Malware depends on its ability to insert a malicious payload into memory with the hope that it will be executed later. Wouldn't it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? Data Execution Prevention (DEP) does exactly that, by substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the No eXecute bit on modern CPUs to mark blocks of memory as read-only so that those blocks can't be used to execute malicious code that may be inserted by means of a vulnerability exploit.
kb-author: Nick Schonning, Daniel Simpson, Marty Hernandez Avedon, Trond B. Krokli, jreeds, jcaparas, Andres Mariano Gorzelany, Tina Burden, Thomas Raya, Justin Hall, justanotheranonymoususer, Liza Poggemeyer, Dani Halfin, imba-tjd (Authors for entire page)
kb-is-example-of: Process Segment Execution Prevention
kb-organization: Microsoft
kb-reference-title: Mitigate threats by using Windows 10 security features: Data Execution Prevention

Reference - Mock attack cybersecurity training system and methods - WOMBAT SECURITY TECHNOLOGIES Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9558677B2/
kb-abstract: A training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The user action may be in response to a mock attack delivered via a messaging service, a wireless communication service, a fake malware application or another device, service, system or mechanism. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user.
kb-author: Norman Sadeh-Koniecpol, Kurt Wescoe, Jason Brubaker, Jason Hong
kb-is-example-of: Decoy Public Release
kb-organization: WOMBAT SECURITY TECHNOLOGIES Inc
kb-reference-title: Mock attack cybersecurity training system and methods

Reference - Modeling user access to computer resources - Daedalus Group LLC (formerly IBM)
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8214364B2
kb-abstract: Embodiments of the invention provide a method for detecting changes in behavior of authorized users of computer resources and reporting the detected changes to the relevant individuals. The method includes evaluating actions performed by each user against user behavioral models and business rules. As a result of the analysis, a subset of users may be identified and reported as having unusual or suspicious behavior. In response, the management may provide feedback indicating that the user behavior is due to the normal expected business needs or that the behavior warrants further review. The management feedback is available for use by machine learning algorithms to improve the analysis of user actions over time. Consequently, investigation of user actions regarding computer resources is facilitated and data loss is prevented more efficiently relative to the prior art approaches with only minimal disruption to the ongoing business processes.
kb-author: Joseph P. Bigus, Leon Gong, Christoph Lingenfelder
kb-is-example-of: Resource Access Pattern Analysis
kb-organization: Daedalus Group LLC (formerly IBM)
kb-reference-title: Modeling user access to computer resources

Reference - Modification of a Server to Mimic a Deception Mechanism - Acalvio Technologies Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170149825A1
kb-abstract: Provided are devices, computer-program products, and methods (e.g., methods implemented by a production system or security agent program or process) for providing services on a production system to mimic a deception mechanism. For example, a method can include determining a deception characteristic of a deception mechanism and determining a production characteristic of the production system. The method can further include determining an additional service or a modification of an existing service of the production system using the deception characteristic and the production characteristic. In some cases, the additional service and/or the modification can be a deterrent to potential attackers of the production system. The method can further include modifying the production system to mimic the deception mechanism, including adding the additional service to the production system or modifying the existing service using the modification.
kb-author: Sreenivas Gukal, Rammohan Varadarajan
kb-is-example-of: Connected Honeynet
kb-organization: Acalvio Technologies Inc
kb-reference-title: Modification of a Server to Mimic a Deception Mechanism

Reference - Network-Based Buffer Overflow Detection by Exploit Code Analysis - Information Security Research Centre
type: Academic Paper Reference
type: NamedIndividual
has-link: https://eprints.qut.edu.au/21172/1/21172.pdf
kb-abstract: Buffer overflow attacks continue to be a major security problem and detecting attacks of this nature is therefore crucial to network security. Signature based network based intrusion detection systems (NIDS) compare network traffic to signatures modelling suspicious or attack traffic to detect network attacks. Since detection is based on pattern matching, a signature modelling the attack must exist for the NIDS to detect it, and it is therefore only capable of detecting known attacks. This paper proposes a method to detect buffer overflow attacks by parsing the payload of network packets in search of shellcode which is the remotely executable component of a buffer overflow attack. By analysing the shellcode it is possible to determine which system calls the exploit uses, and hence the operation of the exploit. Current NIDS-based buffer overflow detection techniques mainly rely upon specific signatures for each new attack. Our approach is able to detect previously unseen buffer overflow attacks, in addition to existing ones, without the need for specific signatures for each new attack. The method has been implemented and tested for buffer overflow attacks on Linux on the Intel x86 architecture using the Snort NIDS.
kb-author: Stig Andersson, Andrew Clark, and George Mohay
kb-is-example-of: Byte Sequence Emulation
kb-organization: Information Security Research Centre
kb-reference-title: Network-Based Buffer Overflow Detection by Exploit Code Analysis

Reference - Network firewall with proxy - Secure Computing LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/GB2318031A
kb-abstract: A proxy which is part of a firewall controls exchanges of information between two application entities. The proxy interrogates attempts to establish a communication session by requesting entities with a server entity in lower layers in accordance with defined authentication procedures. The Proxy interfaces with networking software to direct a communication stack to monitor connection requests to any address on specific ports. The requestor's address, and the server's address are checked against a access control list. If either address is invalid, the proxy closes the connection. If both are valid, a new connection is setup such that both the requestor and server are transparently connected to the proxy with variable higher levels being connected in a relay mode. Protocol data units are interrogated for conformance to a protocol session, and optionally further decoded to add additional application specific filtering. In one embodiment, an OSI architecture comprises the levels.
kb-author: Michael W Green, Ricky Ronald Kruse
kb-is-example-of: Inbound Traffic Filtering
kb-organization: Secure Computing LLC
kb-reference-title: Network firewall with proxy

Reference - Open source intelligence deceptions - Illusive Networks Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10333976B1/en
kb-abstract: A system to detect attackers who attempt to breach an enterprise network and attackers who have already breached the enterprise network, including an open source intelligence (OSINT) discoverer scanning the Internet to discover data related to an enterprise that is available online, an OSINT replacer generating deceptive files by replacing placeholders within template files with deceptive information, based on the data discovered by the OSINT discoverer, an OSINT distributor planting the deceptive files generated by the OSINT replacer within designated OSINT resources, and a deception management server that alerts an administrator in response to an attacker attempting to make a connection within the network using information in a deceptive file planted by the OSINT distributor.
kb-author: Hadar Yudovich; Nimrod Lavi; Sharon Bittan; Tom Kahana; Tom Sela
kb-is-example-of: Decoy File
kb-mitre-analysis: Seems to focus on configuration oriented files to put in decoy hostnames etc. to publish on internet sites, then monitor the decoy "objects".
kb-organization: Illusive Networks Ltd
kb-reference-title: Open source intelligence deceptions

Reference - Platform Firmware Resiliency Guidelines - NIST
type: Guideline Reference
type: NamedIndividual
has-link: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-193.pdf
kb-abstract: This document provides technical guidelines and recommendations supporting resiliency of platform firmware and data against potentially destructive attacks. The platform is a collection of fundamental hardware and firmware components needed to boot and operate a system. A successful attack on platform firmware could render a system inoperable, perhaps permanently, or requiring reprogramming by the original manufacturer, resulting in significant disruptions to users. The technical guidelines in this document promote resiliency in the platform by describing security mechanisms for protecting the platform against unauthorized changes, detecting unauthorized changes that occur, and recovering from attacks rapidly and securely. Implementers, including Original Equipment Manufacturers (OEMs) and component/device suppliers, can use these guidelines to build stronger security mechanisms into platforms. System administrators, security professionals, and users can use this document to guide procurement strategies and priorities for future systems.
kb-author: NIST
kb-is-example-of: Firmware Verification
kb-organization: NIST
kb-reference-title: Platform Firmware Resiliency Guidelines

Reference - Post sandbox methods and systems for detecting and blocking zero-day exploits via api call validation - K2 Cyber Security Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190138715A1/
kb-abstract: In one aspect, a method useful for monitoring and validating execution of executable binary code, includes the step of disassembling an executable binary code of an application. The method includes the step of detecting and obtaining location and type of an application programming interface (API) call, system call, and privileged instruction that is executed by the executable binary code. The method includes the step of detecting and obtaining return address from an Al call and system call. The method includes the step of validating location of the API call system call, and privileged instruction. The method includes the step of validating return from the API call and system call.
kb-author: Jayant Shukla
kb-is-example-of: System Call Analysis
kb-mitre-analysis: The patent describes a technique for monitoring API calls. Executable binary code of an application is first disassembled and scanned for API calls. Based on the recorded API calls, a rule list is generated. Software hooks are placed in the code for monitoring API calls during program execution and then each API call is validated using the generated rule list to permit or deny execution of API calls. Rules are created that specify the type and location of the API call. For example, data collected for an application can show an API call to libc at address 0x43e0 and an API call by libc at address 0xlfb47. Accordingly, two rules are generated. The first rule specifies the location type and target of the API call at address 0x43e0, as well as the return address. The second rule is for the API call to the kernel and states the target address, return address, instruction, and target type.
kb-organization: K2 Cyber Security Inc
kb-reference-title: Post sandbox methods and systems for detecting and blocking zero-day exploits via api call validation

Reference - Predicting Domain Generation Algorithms with Long Short-Term Memory Networks -
type: Academic Paper Reference
type: NamedIndividual
has-link: https://arxiv.org/abs/1611.007911
kb-abstract: Various families of malware use domain generation algorithms (DGAs) to generate a large number of pseudo-random domain names to connect to a command and control (C&C) server. In order to block DGA C&C traffic, security organizations must first discover the algorithm by reverse engineering malware samples, then generating a list of domains for a given seed. The domains are then either preregistered or published in a DNS blacklist. This process is not only tedious, but can be readily circumvented by malware authors using a large number of seeds in algorithms with multivariate recurrence properties (e.g., banjori) or by using a dynamic list of seeds (e.g., bedep). Another technique to stop malware from using DGAs is to intercept DNS queries on a network and predict whether domains are DGA generated. Such a technique will alert network administrators to the presence of malware on their networks. In addition, if the predictor can also accurately predict the family of DGAs, then network administrators can also be alerted to the type of malware that is on their networks. This paper presents a DGA classifier that leverages long short-term memory (LSTM) networks to predict DGAs and their respective families without the need for a priori feature extraction. Results are significantly better than state-of-the-art techniques, providing 0.9993 area under the receiver operating characteristic curve for binary classification and a micro-averaged F1 score of 0.9906. In other terms, the LSTM technique can provide a 90% detection rate with a 1:10000 false positive (FP) rate---a twenty times FP improvement over comparable methods. Experiments in this paper are run on open datasets and code snippets are provided to reproduce the results.
kb-author: Jonathan Woodbridge, Hyrum S. Anderson, Anjum Ahuja, Daniel Grant
kb-is-example-of: DNS Traffic Analysis
kb-reference-title: Predicting Domain Generation Algorithms with Long Short-Term Memory Networks

Reference - Preventing execution of task scheduled malware - McAfee LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160105450A1
kb-abstract: A method for preventing malware attacks includes the steps of detecting an attempt on an electronic device to access a task scheduler, determining an entity associated with the attempt to access the task scheduler, determining a malware status of the entity, and, based on the malware status of the entity, allowing or denying the attempted access to the task scheduler. The task scheduler is configured to launch one or more applications at a specified time or interval.
kb-author: Anil Ramabhatta, Harinath Vishwanath Ramachetty, Nandi Dharma Kishore
kb-is-example-of: Scheduled Job Analysis
kb-mitre-analysis: Access to a job scheduler is intercepted using hooking or file filters to identify and analyze the source files, processes, destination files, or destination servers associated with a scheduled job. The identified servers or files associated with a job are compared against an anti-malware signature database or reputation server to determine if it there is a match. If so, execution is denied and an alert is generated.
kb-organization: McAfee LLC
kb-reference-title: Preventing execution of task scheduled malware

Reference - Private virtual local area network isolation - Cisco Technology Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120331142A1
kb-abstract: In one embodiment, a method includes obtaining addresses of end hosts at a switch, the switch configured with a primary virtual local area network and a secondary virtual local area network, creating a private virtual local area network access list comprising the addresses of end hosts permitted to communicate on the secondary virtual local area network, and applying the private virtual local area network access list to interfaces connected to the end hosts permitted to communicate on the secondary virtual local area network. An apparatus is also disclosed.
kb-author: Anuraag Mittal, Huei-Ping Chen
kb-is-example-of: Broadcast Domain Isolation
kb-organization: Cisco Technology Inc
kb-reference-title: Private virtual local area network isolation

Reference - Protected computing environment - Microsoft Technology Licensing LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20060242406A1
kb-abstract: A method of establishing a protected environment within a computing device including validating a kernel component loaded into a kernel of the computing device, establishing a security state for the kernel based on the validation, creating a secure process and loading a software component into the secure process, periodically checking the security state of the kernel, and notifying the secure process when the security state of the kernel has changed.
kb-author: Sumedh Barde, Jonathan Schwartz, Reid Kuhn, Alexandre Grigorovitch, Kirt Debique, Chadd Knowlton, James Alkove, Geoffrey Dunbar, Michael Grier, Ming Ma, Chaitanya Upadhyay, Adil Sherwani, Arun Kishan
kb-is-example-of: Driver Load Integrity Checking
kb-organization: Microsoft Technology Licensing LLC
kb-reference-title: Protected computing environment

Reference - RPC call interception - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150163109
kb-abstract: A service proxy is described herein. The service proxy is configured to act as an intermediary between a client and a service. The service proxy may observe communications, modify communications, log communications, or the like, particularly so as to enhance the security and reliability of the host device. In some implementations, the service proxy may cooperate with an operating system to take over a named port object. In some implementations, the service proxy may receive messages as an intermediary between the client and the server. In some implementations, the service proxy may attach to a shared memory to intercept communications. In some implementations, the service proxy may be injected into a client process to appear to be the client itself.
kb-author: Ion-Alexandru Ionescu
kb-is-example-of: RPC Traffic Analysis
kb-organization: Crowdstrike Inc
kb-reference-title: RPC call interception

Reference - Secure caching of server credentials - Dell Products LP
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20100107241A1
kb-abstract: A credential caching system includes receiving a set of authentication credentials, storing the set of authentication credentials in a credential cache memory, wherein the credential cache memory is coupled with a management controller, and supplying the set of authentication credentials for automatic authentication during a reset or reboot. In the event of a security breach, the credential caching system clears the set of authentication credentials from the credential cache memory so that the set of authentication credentials may no longer be used for a reset or reboot.
kb-author: Muhammed K. JaberMukund P. KhatriKevin T. MarksDon Charles McCall
kb-is-example-of: Authentication Cache Invalidation
kb-organization: Dell Products LP
kb-reference-title: Secure caching of server credentials

Reference - Security System with Methodology for Interprocess Communication Control - Check Point Software Tech Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20040199763
kb-abstract: A security system with methodology for interprocess communication control is described. In one embodiment, a method for controlling interprocess communication is provided that includes steps of: defining rules indicating which system services a given application can invoke; trapping an attempt by a particular application to invoke a particular system service; identifying the particular application that is attempting to invoke the particular system service; and based on identity of the particular application and on the rules indicating which system services a given application can invoke, blocking the attempt when the rules indicate that the particular application cannot invoke the particular system service.
kb-author: Gregor Freund
kb-is-example-of: IPC Traffic Analysis
kb-mitre-analysis: This patent describes a technique for monitoring interprocess communications to prevent malicious applications from requesting system services. API calls are monitored to detect malicious applications attempting to open a communication channel (port) to access system services or sending messages to other applications using user32 API functions. These requests are examined against an external rules engine or whitelist, matches deny or block access and produce an error message such as connection refused or service not available.
kb-organization: Check Point Software Tech Inc
kb-reference-title: Security System with Methodology for Interprocess Communication Control

Reference - Security Technologies: Stack Smashing Protection (StackGuard) - Red Hat
type: Internet Article Reference
type: NamedIndividual
has-link: https://access.redhat.com/blogs/766093/posts/3548631
kb-abstract: In our previous blog, we saw how arbitrary code execution resulting from stack-buffer overflows can be partly mitigated by marking segments of memory as non-executable, a technology known as Execshield. However stack-buffer overflow exploits can still effectively overwrite the function return address, which leads to several interesting exploitation techniques like ret2libc, ret2gets, and ret2plt. With all of these methods, the function return address is overwritten and attacker controlled code is executed when the program control transfers to overwritten address on the stack.
kb-author: Huzaifa Sidhpurwala
kb-is-example-of: Stack Frame Canary Verification
kb-organization: Red Hat
kb-reference-title: Security Technologies: Stack Smashing Protection (StackGuard)

Reference - Sinkholing bad network domains by registering the bad network domains on the internet - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160381065A1
kb-abstract: Techniques for sinkholing bad network domains by registering the bad network domains on the Internet are provided. In some embodiments, sinkholing bad network domains by registering the bad network domains on the Internet includes determining a network domain is a bad network domain, in which the bad network domain is determined to be associated with an identified malware (e.g., malware that has been identified and has been determined to be associated with the bad domain), and the bad network domain is sinkholed by registering the bad network domain with a sinkholed IP address; and identifying a host that is infected with the identified malware based on an attempt by the host to connect to the sinkholed IP address.
kb-author: Huagang Xie; Wei Xu; Nir Zuk
kb-is-example-of: DNS Traffic Analysis
kb-mitre-analysis: This patent describes a technique to identify bad domains that are associated with malware and sinkhole the bad domain. Bad domains are identified by receiving malware samples and executing the malware sample in a virtual execution environment to identify network domains that the malware sample attempts to connect to during execution. Network domains that are identified during malware execution are then generated into signatures to identity bad domains for other hosts. Once identified, the bad domains are sinkholed by translating the domain to a valid IP address that is associated with a device controlled by a cloud security provider.
kb-organization: Palo Alto Networks Inc
kb-reference-title: Sinkholing bad network domains by registering the bad network domains on the internet

Reference - Supply chain cyber-deception - Cymmetria, Inc.
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/WO2017187379A1
kb-abstract: A computer implemented method of detecting unauthorized access to a protected network from external endpoints, comprising monitoring, at a protected network, communication with one or more external endpoints using one or more access clients to access one or more of a plurality of resources of the protected networked, where one or more deception resources created in the protected network map one or more of the plurality of resources, detecting usage of data contained in one or more of a plurality of deception data objects deployed in the one or more access clients by monitoring an interaction triggered by one or more of the deception data objects with the one or more deception resources when used and identifying one or more potential unauthorized operations based on analysis of the detection.
kb-author: Gadi EVRON; Dean SYSMAN; Imri Goldberg; Shmuel Ur
kb-is-example-of: Decoy File
kb-organization: Cymmetria, Inc.
kb-reference-title: Supply chain cyber-deception

Reference - Synchronizing a honey network configuration to reflect a target network environment - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170019425A1
kb-abstract: Techniques for synchronizing a honey network configuration to reflect a target network environment are disclosed. In some embodiments, a system for synchronizing a honey network configuration to reflect a target network environment includes a device profile data store that includes a plurality of attributes of each of a plurality of devices in the target network environment; a virtual machine (VM) image library that includes one or more VM images; and a virtual clone manager executed on a processor that instantiates a virtual clone of one or more devices in the target enterprise network using a VM image selected from the VM image library that is customized based on one or more attributes for a target device in the device profile data store.
kb-author: Taylor Ettema, Huagang Xie
kb-is-example-of: Integrated Honeynet
kb-organization: Palo Alto Networks Inc
kb-reference-title: Synchronizing a honey network configuration to reflect a target network environment

Reference - System and a method for identifying the presence of malware and ransomware using mini-traps set at network endpoints - Fidelis Cybersecurity Solutions Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9807115B2/en
kb-abstract: A system for identifying the presence of ransomware on a network, including a plurality of resources, interconnected to form a network and at least one decoy drive.The decoy drive includes a plurality of decoy files to be encrypted by the ransomware, and wherein the decoy drive continuously provides the decoy files thereby continuously occupying the ransomware.
kb-author: Doron Kolton; Rami Mizrahi; Omer Zohar; Benny Ben-Rabi; Alex Barbalat; Shlomi Gabai
kb-is-example-of: Decoy File
kb-organization: Fidelis Cybersecurity Solutions Inc
kb-reference-title: System and a method for identifying the presence of malware and ransomware using mini-traps set at network endpoints

Reference - System and method for detecting homoglyph attacks with a siamese convolutional neural network - Endgame Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190019058A1/
kb-abstract: The present invention utilizes computer vision technologies to identify potentially malicious URLs and executable files in a computing device. In one embodiment, a Siamese convolutional neural network is trained to identify the relative similarity between image versions of two strings of text. After the training process, a list of strings that are likely to be utilized in malicious attacks are provided (e.g., legitimate URLs for popular websites). When a new string is received, it is converted to an image and then compared against the image of list of strings. The relative similarity is determined, and if the similarity rating falls below a predetermined threshold, an alert is generated indicating that the string is potentially malicious.
kb-author: Jonathan Woodbridge; Anjum Ahuja; Daniel Grant
kb-is-example-of: Homoglyph Detection
kb-mitre-analysis: This patent describes a mechanism to detect homoglyph strings that involves training a Siamese convolutional neural network to compare images of strings. Strings of legitimate URLs for websites along with known suspicious stings are converted to images during the training process to create an index. New strings are converted to images and then compared to the index for similarity, if the string deviates beyond a threshold an alert is triggered.
kb-organization: Endgame Inc
kb-reference-title: System and method for detecting homoglyph attacks with a siamese convolutional neural network

Reference - System and method for detecting malware injected into memory of a computing device - Endgame Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190018958A1/en
kb-abstract: In the embodiments described herein, a malicious code detection module identifies potentially malicious instructions in memory of a computing device. The malicious code detection module examines the call stack for each thread running within the operating system of the computing device. Within each call stack, the malicious code detection module identifies the originating module for each stack frame and determines whether the originating module is backed by an image on disk. If an originating module is not backed by an image on disk, the thread containing that originating module is flagged as potentially malicious, execution of the thread optionally is suspended, and an alert is generated for the user or administrator.
kb-author: Joseph W. Desimone
kb-is-example-of: Process Code Segment Verification
kb-organization: Endgame Inc
kb-reference-title: System and method for detecting malware injected into memory of a computing device

Reference - System and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Velocity Analysis - Silver Tail Systems
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20100235909A1/en
kb-abstract: A system and software for identifying the change of user behavior on a website includes analyzing the actions of users on a website comprising a plurality of fields or input parameters that identify the actions performed on a website including fields related to previous actions by that user or other users of the website. The fields or input parameters are represented in a vector format where vectors represent different sessions of activity on the website, pages of the website, users of the website, or other attributes of the use of a website. Analysis is performed to determine if new sessions are similar or dissimilar to previously known sessions and if a session is converging or diverging from known sessions based on the velocity and direction of the velocity of the vectors in the vector space.
kb-author: Mike Eynon; Laura Mather; Erik Westland; Jim Lloyd
kb-is-example-of: Web Session Activity Analysis
kb-mitre-analysis: This patent describes a technique for detecting fraudulent behavior on a website. Website behavior is mapped to build a multidimensional representation of user actions on a website that is updated as additional actions are recorded. Example actions on a website that are recorded include clicks by a user on the website and entering data into forms. Current behavior is compared against baseline recorded behavior and if current behavior deviates above a threshold, an alert is issued.
kb-organization: Silver Tail Systems
kb-reference-title: System and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Velocity Analysis

Reference - System and method for internet security - Cylance Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120117644A1
kb-abstract: A computer implemented method for preventing SQL injection attacks comprises intercepting a web request associated with a web service at a first software hook in a first web service execution context, persisting at least a portion of the intercepted web request in a storage location associated with the first software hook and accessible to at least one additional execution context, intercepting a database query generated by at least one web service processing operation at a second software hook associated with the execution of the query, wherein the query is generated in response to the intercepted web request and the second hook retrieves the persisted portion of the intercepted web request, comparing a portion of the persisted portion of the intercepted web request with at least a portion of the intercepted database query, and determining, prior to the query being executed, whether the query corresponds to a potential SQL injection attack.
kb-author: Derek A. Soeder
kb-is-example-of: Database Query String Analysis
kb-mitre-analysis: This patent describes a technique for detecting SQL injection attacks. Software hooks are installed in a web service or application to intercept function calls, events, or messages that are passed between software components. Intercepted database queries associated with a web request are analyzed character by character and if it contains a character that would modify the syntax the query is rejected or sanitized. Security rules and policies may also determine rejection. For example, an administrator or developer may implement a rule that rejects any database query that is excessively long or that contains a particular string, such as "Xp cmdshell".
kb-organization: Cylance Inc
kb-reference-title: System and method for internet security

Reference - System and Method for Network Security Including Detection of Attacks Through Partner Websites - EMC IP Holding Co LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20110302653A1/en
kb-abstract: A computer readable storage medium has instructions for execution on a computer. The instructions monitor transactions between a server and a set of clients. An evaluation of session indicators associated with the transactions is performed. Individual sessions between the server and individual clients of the plurality of clients are isolated in response to the evaluation.
kb-author: Matt Frantz; Andreas Wittenstein; Mike Eynon; Laura Mather; Jim Lloyd; James Schumacher; Duane Murphy
kb-is-example-of: Web Session Activity Analysis
kb-mitre-analysis: This patent describes a technique for detecting man-in-the-browser attacks. Current user session data is compared with the average user session that is based on collected data representing average values across all user sessions over a data-collection period. User session data includes average time between clicks and the order in which website pages are viewed. The comparisons are combined to generate a score that indicates the likelihood that the current session is a man-in-the-browser attack.
kb-organization: EMC IP Holding Co LLC
kb-reference-title: System and Method for Network Security Including Detection of Attacks Through Partner Websites

Reference - System and Method for Process Hollowing Detection - Carbon Black Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170272462A1
kb-abstract: A method and system for remediating a process hollowing intrusion on a user device comprising detecting a process starting on the user device, preparing the process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device, determining whether the process is associated with a process hollowing intrusion based on information associated with the process and/or the API calls, and executing security policies against the process associated with the process hollowing intrusion. In examples, it is determined whether the child process is associated with a process hollowing intrusion in response to determining whether one or more API calls associated with known process hollowing intrusions modify executable memory of and/or modify an entry point address of the child process.
kb-author: Jeffrey Albin Kraemer, Paul Matthew Drapeau
kb-is-example-of: Process Self-Modification Detection
kb-organization: Carbon Black Inc
kb-reference-title: System and Method for Process Hollowing Detection

Reference - System and method for providing an actively invalidated client-side network resource cache - IMVU
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9578081B2/en
kb-abstract: A system and method for providing an actively invalidated client-side network resource cache are disclosed. A particular embodiment includes: a client configured to request, for a client application, data associated with an identifier from a server; the server configured to provide the data associated with the identifier and to establish a queue associated with the identifier at a scalable message queuing system, the client being configured to subscribe to the queue at the scalable message queuing system to receive invalidation information associated with the data; the server being further configured to signal the queue of an invalidation event associated with the data; the scalable message queuing system being configured to convey information indicative of the invalidation event to the client; and the client being further configured to re-request the data associated with the identifier from the server upon receipt of the information indicative of the invalidation event.
kb-author: Jon Watte
kb-is-example-of: Authentication Cache Invalidation
kb-organization: IMVU
kb-reference-title: System and method for providing an actively invalidated client-side network resource cache

Reference - System and method for validating in-memory integrity of executable files to identify malicious activity - Endgame Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190018962A1/en
kb-abstract: In the embodiments described herein, a malicious code detection module identifies potentially malicious instructions in volatile memory of a computing device before the instructions are executed. The malicious code detection module identifies an executable file, such as an .exe file, in memory, validates one or more components of the executable file against the same file stored in non-volatile storage, and issues an alert if the validation fails.
kb-author: Joseph W. Desimone
kb-is-example-of: Process Code Segment Verification
kb-organization: Endgame Inc
kb-reference-title: System and method for validating in-memory integrity of executable files to identify malicious activity

Reference - System and methods thereof for causality identification and attributions determination of processes in a network - Palo Alto Networks IncCyber Secdo Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170195350A1/en
kb-abstract: A system is used for detection of advanced persistent and non-persistent threats in a computerized environment. The system is connected to a plurality of user devices coupled to an enterprise's network. The system receives via an interface an electronic notification of at least one event in the operating system of the computer. The system then analyzes the at least one event. The system then generates a causality chain for the at least one event respective of the analysis. The causality chain comprises all the threads that attributed to the at least one event in a chronological order. The system then identifies a main thread that started the causality chain that led to the at least one event. Then, the system determines whether the main thread is associated with malicious software. Upon determination that the main thread is associated with malicious software, the causality chain is marked as infected.
kb-author: Gil BARAK
kb-is-example-of: Process Lineage Analysis
kb-mitre-analysis: This patent describes detecting malicious processes on a host. Agents are deployed on hosts that monitor all initiated processes and determine whether a process was initiated at boot or initiated by another process. If not initiated at boot or by another process, the process is identified as suspicious and an alert is triggered.
kb-organization: Palo Alto Networks IncCyber Secdo Ltd
kb-reference-title: System and methods thereof for causality identification and attributions determination of processes in a network

Reference - System and methods thereof for identification of suspicious system processes - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170286683A1/en
kb-abstract: A computerized method for identification of suspicious processes executing on an end-point device communicatively connected to network, the network communicatively connected to a server, the method comprising receiving, by the server, a record of at least one process, initiated by and executing on by the end-point device. One or more parameters associated with the at least one process are identified. A first time pointer is identified corresponding to the identified one or more parameters, a first time pointer. A second time pointer at which a user associated with the end-point device initiated a user dependent process is identified. Whether the second time pointer occurred before the first time pointer is identified. It is determined whether the at least one process was initiated by the user based on identification of user dependent processes and corresponding attribution. An action is performed based on the above determination.
kb-author: Gil BARAK
kb-is-example-of: Process Lineage Analysis
kb-mitre-analysis: The patent describes detecting malicious processes by identifying the order of process initiation. The start of a user initiated process (user query, opening an application, etc.) is compared with the start of processes initiated by the device (ex. during boot). In addition, a determination is made on whether processes are not initiated by a user by examining process parameters such as type of process, its creator, source, etc. If it is determined that a user initiated process was started before a process initiated by the device and a process was not initiated by the user, the process is marked as suspicious.
kb-organization: Palo Alto Networks Inc
kb-reference-title: System and methods thereof for identification of suspicious system processes

http://d3fend.mitre.org/ontologies/d3fend.owl#Reference_SystemAndMethodsThereofForLogicalIdentificationOfMaliciousThreatsAcrossAPluralityOfEnd-pointDevices(epd)CommunicativelyConnectedByANetwork_PaloA…
type: Patent Reference
type: NamedIndividual
label: Reference - System and methods thereof for logical identification of malicious threats across a plurality of end-point devices (epd) communicatively connected by a network - Palo Alto Networks IncCyber Secdo Ltd
has-link: https://patents.google.com/patent/US20180373870A1/en
kb-abstract: A computerized method for logical identification of malicious threats across a plurality of end-point devices (EPD) communicatively connected by a network, comprising collecting over the network an identifier associated with each file of a plurality of files, wherein each file of the plurality of files is installed on at least one of the plurality of EPDs and wherein the identifier is the same for each like file of the plurality of file. Information associated with an identified subset of files is collected, wherein the information indicates at least a time at which the at least one file was installed on one or more of the plurality of EPDs and the way the at least one file spread within the network. The collected information is analyzed according to a set of predetermined computerized investigation rules. The analysis is used to determine whether at least a file of the identified subset files is a suspicious file.
kb-author: Gil BARAK
kb-is-example-of: File Content Rules
kb-mitre-analysis: This patent describes detecting suspicious files using file metadata such as the prevalence of the file deployed on the network, file installation times, and how the file was spread within the network. The combination of these factors are used to determine a risk score of the file and if below a threshold, sends an alert.
kb-organization: Palo Alto Networks IncCyber Secdo Ltd
kb-reference-title: System and methods thereof for logical identification of malicious threats across a plurality of end-point devices (epd) communicatively connected by a network

Reference - System and methods thereof for preventing ransomware from encrypting data elements stored in a memory of a computer-based system - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170308711A1/en
kb-abstract: A computerized method for preventing ransomware from encrypting data elements stored in a memory of a computer-based system, the method comprising identifying at least one identifier for a data element, wherein the at least one identifier indicates at least a position of the data element within the memory. An optimal number of virtual traps is determined for the data element corresponding to the at least one identifier. An optimal position for each of the virtual traps is determined corresponding to the at least one identifier. The virtual traps are send to the determined optimal position within the memory.
kb-author: Gil BARAK
kb-is-example-of: Decoy File
kb-organization: Palo Alto Networks Inc
kb-reference-title: System and methods thereof for preventing ransomware from encrypting data elements stored in a memory of a computer-based system

Reference - System for detecting threats using scenario-based tracking of internal and external network traffic - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191563A1
kb-abstract: Disclosed is an improved approach to implement a system and method for detecting insider threats, where models are constructed that is capable of defining what constitutes the normal behavior for any given hosts and quickly find anomalous behaviors that could constitute a potential threat to an organization. The disclosed approach provides a way to identify abnormal data transfers within and external to an organization without the need for individual monitoring software on each host, by leveraging metadata that describe the data exchange patterns observed in the network.
kb-author: Nicolas BEAUCHESNE; David Lopes Pegna
kb-is-example-of: Per Host Download-Upload Ratio Analysis
kb-mitre-analysis: Determination of anomalous data transfers is performed over a given time period. For example, a check of a pull vs. push data ratio can be established over a specific time period, e.g., over a three-hour period, over a one day period, over a one week period, etc. The system can also establish a baseline behavior for data exchange for each host in terms of pull vs. push data ratio for each resource contacted by the host. Network packet capture data is collected and metadata is extracted. Aggregate data push/pull information from the metadata is then analyzed for a given host versus specific client to server relationships. This technique can potentially catch lateral data transfers, and may have filtering on alerting logic to only raise alarms when external hosts receive large data transfers.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: System for detecting threats using scenario-based tracking of internal and external network traffic

Reference - System for implementing threat detection using threat and risk assessment of asset-actor interactions - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191559A1
kb-abstract: Disclosed is an approach to detect insider threats, by tracking unusual access activity for a specific user or computer with regard to accessing key assets over time. In this way, malicious activity and the different preparation phases of attacks can be identified.
kb-author: Himanshu Mhatre; David Lopes Pegna; Oliver Brdiczka
kb-is-example-of: User Data Transfer Analysis
kb-mitre-analysis: The patent describes an insider threat detection system that analyzes packets sent within a network to identify and isolate malicious behavior. Current network traffic is collected and developed into a baseline that establishes the amount of data sent and received between a specific asset and a host. Current data transfer values are then compared with the baseline to identify anomalies.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: System for implementing threat detection using threat and risk assessment of asset-actor interactions

Reference - TPM 2.0 Library Specification - Trusted Computing Group, Incorporated
type: Specification Reference
type: NamedIndividual
has-link: https://trustedcomputinggroup.org/resource/tpm-library-specification/
kb-abstract: This specification defines the Trusted Platform Module (TPM) a device that enables trust in computing platforms in general. It is broken into parts to make the role of each part clear. All parts are required in order to constitute a complete standard. For a complete definition of all requirements necessary to build a TPM, the designer will need to use the appropriate platform-specific specification to understand all of the requirements for a TPM in a specific application or make appropriate choices as an implementer. Those wishing to create a TPM need to be aware that this specification does not provide a complete picture of the options and commands necessary to implement a TPM. To implement a TPM the designer needs to refer to the relevant platform-specific specification to understand the options and settings required for a TPM in a specific type of platform or make appropriate choices as an implementer.
kb-author: Trusted Computing Group
kb-is-example-of: TPM Boot Integrity
kb-organization: Trusted Computing Group, Incorporated
kb-reference-title: TPM 2.0 Library Specification

Reference - Tamper proof mutating software - ARXAN TECHNOLOGIES Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9262600B2/en
kb-abstract: System and method is disclosed for protecting client software running on a client computer from tampering using a secure server. Prior to or independent of executing the client software, the system integrates self-protection into the client software; removes functions from the client software for execution on the server; develops client software self-protection updates; and periodically distributes the updates. During execution of the client software, the system receives an initial request from the client computer for execution of the removed function; verifies the initial request; and cooperates with the client computer in execution of the client software if verification is successful. If verification is unsuccessful, the system can attempt to update the client software on the client computer; and require a new initial request. Client software can be updated on occurrence of a triggering event. Communications can be encrypted, and the encryption updated. Authenticating checksums can be used for verification.
kb-author: Kevin Dale Morgan
kb-is-example-of: Process Code Segment Verification
kb-organization: ARXAN TECHNOLOGIES Inc
kb-reference-title: Tamper proof mutating software

Reference - Threat detection for return oriented programming - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20140075556A1
kb-abstract: This disclosure describes, in part, techniques for detecting security exploits associated with return-oriented programming. The techniques include determining that a retrieved count is indicative of malicious activity, such as return oriented programming. The count may be retrieved from a processor performance counter of prediction mismatches, the prediction mismatches resulting from comparisons of a call stack of a computing device and of a shadow call stack maintained by a processor of the computing device. The techniques further include performing at least one security response action in response to determining that the count indicates malicious activity.
kb-author: Georg WICHERSKI
kb-is-example-of: Shadow Stack Comparisons
kb-mitre-analysis: This patent describes a technique for detecting shellcode security exploits. A call stack of a computing device is compared with a shadow call stack maintained by a processor of the computing device since a return oriented program may only be able to control or spoof the call stack and not the shadow call stack. Mismatches between the two are counted and if the number of mismatches exceeds a certain threshold it is an indication of malicious activity and a security response action is performed.
kb-organization: Crowdstrike Inc
kb-reference-title: Threat detection for return oriented programming

Reference - Threat detection through the accumulated detection of threat characteristics - Sophos Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9104864B2/en
kb-abstract: Embodiments of the present disclosure provide for improved capabilities in the detection of malware, where malware threats are detected through the accumulated identification of threat characteristics for targeted computer objects. Methods and systems include dynamic threat detection providing a first database that correlates a plurality of threat characteristics to a threat, wherein a presence of the plurality of the threat characteristics confirms a presence of the threat; detecting a change event in a computer run-time process; testing the change event for a presence of one or more of the plurality of characteristics upon detection of the change event; storing a detection of one of the plurality of characteristics in a second database that accumulates detected characteristics for the computer run-time process; and identifying the threat when each one of the plurality of characteristics appears in the second database.
kb-author: Clifford Penton; Irene Michlin
kb-is-example-of: Process Code Segment Verification
kb-organization: Sophos Ltd
kb-reference-title: Threat detection through the accumulated detection of threat characteristics

Reference - Use of an application controller to monitor and control software file and application environments - Sophos Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180032727A1
kb-abstract: In embodiments of the present invention, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation. In response to the selection of a file, an application controller may be used to select a software application from two or more software applications to open the selected file, based at least in part on the selected file's reputation. If launched, a software application may be configured to open the file in an environment, such as a virtual machine, quarantined environment, and the like, that is appropriate for the file based at least in part on the reputation information. A software application may be a secure software application configured to manage secure files, or an insecure software application configured to manage insecure files. The selected file, and communications relating to the selected software application, may be managed according to the selected software application's secure or insecure configuration. Further, the selected software application may associate reputation information with all files that are modified and/or created by the selected software application, including at least in part, reputation information matching that of the selected file.
kb-author: Andrew J. Thomas
kb-is-example-of: Dynamic Analysis
kb-mitre-analysis: This patent describes received files being open in an environment such as a virtual machine or quarantined environment to associate file reputation information that determines if a file is a threat.
kb-organization: Sophos Ltd
kb-reference-title: Use of an application controller to monitor and control software file and application environments

Reference - Virtualized process isolation - Advanced Micro Devices Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180081829A1
kb-abstract: Systems, apparatuses, and methods for implementing virtualized process isolation are disclosed. A system includes a kernel and multiple guest VMs executing on the system's processing hardware. Each guest VM includes a vShim layer for managing kernel accesses to user space and guest accesses to kernel space. The vShim layer also maintains a separate set of page tables from the kernel page tables. In one embodiment, data in the user space is encrypted and the kernel goes through the vShim layer to access user space data. When the kernel attempts to access a user space address, the kernel exits and the vShim layer is launched to process the request. If the kernel has permission to access the address, the vShim layer copies the data to a region in kernel space and then returns execution to the kernel.
kb-author: David A. Kaplan
kb-is-example-of: Hardware-based Process Isolation
kb-organization: Advanced Micro Devices Inc
kb-reference-title: Virtualized process isolation

Reference - What is NX/XD feature ? [sic] - Red Hat
type: Internet Article Reference
type: NamedIndividual
has-link: https://access.redhat.com/solutions/2936741
kb-abstract: What is NX/XD feature ? How to check whether NX/XD is enabled ? How to enable or disable NX/XD? NX/XD is a hardware cpu feature which is provided in almost all the hardware. Some BIOS has advanced option of enabling or disabling it. NX stands for No eXecute and XD stands for eXecute Disable. Both are same and is a technology used in processors to prevent execution of certain types of code.
kb-author: Red Hat
kb-is-example-of: Process Segment Execution Prevention
kb-organization: Red Hat
kb-reference-title: What is NX/XD feature?

Relay Pattern Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Outbound Internet Network Traffic
d3fend-id: D3-RPA
definition: The detection of an internal host relaying traffic between the internal network and the external network.
enables: Detect
kb-article: ## How it works A relay may use a variety of proxying, forwarding, or routing technologies to bridge a protected network with an external network. A defensive analytic to detect a relay network may compare the network sessions among multiple hosts. Hosts which have nearly similar network statistics may be part of a relay network. The statistics may include number of bytes sent to and from, time of session initiation, packet size, or packet arrival time data. ## Considerations Complex intranet VPNs or routing encapsulation may affect the detection analytics. In addition, unwanted packets might not be forwarded, and additional packets may be added at the relay, further complicating detection.
kb-reference: Reference - Malicious relay detection on networks - VECTRA NETWORKS Inc
synonym: Relay Network Detection
subclass of: Restriction
  on property: analyzes
  some values from: Outbound Internet Network Traffic
subclass of: Network Traffic Analysis

Remote Resource
type: Class
comment: In computing, a remote resource is a computer resource made available from one host to other hosts on a computer network. It is a device or piece of information on a computer that can be remotely accessed from another computer, typically via a local area network or an enterprise intranet.
subclass of: Resource

Router
type: Class
type: NamedIndividual
runs: Operating System
comment: A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. Data sent through the internet, such as a web page or email, is in the form of data packets. A packet is typically forwarded from one router to another router through the networks that constitute an internetwork (e.g. the Internet) until it reaches its destination node.
subclass of: Network Node

Script Execution Analysis
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: Script Application Process
d3fend-id: D3-SEA
definition: Analyzing the execution of a script to detect unauthorized user activity.
enables: Detect
kb-article: ## How it works Software installed on the host system hooks into a scripting engine to intercept commands before they are executed and block commands if they are determined to be harmful. Pattern matching is used to identify unauthorized commands or in the case of script files, a hash of the file is compared against hashes of known unauthorized script files. ## Considerations List of known unauthorized script files or regular expression patterns must be kept up to date to ensure detection of new threats.
kb-reference: Reference - Detecting script-based malware - Crowdstrike Inc
subclass of: Restriction
  on property: analyzes
  some values from: Script Application Process
subclass of: Process Analysis

Sender MTA Reputation Analysis
type: Message Analysis
type: Class
type: NamedIndividual
analyzes: Email
d3fend-id: D3-SMRA
definition: Characterizing the reputation of mail transfer agents (MTA) to determine the security risk in emails.
enables: Detect
kb-article: ## How it works The sender message transfer agent (MTA) trust rating can be considered an indicator of the level of security risk and/or a trust level associated with sender MTAs in an email header. The features considered in determining the trust rating may include: * Length of time MTA has interacted with the enterprise * Number of sender domains sending emails from the MTA * Number of recipients in the enterprise the MTA sends emails to * Number of emails received from this MTA * Number of email replies received from this MTA For example, higher values for the length of time an MTA has interacted with the enterprise, or number of emails received from an MTA can result in a higher trust rating. The trust rating categorizes the sender MTA as unrated, neutral, trusted, suspicious, or malicious. ## Considerations Legitimate emails from a sender MTA may receive a lower trust rating over time if the sender’s domain gets spoofed and is used to send unauthorized emails.
kb-reference: Reference - Systems and methods for detecting and/or handling targeted attacks in the email channel - Graphus Inc
subclass of: Restriction
  on property: analyzes
  some values from: Email
subclass of: Message Analysis

Sender Reputation Analysis
type: Message Analysis
type: Class
type: NamedIndividual
analyzes: Email
d3fend-id: D3-SRA
definition: Ascertaining sender reputation based on information associated with a message (e.g. email/instant messaging).
enables: Detect
kb-article: ## How it works Sender trust rating can be considered an indicator of the level of security risk and/or a trust level associated with a sender. The features considered in determining the trust rating include: * Length of time sender has sent emails to the enterprise * Number of recipients in the enterprise the sender interacts with * Sender vs. enterprise originated message ratio * Sender messages opened vs. not-opened ratio * Number of emails received from this sender * Number of emails replied to this sender * Number of emails from this sender not opened * Number of emails from this sender not opened that contain an attachment * Number of emails from this sender not opened that contain a URL * Number of emails sent to this sender * Number of email replies received from this sender. Higher values for the number of recipients the sender has interacted with or the number of emails received from the sender, for example, results in a higher trust rating. The trust rating can categorize the sender as unrated, neutral, trusted, suspicious, or malicious. ## Considerations Legitimate emails from a sender may receive a lower trust rating over time if the sender’s domain gets spoofed and is used to send unauthorized emails.
kb-reference: Reference - Systems and methods for detecting and/or handling targeted attacks in the email channel - Graphus Inc
subclass of: Restriction
  on property: analyzes
  some values from: Email
subclass of: Message Analysis

Service Binary Verification
type: System File Analysis
type: Class
type: NamedIndividual
analyzes: Operating System File
d3fend-id: D3-SBV
definition: Analyzing changes in service binary files by comparing to a source of truth.
enables: Detect
kb-article: ## How it works System service applications may originate from the operating system installation or third-party applications installed with administrative privileges. These services have an entry point of some executable file-- a binary or a script. Attackers sometimes modify these executables to launch their own code. Analyzing changes in these files may uncover unauthorized activity. ## Considerations * These files change for legitimate reasons when the system or software updates. * The source of truth must not be corrupted in order for this method to work.
kb-reference: Reference - CAR-2014-02-001: Service Binary Modifications - MITRE
verifies: Service Application
subclass of: Restriction
  on property: verifies
  some values from: Service Application
subclass of: System File Analysis

Session
type: Class
comment: In computer science, in particular networking, a session is a semi-permanent interactive information interchange, also known as a dialogue, a conversation or a meeting, between two or more communicating devices, or between a computer and user (see Login session). A session is set up or established at a certain point in time, and then torn down at some later point. An established communication session may involve more than one message in each direction. A session is typically, but not always, stateful, meaning that at least one of the communicating parts needs to save information about the session history in order to be able to communicate, as opposed to stateless communication, where the communication consists of independent requests with responses.
subclass of: Digital Artifact

Shadow Stack Comparisons
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: Stack Frame
d3fend-id: D3-SSC
definition: Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.
enables: Detect
kb-article: ## How it works This technique compares the call stack stored in system memory with the shadow call stack maintained in the cache memory of the processor. Mismatches between the two are compared since a return oriented programming attack may only be able to control or spoof the call stack and not the shadow call stack. Mismatches are counted and if the number of mismatches exceeds a certain threshold it is an indication of unauthorized activity and a security response action is performed. ## Considerations If the threshold for detecting a stack anomaly is low, it may not detect a return-oriented attack with just one gadget, such as a return-to-libc or return-to-plt attack. Additionally, this technique may not detect JOP (Jump-oriented programming), as the return instruction is not executed.
kb-reference: Reference - Threat detection for return oriented programming - Crowdstrike Inc
subclass of: Restriction
  on property: analyzes
  some values from: Stack Frame
subclass of: Process Analysis

Shortcut File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A shortcut file, or shortcut, is a handle that allows the user to find a file or resource located in a different directory or folder from the place where the shortcut is located. Shortcuts, which are supported by the graphical file browsers of some operating systems, may resemble symbolic links but differ in a number of important ways. One difference is what type of software is able to follow them: - Symbolic links are automatically resolved by the file system. Any software program, upon accessing a symbolic link, will see the target instead, whether the program is aware of symbolic links or not. - Shortcuts are treated like ordinary files by the file system and by software programs that are not aware of them. Only software programs that understand shortcuts (such as the Windows shell and file browsers) treat them as references to other files. Another difference are the capabilities of the mechanism: - Microsoft Windows shortcuts normally refer to a destination by an absolute path (starting from the root directory), whereas POSIX symbolic links can refer to destinations via either an absolute or a relative path. The latter is useful if both the location and destination of the symbolic link share a common path prefix[clarification needed], but that prefix is not yet known when the symbolic link is created (e.g., in an archive file that can be unpacked anywhere). - Microsoft Windows application shortcuts contain additional metadata that can be associated with the destination, whereas POSIX symbolic links are just strings that will be interpreted as absolute or relative pathnames. - Unlike symbolic links, Windows shortcuts maintain their references to their targets even when the target is moved or renamed. Windows domain clients may subscribe to a Windows service called Distributed Link Tracking to track the changes in files and folders to which they are interested. The service maintains the integrity of shortcuts, even when files and folders are moved across the netwo…
subclass of: File

Source Code Reference
type: Class
pref-label: Source Code
subclass of: Technique Reference

Standalone Honeynet
type: Decoy Environment
type: Class
type: NamedIndividual
d3fend-id: D3-SHN
definition: An environment created for the purpose of attracting attackers and eliciting their behaviors that is not connected to any production enterprise systems.
enables: Deceive
kb-article: ## How it works A standalone honeynet does not directly interact with the real enterprise environment. It may be located near or in some portion of the enterprise address space, but it does not interact with enterprise resources. ## Considerations A standalone honeynet is a lower risk to deploy compared to connected or integrated honeynets due to its isolation from the enterprise network. However, this comes at cost in loss of fidelity and realism. Significant extra effort must be made in order to make the environment look realistic.
kb-reference: Reference - Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network - Palo Alto Networks Inc
manages: Decoy Object
spoofs: Intranet Network
subclass of: Restriction
  on property: spoofs
  some values from: Intranet Network
subclass of: Decoy Environment

Static Analysis Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A static [program] analysis tool performs an automated analysis of computer software without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing. In most cases the analysis is performed on some version of the source code, and in the other cases, some form of the object code.
subclass of: Code Analyzer
alternative label: Static Program Analysis Tool

Strong Password Policy
type: Credential Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-SPP
definition: Modifying system configuration to increase password strength.
enables: Harden
kb-article: ## How it works Password strength guidelines include increasing password length, permitting passwords that contain ASCII or Unicode characters, and requiring systems to screen new passwords against lists of commonly used or compromised passwords. ## Considerations Extremely complex password requirements may lead users to saving passwords in text files or picking obvious passwords that meet the policy.
kb-reference: Reference - Digital Identity Guidelines 800-63-3
strengthens: Password
strengthens: User Account
subclass of: Restriction
  on property: strengthens
  some values from: Password
subclass of: Restriction
  on property: strengthens
  some values from: User Account
subclass of: Credential Hardening

System Software
type: Class
type: NamedIndividual
contains: Executable File
subclass of: Software

Exfiltration Over Physical Medium
type: Class
type: NamedIndividual
attack-id: T1052
enables: Exfiltration
subclass of: Exfiltration Technique

Trusted Developer Utilities Proxy Execution
type: Class
type: NamedIndividual
attack-id: T1127
enables: Defense Evasion
subclass of: Defense Evasion Technique

Traffic Signaling
type: Class
type: NamedIndividual
attack-id: T1205
enables: Command And Control
enables: Defense Evasion
enables: Persistence
produces: Network Traffic
comment: used all over so its not just internet traffic
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
subclass of: Command and Control Technique
subclass of: Defense Evasion Technique
subclass of: Persistence Technique

Signed Script Proxy Execution
type: Class
type: NamedIndividual
attack-id: T1216
enables: Defense Evasion
enables: Execution
subclass of: Defense Evasion Technique
subclass of: Execution Technique

Execution Guardrails
type: Class
type: NamedIndividual
attack-id: T1480
enables: Defense Evasion
subclass of: Defense Evasion Technique

Virtualization/Sandbox Evasion
type: Class
type: NamedIndividual
attack-id: T1497
enables: Defense Evasion
subclass of: Defense Evasion Technique

Software Discovery
type: Class
type: NamedIndividual
attack-id: T1518
enables: Discovery
subclass of: Discovery Technique

Man-in-the-Middle
type: Class
type: NamedIndividual
attack-id: T1557
enables: Collection
enables: Credential Access
produces: Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
subclass of: Collection Technique
subclass of: Credential Access Technique

TCG Trusted Attestation Protocol Use Cases for TPM Families 1.2 and 2.0 and DICE
type: Specification Reference
type: NamedIndividual
has-link: https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf
kb-reference-title: TCG Trusted Attestation Protocol Use Cases for TPM Families 1.2 and 2.0 and DICE

TPM Boot Integrity
type: Platform Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-TBI
definition: Assuring the integrity of a platform by demonstrating that the boot process starts from a trusted combination of hardware and software and continues until the operating system has fully booted and applications are running. Sometimes called Static Root of Trust Measurement (STRM).
enables: Harden
kb-article: ## How it works During the boot process, the BIOS boot block (which with this defense enabled, is the Core Root of Trust for Measurement) measures boot components (firmware, ROM). The TPM hashes those measurements and stores the hashes in Platform Configuration Registers (PCRs). Upon a subsequent boot, these hashes are provided to a verifier which compares the stored measurements to the new boot measurements. Integrity of the boot components is assured if they match. Attestation of the secure boot occurs when a verifying entity requests a Quote which is a concatenation of the requested PCR values, hashed and signed by the TPM's unique RSA key. The TPM signature is trusted because the private key is stored securely in hardware and never leaves the TPM. ## Considerations * The TPM does not perform the follow-on actions of acting on the PCR value information, it just provides the PCR stored information. * The current version of TPM is 2.0.; most existing implementations use TPM 1.2. ## Citations [1] [TPM 2.0 Library](https://trustedcomputinggroup.org/resource/tpm-library-specification/) [2] [TCG Trusted Attestation Protocol (TAP) Use Cases for TPM Families 1.2 and 2.0 and DICE](https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf)
kb-reference: Trusted Attestation Protocol Use Cases
synonym: STRM
synonym: Static Root of Trust Measurement
subclass of: Platform Hardening

Thin Client Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A thin client is a lightweight computer that has been optimized for establishing a remote connection with a server-based computing environment. The server does most of the work, which can include launching software programs, performing calculations, and storing data. This contrasts with a fat client or a conventional personal computer; the former is also intended for working in a client–server model but has significant local processing power, while the latter aims to perform its function mostly locally. Thin clients are shared computers as the thin client's computing resources are provided by a remote server.
subclass of: Shared Computer

Ticket Granting Ticket
type: Class
type: NamedIndividual
authenticates: User Account
comment: In some computer security systems, a Ticket Granting Ticket or Ticket to Get Tickets (TGT) is a small, encrypted identification file with a limited validity period. After authentication, this file is granted to a user for data traffic protection by the key distribution center (KDC) subsystem of authentication services such as Kerberos. The TGT file contains the session key, its expiration date, and the user's IP address, which protects the user from man-in-the-middle attacks. The TGT is used to obtain a service ticket from Ticket Granting Service (TGS). User is granted access to network services only after this service ticket is provided.
subclass of: Access Token
alternative label: Golden Ticket

Trust Store
type: Class
comment: Stores public information necessary to determine if another party can be trusted.
subclass of: Digital Artifact

Trusted Attestation Protocol Use Cases
type: Specification Reference
type: NamedIndividual
has-link: https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf
kb-article: ## Document Abstract This specification defines the Trusted Platform Module (TPM) a device that enables trust in computing platforms in general. It is broken into parts to make the role of each part clear. All parts are required in order to constitute a complete standard. For a complete definition of all requirements necessary to build a TPM, the designer will need to use the appropriate platform-specific specification to understand all of the requirements for a TPM in a specific application or make appropriate choices as an implementer. Those wishing to create a TPM need to be aware that this specification does not provide a complete picture of the options and commands necessary to implement a TPM. To implement a TPM the designer needs to refer to the relevant platform-specific specification to understand the options and settings required for a TPM in a specific type of platform or make appropriate choices as an implementer.
kb-reference-title: Trusted Attestation Protocol Use Cases

Utility Software
type: Class
type: NamedIndividual
contains: Executable File
comment: Utility applications are software applications designed to help to analyze, configure, optimize or maintain a computer. It is used to support the computer infrastructure - in contrast to application software, which is aimed at directly performing tasks that benefit ordinary users. However, utilities often form part of the application systems. For example, a batch job may run user-written code to update a database and may then include a step that runs a utility to back up the database, or a job may run a utility to compress a disk before copying files.
subclass of: Software
alternative label: Utility Application

Wireless Access Point
type: Class
type: NamedIndividual
runs: Operating System
comment: In computer networking, a wireless access point (WAP), or more generally just access point (AP), is a networking hardware device that allows other Wi-Fi devices to connect to a wired network. The AP usually connects to a router (via a wired network) as a standalone device, but it can also be an integral component of the router itself. An AP is differentiated from a hotspot which is a physical location where Wi-Fi access is available.
subclass of: Network Node
alternative label: WAP

addressed-by
type: ObjectProperty
comment: x addressed-by y: Relates a resource x (e.g., network host, peripheral device, disk sector, a memory cell or other logical or physical entity) to a discrete address y in an address space that points to it.
domain: Resource
range: Identifier
sub property of: associated-with
inverse of: addresses

attached-to
type: ObjectProperty
comment: x attached-to y: A subject x is joined in close association to an object y.
sub property of: associated-with

attack-kb-annotation
type: AnnotationProperty
comment: x attack-kb-annotation y: The offensive technique x has the kb annotation of y.
domain: Offensive Technique
sub property of: d3fend-annotation

authorizes
type: ObjectProperty
comment: x authorizes y: A subject x grants authorization or clearance for an agent y to use an object. This relation indicates an authorization event has occurred.
sub property of: associated-with

cited-by
type: ObjectProperty
comment: x cited-by y: The citation x is cited by the assertion y. Inverse of has-citation.
domain: Analysis Citation
range: Technique Assertion
sub property of: d3fend-analysis-object-property
inverse of: has-citation
alternative label: cited by

connects
type: ObjectProperty
comment: x connects y: The subject x joins system y by means of communication equipment (to some other system, typically the adversary-targeted host).
sub property of: associated-with

d3fend-id
type: DatatypeProperty
comment: Unique identifier for a D3FEND technique. D3-[Acronym].
sub property of: d3fend-kb-data-property

deletes
type: ObjectProperty
comment: x deletes y: A technique or agent x wipes out the digitally or magnetically recorded information of digital object y.
sub property of: modifies

developed-by
type: ObjectProperty
comment: x developed-by y: A product x is developed by a product developer y. Inverse of develops.
domain: Product
range: Product Developer
sub property of: d3fend-analysis-object-property
inverse of: develops

extends
type: ObjectProperty
comment: x extends y: The entity x extend the scope or range or area of entity y, especially in the sense of widen the range of applications.
sub property of: modifies

has-account
type: ObjectProperty
comment: x has-account y: The subject x has ownership or possession of some account y.
sub property of: owns

has-analysis
type: ObjectProperty
comment: x has-analysis y: The product x has been analyzed in the d3fend analysis y.
domain: Product
range: D3FEND Analysis
sub property of: d3fend-analysis-object-property

has-analyst
type: ObjectProperty
comment: x has-analyst y: The product analysis x has been created by the analyst y.
sub property of: d3fend-analysis-object-property

has-ancestor
type: ObjectProperty
comment: x has-ancestor y: The artifact x has an ancestor artifact y that created it.
sub property of: d3fend-analysis-object-property

has-date
type: DatatypeProperty
comment: x has-date y: The d3fend analysis x has the date y.
range: dateTime
sub property of: d3fend-analysis-data-property

has-expected-latency
type: ObjectProperty
comment: x has-expected-latency y: The technique assertion x has the expected analytic latency of y.
sub property of: has-latency

has-form-factor
type: ObjectProperty
comment: x has-form-factor y: The product x has the form factory y (e.g., 'Snort 2.9' has-form-factor "On-premises Software'.)
domain: Product
range: Form Factor
sub property of: d3fend-analysis-object-property

has-latency
type: ObjectProperty
comment: x has-latency y: The technique assertion x has the analytic latency of y.
domain: Technique Assertion
range: Analytic Latency
sub property of: d3fend-analysis-object-property

has-license
type: ObjectProperty
comment: x has-license y: The product x has the product license y.
domain: Product
range: License
sub property of: d3fend-analysis-object-property

has-location
type: ObjectProperty
comment: x has-location y: The entity x is situated in a particular spot or position y.
sub property of: associated-with
alternative label: located_in

has-name
type: DatatypeProperty
comment: x has-name y: The d3fend analysis x has the name y.
range: string
sub property of: d3fend-analysis-data-property

has-recipient
type: ObjectProperty
comment: x has_recipient y: An agent y is the intended recipient and decoder of the information contained in communication x.
sub property of: associated-with

has-reference-type
type: ObjectProperty
comment: x has-reference-type y: The analysis citation x is a reference type y (i.e., where y is a book, patent, etc.)
domain: Analysis Citation
range: Reference Type
sub property of: d3fend-analysis-object-property

has-reviewer
type: ObjectProperty
comment: x has-reviewer y: The d3fend analysis x has been reviewed by the analyst y.
domain: D3FEND Analysis
range: D3FEND Analyst
sub property of: d3fend-analysis-object-property

has-sender
type: ObjectProperty
comment: x has_sender y: An agent y is the sender and encoder of the information contained in communication x.
sub property of: associated-with

has-support-level
type: ObjectProperty
domain: Technique Assertion
range: Support Level
sub property of: d3fend-analysis-object-property

has-technique
type: ObjectProperty
comment: x has-technique y: The technique assertion x is asserting technique y is employed by the product being analyzed.
domain: Technique Assertion
range: Technique
sub property of: d3fend-analysis-object-property

has-technique-assertion
type: ObjectProperty
comment: x has-technique-assertion y: The technique assertion x is asserting technique y is employed by the product being analyzed.
domain: D3FEND Analysis
range: Technique Assertion
sub property of: d3fend-analysis-object-property

has-version
type: DatatypeProperty
comment: x has-version y: The product x has the version y.
domain: Product
range: string
sub property of: d3fend-analysis-data-property

installs
type: ObjectProperty
comment: x installs y: An entity x sets up a digital artifact y for subsequent use. For example, an installation program can install application software.
sub property of: associated-with

interprets
type: ObjectProperty
comment: x interprets y: The subject x interprets the executable script y. The sense of interprets is here 'Parse the source code and perform its behavior directly.'
sub property of: executes
sub property of: may-interpret

is-complete
type: DatatypeProperty
comment: x is-complete y: For the d3fend product analysis x the truth value y states whether the is d3fend team deems the analysis completed.
domain: D3FEND Analysis
range: boolean
sub property of: d3fend-analysis-data-property

kb-reference
type: ObjectProperty
sub property of: d3fend-kb-object-property
alternative label: has-technique-reference

kb-reference-title
type: DatatypeProperty
comment: x kb-reference-title y: The d3fend knowledge base reference x has the reference title string y.
domain: Reference
range: string
sub property of: d3fend-kb-data-property

limits
type: ObjectProperty
comment: x limits y: An entity x specifies a designated limit beyond which some entity y cannot function or must be terminated.
sub property of: associated-with
alternative label: cutoff

neutralizes
type: ObjectProperty
comment: x neutralizes y: The technique x makes the execution of actions of y ineffective by preventing or counterbalancing the effect of y.
sub property of: associated-with

owns
type: ObjectProperty
comment: x owns y: The subject x has ownership or possession of some object y.
sub property of: associated-with
alternative label: possesses

pref-label
type: AnnotationProperty
type: DatatypeProperty
comment: x pref-label y: The preferred display value for x is y in d3fend tools.
sub property of: d3fend-annotation
sub property of: d3fend-display-property

process-ancestor
type: ObjectProperty
type: TransitiveProperty
comment: x process-ancestor y: The process y is a process ancestor of process x, indicating one or more process creation events were conducted were started at process y and subsequently created process x.
sub property of: process-property

process-command-line-arguments
type: DatatypeProperty
comment: x process-command-line-arguments y: The process x has the process command line arguments data y.
sub property of: process-data-property

process-environmental-variables
type: DatatypeProperty
comment: x process-environment-variables y: The process x has the process environmental variables data y.
sub property of: process-data-property
alternative label: process-environmental-variable

process-identifier
type: DatatypeProperty
comment: x process-identifier y: The process x has the process identifier y.
sub property of: process-data-property

process-image-path
type: ObjectProperty
comment: x process-image-path y: The filepath y is the process image path for the process x, indicating the path to the resource from which the process's image was loaded.
sub property of: process-property
alternative label: processImagePath

process-security-context
type: DatatypeProperty
comment: x process-security-context y: The process x has the process security context data y.
domain: Process
sub property of: process-data-property

process-user
type: ObjectProperty
comment: x process-user y: The process x has been executed by the user y.
sub property of: process-property
alternative label: processUser

summarizes
type: ObjectProperty
comment: x summarizes y: The sensor x summarizes a set y of events concerning digital artifacts over time
sub property of: associated-with

terminates
type: ObjectProperty
comment: x terminates y: The technique x brings to an end or halt to some activity y.
sub property of: associated-with
alternative label: aborts

unmounts
type: ObjectProperty
comment: x unmounts y: An operation x removes the access via computer system's file system the availability of files and directories on a storage artifact y. Unmounts reverse or undo prior mount operations.
sub property of: associated-with

use-limits
type: ObjectProperty
comment: x use-limits y: An entity x specifies a designated number of uses beyond which some entity y cannot function or must be terminated.
sub property of: limits

validates
type: ObjectProperty
comment: x validates y: The technique x proves the digital artifact y is valid; that is, x shows or confirms the validity of y.
sub property of: associated-with

windows-registry-key
type: DatatypeProperty
comment: x value y: The key-value pair x has the key y.
sub property of: windows-registry-data-property
alternative label: key

windows-registry-value
type: DatatypeProperty
comment: x value y: The key-value pair x has the data value y.
sub property of: windows-registry-data-property
alternative label: value

ATTACK Thing
type: Class
comment: ATTACK things are concepts defined in the ATT&CK Framework.

Account Locking
type: Credential Eviction
type: Class
type: NamedIndividual
d3fend-id: D3-AL
definition: The process of temporarily disabling user accounts on a system or domain.
disables: User Account
enables: Evict
kb-article: ## How it works Management servers with enterprise policies for account management provide the ability to enable and disable account for given rules. The rules may include specific periods of time (eg. weekend, plant shutdown, leave periods), specific user types or groups, or individual users. ## Considerations * Local accounts caches vs centralized account management * Single Sign-on * Role based vs Attribute based systems ## Examples of account configuration stores * Directory Services * Active Directory * RADIUS * LDAP * Oracle User Account Management * JumpCloud
kb-reference: Reference - Account monitoring - Forescout Technologies
kb-reference: Reference - Framework for notifying a directory service of authentication events processed outside the directory service - Oracle International Corp
subclass of: Restriction
  on property: disables
  some values from: User Account
subclass of: Credential Eviction

Active Certificate Analysis
type: Certificate Analysis
type: Class
type: NamedIndividual
analyzes: Certificate File
d3fend-id: D3-ACA
definition: Actively collecting PKI certificates by connecting to the server and downloading its server certificates for analysis.
enables: Detect
kb-article: ## How it works Analysis of server certificates using active methods to detect if certificates have been misconfigured or spoofed by using elements of the certificate, certificate authorities and signatures. ### Certificate validity analysis This can be accomplished by verifying the digital signature on certificate. ### Certificate path analysis The client’s browser can perform path verification to ensure that the server’s certificate contains a valid trust anchor. ### Certificate configuration analysis Some browsers can be configured to implement the key-usage extensions contained certificates. This can help to prevent a certificate from being misused. ### Certificate revocation status analysis Using either Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) to determine the revocation status. OCSP Stapling, binding the status with the certificate, helps to mitigate potential delay in status verifications. ## Considerations * Management of the PKI across the enterprise typically requires automation to maintain scalability and flexibility * If the certificate authority, issuing the certificate, is compromised then all of the certificates issued by the CA are suspect * There may be delays associated with updates to certificates * Revoked certificates give the appearance of valid certificates until they are published to a trusted revocation service (OCSP or CRL) * The revocation service (OCSP or CRL) may be down during our connection and a browser will need to make a decision will need to be made about trusting the connection
kb-reference: Reference - Securing Web Transactions
subclass of: Certificate Analysis

Artifact
type: Class
comment: A man-made object taken as a whole.
subclass of: D3FEND Thing

Artifact Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A digital artifact server provides access services to digital artifacts in a repository. It provides an associated set of data management, search and access methods allowing application-independent access to the content.
subclass of: Web Server

Asymmetric Key
type: Class
comment: Asymmetric keys are public and private keys, paired such that asymmetric (public-key) cryptography algorithms can be implemented using them. Public-key cryptography, or asymmetric cryptography, is any cryptographic system that uses pairs of keys: public keys that may be disseminated widely paired with private keys which are known only to the owner. There are two functions that can be achieved: using a public key to authenticate that a message originated with a holder of the paired private key; or encrypting a message with a public key to ensure that only the holder of the paired private key can decrypt it.
subclass of: Cryptographic Key

Audio Input Device
type: Class
type: NamedIndividual
comment: Audio input devices allow a user to send audio info to a computer for processing, recording, or carrying out commands. Devices such as microphones allow users to speak to the computer in order to record a voice message or navigate software. Aside from recording, audio input devices are also used with speech recognition software.
subclass of: Input Device

Authentication Cache Invalidation
type: Credential Eviction
type: Class
type: NamedIndividual
d3fend-id: D3-ANCI
definition: Removing tokens or credentials from an authentication cache to prevent further user associated account accesses.
disables: Credential
enables: Evict
kb-article: ## How it works Applications can locally cache user authentication credentials for certain server connections. An application may attempt to use the cached credential for a connection. If the cached credentials exist then the user will not be typically prompted for new credentials. ## Considerations Are these cached credentials only on the local host? Can they be persisted to the remote server? ## Examples Windows Credential Management API
kb-reference: Reference - Secure caching of server credentials - Dell Products LP
kb-reference: Reference - System and method for providing an actively invalidated client-side network resource cache - IMVU
subclass of: Restriction
  on property: disables
  some values from: Credential
subclass of: Credential Eviction

Authorization Service
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An authorization service ensures that the user is authorized to have access to a particular resource. Authorization can be done through role-based access control (RBAC) or list-based access control (LBAC).
subclass of: Service Application

Binary Segment
type: Class
comment: A binary segment is a partition of binary information within a larger binary object, which arranges a set of binary objects for its purpose. For example, code, data, heap, and stack segments are segments of the binary information used by a process. Code and data segments are also found in object files.
subclass of: Digital Artifact

Block Device
type: Class
type: NamedIndividual
contains: Boot Sector
contains: Partition
contains: Partition Table
may-contain: Volume
comment: A block device (or block special file) provides buffered access to hardware devices, and provides some abstraction from their specifics. IEEE Std 1003.1-2017: A file that refers to a device. A block special file is normally distinguished from a character special file by providing access to the device in a manner such that the hardware characteristics of the device are not visible.
subclass of: Restriction
  on property: contains
  some values from: Boot Sector
subclass of: Restriction
  on property: may-contain
  some values from: Volume
subclass of: Restriction
  on property: contains
  some values from: Partition
subclass of: Restriction
  on property: contains
  some values from: Partition Table
subclass of: Digital Artifact
alternative label: Block Special File

Broadcast Domain Isolation
type: Network Isolation
type: Class
type: NamedIndividual
d3fend-id: D3-BDI
definition: Broadcast isolation restricts the number of computers a host can contact on their LAN.
enables: Isolate
filters: Local Area Network Traffic
kb-article: ## How it works Software Defined Networking, or other network encapsulation technologies intercept host broadcast traffic then route it to a specified destination per a configured policy. This can be implemented within hypervisors, networking hardware (WAPs, switches, routers), or virutal hardware. ## Considerations This technique is highly dependent on network infrastructure and networking requirements.
kb-reference: Reference - Private virtual local area network isolation - Cisco Technology Inc
synonym: Network Segmentation
subclass of: Restriction
  on property: filters
  some values from: Local Area Network Traffic
subclass of: Network Isolation

Browser
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
may-contain: Browser Extension
uses: Resource
comment: A web browser (commonly referred to as a browser) is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier (URI/URL) and may be a web page, image, video or other piece of content. Hyperlinks present in resources enable users easily to navigate their browsers to related resources. Although browsers are primarily intended to use the World Wide Web, they can also be used to access information provided by web servers in private networks or files in file systems.
subclass of: Restriction
  on property: may-contain
  some values from: Browser Extension
subclass of: User Application

Build Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A tool that automates the process of creating a software build and the associated processes including: compiling computer source code into binary code, packaging binary code, and running automated tests.
subclass of: Developer Application
alternative label: Build Automation Tool

Byte Sequence Emulation
type: Network Traffic Analysis
type: Class
type: NamedIndividual
d3fend-id: D3-BSE
definition: Analyzing sequences of bytes and determining if they likely represent malicious shellcode.
enables: Detect
kb-article: ## How it works Bytes are analyzed as if they are machine code instructions, and such instructions that are a common component of known shellcode are noted, such as stack pivots, reads from a Memory Address Table, and system calls for functions that disable protections or execute code. For example, the x86 instruction `b0 0b: mov $11, %ax`, with no further alterations to the `%ax` register, followed by `cd 80: syscall` executes the system call `execve()` in the Linux kernel, which replaces the current process with another one specified -- this is a common action in shellcode, so this sequence would be flagged. This technique detects shellcode despite whether or not it would cause a buffer overflow in the target binary. If the sequence of bytes contains a sequence similar to that used in malicious shellcode, the entire byte sequence is flagged and a follow-on technique may be invoked. ## Considerations ### False Negatives If the shellcode instructions are far apart, simple implementations might not detect the shellcode. Due to the nature of assembly instructions not having a defined start or end, implementations which do not process all start sequences (for example, when they a find byte sequence of interest, continue scanning forwards from the end of it) might not detect the shellcode. This technique might not detect more complex or obfuscated instructions. For that purpose, Dynamic Analysis or Emulated File Analysis could assist by analyzing the actual instruction function. This technique may not detect self-modifying code. To make it harder for a process to modify itself, Process Segment Execution Prevention should be used, while noting its considerations. This technique might not detect malicious shellcode which reuses instructions in the target binary for malicious effect, as memory references in the presumed assembly code are not dereferenced. Dynamic Analysis and Emulated File Analysis, when set up properly to fork from the running target binary, might detect …
kb-reference: Reference - Network-level polymorphic shellcode detection using emulation
kb-reference: Reference - Network-Based Buffer Overflow Detection by Exploit Code Analysis - Information Security Research Centre
synonym: Shellcode Transmission Detection
subclass of: Network Traffic Analysis

Certificate Pinning
type: Credential Hardening
type: Class
type: NamedIndividual
authenticates: Public Key
d3fend-id: D3-CP
definition: Persisting either a server's X509 certificate or their public key and comparing that to server’s presented identity to allow for greater client confidence in the remote server's identity for SSL connections.
enables: Harden
kb-article: ## How it works Pinning allows for a trusted copy of a certificate or public key to be associated with a server and thus reducing the likelihood of frequently visited sites being subjected to man-in-the-middle attacks. Certificates or public keys can be pinned after a trusted connection has been established or the pinning can be preloaded in an application, which is the preferred method for mobile applications. Pinning can take the form of certificate pinning or public key pinning. ## Forms of Pinning * Certificate Pinning Certificate Pinning (CP) allows for the client to verify the X509 certificate with a preloaded certificate. Typically, this is involves storing a hash of the certificate and using the stored hash for comparison to the hash of the certificate submitted during the SSL handshake. * Public Key Pinning Public Key Pinning (PKP) requires the extraction of a public key from server’s certificate. The stored public key is compared to the server’s presented public key. A public key is expected to rotate less frequently than an X509 certificate and is generally favored over certificate pinning. An extension of PKP is Subject Public Key Information Pinning (SPKI) includes public key pinning plus additional information for SSL connections. The additional information can include preferred algorithms. ## Considerations * With pinned certificates whenever a server updates its certificate, the pinned certificates will also need to be updated * With pinned public keys the extracted key may be subject to key refresh policies but much less frequently * Websites can become unavailable if pinned objects are set and not updated with the rotated identities. This may require a pinning strategy to be developed.
kb-reference: Reference - Certificate and Public Key Pinning
kb-reference: Reference - End-to-end certificate pinning
subclass of: Restriction
  on property: authenticates
  some values from: Public Key
subclass of: Credential Hardening

Certificate Trust Store
type: Class
type: NamedIndividual
contains: Certificate
comment: A certificate truststore is used to store public certificates used to authenticate clients by the server for an SSL connection.
subclass of: Restriction
  on property: contains
  some values from: Certificate
subclass of: Trust Store

Client Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A client application is software that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network. The term applies to the role that programs or devices play in the client–server model
subclass of: Application

Clipboard
type: Class
type: NamedIndividual
comment: The clipboard is a buffer that some operating systems provide for short-term storage and transfer within and between application programs. The clipboard is usually temporary and unnamed, and its contents reside in the computer's RAM. The clipboard is sometimes called the paste buffer. Windows, Linux and macOS support a single clipboard transaction. Each cut or copy overwrites the previous contents. Normally, paste operations copy the contents, leaving the contents available in the clipboard for further pasting.
subclass of: Digital Artifact

Cloud Instance Metadata
type: Class
type: NamedIndividual
comment: Cloud instance metadata is configuration information on the instance and users of the instance. This includes such information as security groups, public ip addresses, and private addresses, public keys configured, and event rotating security keys. User data can contain initialization scripts, variables, passwords, and more.
subclass of: Cloud Configuration Information

Code Analyzer
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Code analyzers automatically analyze the composition or behavior of computer programs regarding a property such as correctness, robustness, security, and safety. Program analysis can be performed without executing the program (static program analysis), during runtime (dynamic program analysis) or in a combination of both.
subclass of: Developer Application
alternative label: Program Analysis Tool

Compiler
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
reads: Compiler Configuration File
uses: Resource
comment: In computing, a compiler is a computer program that translates computer code written in one programming language (the source language) into another language (the target language). The name "compiler" is primarily used for programs that translate source code from a high-level programming language to a lower level language (e.g., assembly language, object code, or machine code) to create an executable program.
subclass of: Restriction
  on property: reads
  some values from: Compiler Configuration File
subclass of: Build Tool

Container Image
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another. A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries and settings. Container images become containers at runtime and in the case of Docker containers - images become containers when they run on Docker Engine. Available for both Linux and Windows-based applications, containerized software will always run the same, regardless of the infrastructure. Containers isolate software from its environment and ensure that it works uniformly despite differences for instance between development and staging.
subclass of: File

Container Orchestration Software
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
subclass of: Service Application

Credential Management System
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Credential Management, also referred to as a Credential Management System (CMS), is an established form of software that is used for issuing and managing credentials as part of public key infrastructure (PKI).
subclass of: Service Application

Cryptographic Key
type: Class
comment: In cryptography, a key is a piece of information (a parameter) that determines the functional output of a cryptographic algorithm. For encryption algorithms, a key specifies the transformation of plaintext into ciphertext, and vice versa for decryption algorithms. Keys also specify transformations in other cryptographic algorithms, such as digital signature schemes and message authentication codes.
subclass of: Digital Artifact

Custom Archive File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A custom archive file is an archive file conforming to a custom format; that is, an archive file that does not conform to a common standard.
subclass of: Archive File

Decoy Persona
type: Decoy Object
type: Class
type: NamedIndividual
d3fend-id: D3-DP
definition: Establishing a fake online identity to misdirect, deceive, and or interact with adversaries.
enables: Deceive
kb-article: ## How it works A false online identity is created for the purposes of interacting with adversaries in a direct or indirect manner. This includes the associated email addresses, social media accounts, and other online communication profiles. ## Considerations * Include phone numbers and online social profiles as well as automatically or manually responding to contact made to the persona to improve realism. * Continuous updating and managing the decoy personas and online activity streams to ensure personas do not become stale and outdated.
kb-reference: Reference - Decoy and deceptive data object technology - Cymmetria, Inc.
kb-reference: Reference - Decoy Personas for Safeguarding Online Identity Using Deception -
spoofs: User
subclass of: Restriction
  on property: spoofs
  some values from: User
subclass of: Decoy Object

Default User Account
type: Class
type: NamedIndividual
comment: Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems or default factory/provider set accounts on other types of systems, software, or devices.
subclass of: User Account

Digital Object
type: Class
comment: A digital object is the top-level class for an information bearing object that exists in a digital environment. The digital object may be virtual or physical.
subclass of: D3FEND Thing

Display Adapter
type: Class
type: NamedIndividual
comment: A graphics card (also called a display card, video card, display adapter, or graphics adapter) is an expansion card which generates a feed of output images to a display device (such as a computer monitor). Frequently, these are advertised as discrete or dedicated graphics cards, emphasizing the distinction between these and integrated graphics. At the core of both is the graphics processing unit (GPU), which is the main part that does the actual computations, but should not be confused with the video card as a whole, although "GPU" is often used to refer to video cards.
subclass of: Output Device
alternative label: Display Card
alternative label: Graphics Adapter
alternative label: Video Card

Display Server
type: Class
type: NamedIndividual
comment: A display server or window server is a program whose primary task is to coordinate the input and output of its clients to and from the rest of the operating system, the hardware, and each other. The display server communicates with its clients over the display server protocol, a communications protocol, which can be network-transparent or simply network-capable. The display server is a key component in any graphical user interface, specifically the windowing system.
subclass of: Digital Artifact
alternative label: Window Server

Driver Load Integrity Checking
type: Platform Hardening
type: Class
type: NamedIndividual
authenticates: Hardware Driver
d3fend-id: D3-DLIC
definition: Ensuring the integrity of drivers loaded during initialization of the operating system.
enables: Harden
kb-article: ## How it works This technique can be accomplished in a number of ways: * A kernel level security agent installed on a host machine ensures that the driver associated with the agent is first in the initialization order. A dependent DLL associated with the driver is configured to be processed before other dependent DLLs and executes a number of operations to ensure the driver associated with the security agent is initialized first. * Kernel components can be signed by a certificate obtained by a third party to verify the source of the component and whether it has been modified. When signed, the component will include a signature block implemented as a hash value of the component header and can also include a certificate chain. The signature and certificate data are typically added before the kernel component is distributed to the public. ## Considerations * The private keys to sign certificates as reputable companies have been stolen in the past -- in cases such as where certificates from Adobe, Realtek, and JMicron have been used to sign malicious executables. (Source: https://resources.infosecinstitute.com/cybercrime-exploits-digital-certificates/#gref) * Trusted Root Certificate Authorities have been compromised, yielding the ability to use the compromised keys to generate certificates with an arbitrary company name. * It may not be difficult for an attacker to start an organization which can obtain a signed certificate. * A root certificate authority (CA) whose certificate is trusted in the verification logic could generate incorrect certificates, if they are lax or have ulterior motives.
kb-reference: Reference - Integrity assurance through early loading in the boot phase - Crowdstrike Inc
kb-reference: Reference - Protected computing environment - Microsoft Technology Licensing LLC
subclass of: Restriction
  on property: authenticates
  some values from: Hardware Driver
subclass of: Platform Hardening

Dynamic Analysis
type: File Analysis
type: Class
type: NamedIndividual
analyzes: Document File
analyzes: Executable File
d3fend-id: D3-DA
definition: Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader.
enables: Detect
kb-article: ## How it works Analyzing the interaction of a piece of code with a system while the code is being executed in a controlled environment such as a sandbox, virtual machine, or simulator. This exposes the natural behavior of the piece of code without requiring the code to be disassembled. ## Considerations * Malware often detects a fake environment, then changes its behavior accordingly. For example, it could detect that the system clock is being sped up in an effort to get it to execute commands that it would normally only execute at a later time, or that the hardware manufacturer of the machine is a virtualization provider. * Malware can attempt to determine if it is being debugged, and change its behavior accordingly. * For maximum fidelity, the simulated and real environments should be as similar as possible because the malware could perform differently in different environments. * Sometimes the malware behavior is triggered only under certain conditions (on a specific system date, after a certain time, or after it is sent a specific command) and can’t be detected through a short execution in a virtual environment. ## Implementations * [Cuckoo Sandbox](https://cuckoosandbox.org)
kb-reference: Reference - Malware analysis system - Palo Alto Networks Inc
kb-reference: Reference - Use of an application controller to monitor and control software file and application environments - Sophos Ltd
synonym: Malware Detonation
synonym: Malware Sandbox
subclass of: Restriction
  on property: analyzes
  some values from: Executable File
subclass of: Restriction
  on property: analyzes
  some values from: Document File
subclass of: File Analysis

Eviction Latency
type: Class
subclass of: Latency

Executable Allowlisting
type: Platform Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-EAL
definition: Using a digital signature to authenticate a file before opening.
enables: Isolate
kb-article: ## How it works This technique is generic and there are numerous ways to compute and authenticate digital signatures. A digital certificate is generated from a private/public key pair issued by a certificate authority (CA). A hash of the file is encrypted using the private key. When the file is downloaded by another user, the user’s system uses the public key to decrypt the hash and a new hash is created of the downloaded file. The hash decrypted by the public key is compared to the new hash and if there is a mismatch, further techniques, such as file deletion, file quarantine, or **Executable Blacklisting** may be invoked. This technique may be invoked when deciding whether to execute a file. ## Considerations Organizations which download or create high volumes of software make management complex, in particular engineering or scientific organizations.
kb-reference: Reference - Computing apparatus with automatic integrity reference generation and maintenance - Tripwire, Inc.
kb-reference: Reference - Enhancing Network Security By Preventing User-Initiated Malware Execution -
synonym: File Signature Authentication
verifies: Executable Binary
subclass of: Restriction
  on property: verifies
  some values from: Executable Binary
subclass of: Execution Isolation

Executable Denylisting
type: Execution Isolation
type: Class
type: NamedIndividual
blocks: Executable File
d3fend-id: D3-EDL
definition: Blocking the execution of files on a host in accordance with defined application policy rules.
enables: Isolate
kb-article: ## How it works #### Criteria A policy-enforcing application can register an application for denylisting based on conditions including the following: * File attributes * file name * file path * file hash * file publisher, as obtained from the digital signature * permissions of the file * File malware scan (eg. Windows SmartScreen) * User-File combination This may be done to prevent execution of applications which are: * an old version with known vulnerabilities * without a valid license, which could cause legal issues * in a directory that is accessible to low-privileged users, that could be accessed by a malware dropper * known trojan horse programs * too open in their permissions, possibly set to run as a user other than the originator or allowing execution when they should not be * a match to the hash of other known malware * are detected as undesirable based on a file scan runtime behavior System administrators will customize the rules for the given environment. #### Backend The policy-enforcing program may work by running in kernel mode, and [intercepting] [system calls which execute a process]. ## Considerations * If denylisting is done by filename, filepath, or hash, these mechanisms may be a worthy first line of defense and detection, but could still be evaded by an attacker. * Continuous management is needed to keep the denylist up to date, whether it is based on hash, publisher, behavior, or any other digital artifact. * Although denylists based on attributes such as file path and virus scan could defend against some threats which they have not been explicitly coded to block, denylists may not provide protection from new, unknown, or zero day attacks. ## Examples On a Windows machine the Windows Defender Application Control (WDAC) policy enforcement is run in the kernel and allows for restricting applications.
kb-reference: Reference - Content extractor and analysis system - Bit 9 Inc, Carbon Black Inc
kb-reference: Reference - Method and apparatus for increasing the speed at which computer viruses are detected - McAfee LLC
synonym: Executable Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: Executable File
subclass of: Execution Isolation

File System
type: Class
type: NamedIndividual
contains: Directory
contains: File
contains: File System Link
contains: File System Metadata
comment: In computing, a file system or filesystem is used to control how data is stored and retrieved. Without a file system, information placed in a storage medium would be one large body of data with no way to tell where one piece of information stops and the next begins. By separating the data into pieces and giving each piece a name, the information is easily isolated and identified. Taking its name from the way paper-based information systems are named, each group of data is called a "file". The structure and logic rules used to manage the groups of information and their names is called a "file system".
subclass of: Restriction
  on property: contains
  some values from: File
subclass of: Restriction
  on property: contains
  some values from: File System Metadata
subclass of: Restriction
  on property: contains
  some values from: File System Link
subclass of: Restriction
  on property: contains
  some values from: Directory
subclass of: Digital Artifact

Firmware Behavior Analysis
type: Restriction
  on property: enables
  some values from: Platform Monitoring
type: Restriction
  on property: analyzes
  some values from: Firmware
type: Restriction
  on property: enables
  some values from: Detect
type: Restriction
  on property: monitors
  some values from: Platform
type: Platform Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-FBA
definition: Analyzing the behavior of embedded code in firmware and looking for anomalous behavior and suspicious activity.
enables: Detect
kb-article: ## How it works Firmware behavior analysis provides protections by ensuring that installed firmware has not been tampered with or modified. Firmware analysis applies to mutable firmware and immutable read-only memory (ROMs). Firmware in deployed network devices is typically not analyzed and monitored for vulnerabilities and thus is subject to potential attacks. This technique makes use of known and measured behavioral attributes, including timing attributes, of analyzed firmware on deployed devices. A behavioral method that employs known timing measurements may use the timing results from a challenge and response protocol to detect the presence of malware in embedded firmware. Firmware device timing measurements are made, specific to the installed device, and are used in the verifying function. The original firmware image is modified by injecting a monitoring software component into the embedded firmware code. The injected software components will allow for a software root of trust, the challenge and response protocol, to be implement in the firmware. A challenge-response is issued and includes a nonce so that replays are not allowed. The firmware will calculate a checksum over all of memory, including the nonce, and return the result. The verification system will compare the computed checksum and the time it took for the computation of the checksum to determine if the firmware has been modified. ## Considerations * The firmware code will need to be modified to include the behavioral monitoring functionality. * This technique is sensitive to the device the embedded firmware is hosted on and it is expected that the devices and firmware will need to be profiled and analyzed to determine timing estimation. * This technique is not expected to be one hundred percent correct as you would expect in a hardware root of trust solution and may require some tuning.
kb-reference: Reference - Firmware Behavior Analysis ConFirm
kb-reference: Reference - Firmware Behavior Analysis VIPER
synonym: Firmware Timing Analysis
subclass of: Platform Monitoring

Firmware Embedded Monitoring Code
type: Restriction
  on property: monitors
  some values from: Platform
type: Restriction
  on property: analyzes
  some values from: Firmware
type: Restriction
  on property: enables
  some values from: Detect
type: Restriction
  on property: enables
  some values from: Platform Monitoring
type: Platform Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-FEMC
definition: Monitoring code is injected into firmware for integrity monitoring of firmware and firmware data.
enables: Detect
kb-article: ## How it works Firmware in deployed network devices is typically not monitored for malicious changes. This technique provides a method to embed a software security component into the deployed firmware which provides a near real-time monitoring hook. The exception handling code, in the firmware, is typically used to expose any detected vulnerabilities. The injected software components provide a feature similar to intrusion detection systems for the firmware by detecting unauthorized modifications of the embedded firmware. The integrity of static code and firmware data are monitored continuously in the hosted devices. Comparisons are made to monitored elements like firmware memory addresses and data segments. Memory pages are scanned and if a modification is detected the software component may lock the page. This will protect subsequent attempted modifications to the firmware. The software component may utilize the exception handling code and thus be able to disclose the exact address of the modified memory. The injected software components are inserted during the firmware imaging process. The injected software is assumed to have knowledge of both the embedded code and the current execution state of the host program. The injected software will monitor and alert, in near real-time, on potential suspicious activity. The injected code is run alongside of the embedded code in the host. The injected software operates as an independent entity and is not dependent on the host software. Finally, this technique may implement other countermeasure techniques as part of their analytical processes. These should be identified by referencing other countermeasure techniques directly as necessary. ## Considerations * The firmware code will need to be modified and re-hosted on the device. * Exposing monitoring hooks to the injected code may introduce additional risk.
kb-reference: Reference - Firmware Embedded Monitoring Code Red Balloon
kb-reference: Reference - Firmware Embedded Monitoring Code Symbiotes
subclass of: Platform Monitoring

Form Factor
type: Class
comment: The form factor a given product may take, such as an appliance or software as a service (SaaS).
subclass of: D3FEND Analysis Thing

Get System Time
type: Class
type: NamedIndividual
executes: Subroutine
comment: A system call that gets the system time. For POSIX.1 systems, time() invokes a call to get the system time.
subclass of: System Call

Global User Account
type: Class
type: NamedIndividual
comment: A type of user account in Microsoft Windows (NT) that has a domain-wide scope.defines that user's access to a logical group of network objects (computers, users, devices) that share the same Active Directory databases; that is, a user's access to the domain.
subclass of: Domain User Account

Graphical User Interface
type: Class
type: NamedIndividual
comment: A graphical user interface (GUI) is a type of user interface that allows users to interact with electronic devices through graphical icons and visual indicators such as secondary notation, instead of text-based user interfaces, typed command labels or text navigation. GUIs were introduced in reaction to the perceived steep learning curve of command-line interfaces (CLIs), which require commands to be typed on a computer keyboard.
subclass of: User Interface
alternative label: GUI

Hard Link
type: Class
comment: In computing, a hard link is a directory entry that associates a name with a file on a file system. All directory-based file systems must have at least one hard link giving the original name for each file. The term “hard link” is usually only used in file systems that allow more than one hard link for the same file. Multiple hard links – that is, multiple directory entries to the same file – are supported by POSIX-compliant and partially POSIX-compliant operating systems, such as Linux, Android, macOS, and also Windows NT4 and later Windows NT operating systems.
subclass of: File System Link

Homoglyph Detection
type: Identifier Analysis
type: Class
type: NamedIndividual
analyzes: Email
analyzes: URL
d3fend-id: D3-HD
definition: Comparing strings using a variety of techniques to determine if a deceptive or malicious string is being presented to a user.
enables: Detect
kb-article: ## How it works A homoglyph, in this context, is a deceptive string or word which looks like a trusted word, but is composed of different characters, for example: goooogle.com versus google.com. This is commonly found in phishing and typo squatting attacks where a human exploiting through a social engineering campaign. ## Considerations * In very large environments processing DNS queries can be computationally expensive due to the amount of traffic that is generated * Legitimate companies and products use non-dictionary words in their names that could result in many false positives
kb-reference: Reference - Computer-implemented methods and systems for identifying visually similar text character strings - Greathorn Inc
kb-reference: Reference - System and method for detecting homoglyph attacks with a siamese convolutional neural network - Endgame Inc
subclass of: Restriction
  on property: analyzes
  some values from: URL
subclass of: Restriction
  on property: analyzes
  some values from: Email
subclass of: Identifier Analysis

Image Data Segment
type: Class
type: NamedIndividual
comment: An image data segment (often denoted .data) is a portion of an object file that contains initialized static variables, that is, global variables and static local variables. The size of this segment is determined by the size of the values in the program's source code, and does not change at run time. This segmenting of the memory space into discrete blocks with specific tasks carried over into the programming languages of the day and the concept is still widely in use within modern programming languages.
see also: Process Data Segment
subclass of: Image Segment

Image Scanner Input Device
type: Class
comment: An image scanner—often abbreviated to just scanner, is a device that optically scans images, printed text, handwriting or an object and converts it to a digital image. Commonly used in offices are variations of the desktop flatbed scanner where the document is placed on a glass window for scanning. Hand-held scanners, where the device is moved by hand, have evolved from text scanning "wands" to 3D scanners used for industrial design, reverse engineering, test and measurement, orthotics, gaming and other applications. Mechanically driven scanners that move the document are typically used for large-format documents, where a flatbed design would be impractical.
subclass of: Video Input Device
alternative label: Scanner

Image Segment
type: Class
comment: Image segments are distinct partitions of an object file. Both data and code segments are examples of image segments.
see also: Object File
subclass of: Binary Segment

Init Script
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An init script (or initialization script) is an executable script that initializes the an application, a process, or a service's state. Examples include scripts run at boot by Unix or Windows, or those run to initialize a shell.
subclass of: Digital Artifact
subclass of: Executable Script
alternative label: Initialization Script

Input Device Analysis
type: Operating System Monitoring
type: Class
type: NamedIndividual
analyzes: Input Device
d3fend-id: D3-IDA
definition: Operating system level mechanisms to prevent abusive input device exploitation.
enables: Detect
kb-article: ## How it works Input Device Hardening techniques filter certain commands, or disable related operating system functionality. ### Analytics All of these values can be analyzed and compared to a baseline: * Amount of input * Duration of a single input * Durations between inputs * Value of input Context can also include: * User which is logged in, to include attributes such as physical location of the user * Date and time * System which is processing the input * Source device of input, to include its properties (eg. manufacturer), configuration (eg. keyboard layout) and behavioral attributes of this device (eg. first use) * Source system of input (local or remote system) * Other hardware devices attached to the system ### Actions Actions can include: * Disabling the source device * Sending an alert * Locking the current session (eg. system screen lock, or returning to an authentication screen in a web app) and requiring one or more methods of authentication to continue * Administratively disabling credentials for the account or the entire account -- the technique *Account Locking* ### Examples A malicious input device sends many keystrokes with approximately the same delay between each. This does not match the normal cadence of input, and the device is disabled. Input to type the session user's name takes abnormally longer for each keystroke. The system is locked to the password prompt screen. A system receives key press events from two different devices -- one device sends keystrokes after the other has been idle for a long time. A system receives physical input in a user session, while that user has sent input from a device located out of the country in the past hour. Network traffic is suddenly routed through a new external device, and nearly the same volume of network traffic is subsequently sent out the previously existing interface. The new external device is disabled, and an alert is raised to investigate the network configuration for a potential compromise. ##…
kb-reference: Reference - Continuous authentication by analysis of keyboard typing characteristics - Bradford Univ., UK
kb-reference: Reference - http://www.biometric-solutions.com/keystroke-dynamics.html - biometric-solutions.com
subclass of: Restriction
  on property: analyzes
  some values from: Input Device
subclass of: Operating System Monitoring

Intranet File Transfer Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Intranet file transfer traffic is file transfer traffic that does not cross a given network's boundaries and uses a standard file transfer protocol.
subclass of: File Transfer Network Traffic
subclass of: Intranet Network Traffic

Intranet Multicast Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Intranet IPC network traffic is multicast network traffic that does not cross a given network's boundaries.
subclass of: Intranet Network Traffic

Intranet Web Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
may-contain: File
originates-from: Physical Location
comment: Intranet web network traffic is network traffic that does not cross a given network's boundaries and uses a standard web protocol.
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: Intranet Network Traffic
subclass of: Web Network Traffic

Kerberos Ticket Granting Ticket
type: Class
type: NamedIndividual
authenticates: User Account
comment: A ticket granting ticket issued by a Kerberos system; that is, a ticket that grants a user domain admin access.
subclass of: Kerberos TIcket
subclass of: Ticket Granting Ticket

Keyboard Input Device
type: Class
type: NamedIndividual
comment: A computer keyboard is a typewriter-style device which uses an arrangement of buttons or keys to act as mechanical levers or electronic switches. Following the decline of punch cards and paper tape, interaction via teleprinter-style keyboards became the main input method for computers. A keyboard is also used to give commands to the operating system of a computer, such as Windows' Control-Alt-Delete combination. Although on Pre-Windows 95 Microsoft operating systems this forced a re-boot, now it brings up a system security options screen.
subclass of: Input Device
alternative label: Computer Keyboard
alternative label: Keyboard

License
type: Class
comment: An enumeration of the general type of software license a product has (i.e., open source or proprietary.) A software license is a legal instrument (usually by way of contract law, with or without printed material) governing the use or redistribution of software. Under United States copyright law, all software is copyright protected, in both source code and object code forms, unless that software was developed by the United States Government, in which case it cannot be copyrighted. Authors of copyrighted software can donate their software to the public domain, in which case it is also not covered by copyright and, as a result, cannot be licensed.
subclass of: D3FEND Analysis Thing
alternative label: Software License

Local Area Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Intranet local area network (LAN) traffic is network traffic that does not cross a given network's boundaries; where that network is defined as a LAN.
subclass of: Intranet Network Traffic

Local Resource Access
type: Class
type: NamedIndividual
accesses: Local Resource
comment: Ephemeral digital artifact comprising a request of a local resource and any response from that resource.
subclass of: Restriction
  on property: accesses
  some values from: Local Resource
subclass of: Resource Access
alternative label: Endpoint Resource Access

Log File
type: Class
type: NamedIndividual
contains: Log
may-contain: File
may-contain: URL
comment: A log file is a file that records either events that occur in an operating system or other software runs, or messages between different users of a communication software. Logging is the act of keeping a log. In the simplest case, messages are written to a single log file. A transaction log is a file (i.e., log) of the communications between a system and the users of that system, or a data collection method that automatically captures the type, content, or time of transactions made by a person from a terminal with that system. For Web searching, a transaction log is an electronic record of interactions that have occurred during a searching episode between a Web search engine and users searching for information on that Web search engine. Many operating systems, software frameworks and programs include a logging system. A widely used logging standard is syslog, defined in Internet Engineering Task Force (IETF) RFC 5424). The syslog standard enables a dedicated, standardized subsystem to generate, filter, record, and analyze log messages. This relieves software developers of having to design and code their own ad hoc logging systems.
subclass of: Restriction
  on property: contains
  some values from: Log
subclass of: File

MacOS Keychain
type: Class
type: NamedIndividual
comment: Keychain is the password management system in macOS, developed by Apple. It was introduced with Mac OS 8.6, and has been included in all subsequent versions of the operating system, now known as macOS. A Keychain can contain various types of data: passwords (for websites, FTP servers, SSH accounts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes.
subclass of: Password Store
alternative label: Keychain

Mandatory Access Control
type: Execution Isolation
type: Class
type: NamedIndividual
d3fend-id: D3-MAC
definition: Controlling access to local computer system resources with kernel-level capabilities.
enables: Isolate
isolates: Process
kb-article: ## How it works Mandatory access control is a non-discretionary access control system because the rules and polices that determine access is determined by a security control authority and not distributed to local users. Access determinations are based on designed access control polices and are not based on local resource owner determinations. Access is typically granted by defining sets of subjects and sets of objects. Subjects are the entities requesting access and objects are the resources that subjects are trying to access. Rules and policies are defined that associate subjects and object permissions and access controls. ### Common MAC implementations #### Security label access control A fine-grained form of mandatory access control is to apply security labels to individual resources, including processes, and the access control decisions are against a particular resource and a given user attempting to gain access. This type of MAC requires that the file system has built-in support for security labels. Access controls are typically implemented through the use of label identifiers for every file system object. Identifier labels are applied to resources and users are assigned a similar access identifier. Users attempting to access a resource will result in the operating system performing an access control check. The access control check will compare the assigned user’s credentials to that of the resource or object they are attempting to access. A security context is associated with resources and is used to determine assess. Typical basic access control elements include users, roles and types and together they form a security context which is the basis for the security labels. This type of access control is what is employed in SELinux [2]. This form of MAC is considered the most flexible implementation, but it also is the most complex to deploy across the enterprise. Where multiple virtual machines (VM) are run together this type of access control is typically employ…
kb-reference: Reference - Analysis of the Windows Vista Security Model - Symantec Corporation
kb-reference: Reference - Architecture of transparent network security for application containers - Neuvector Inc
synonym: Kernel-based Process Isolation
subclass of: Restriction
  on property: isolates
  some values from: Process
subclass of: Execution Isolation

Message Transfer Agent
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A message transfer agent or mail transfer agent (MTA) or mail relay is software that transfers electronic mail messages from one computer to another using a client–server application architecture. An MTA implements both the client (sending) and server (receiving) portions of the Simple Mail Transfer Protocol.
subclass of: Service Application
alternative label: MTA
alternative label: Mail Transfer Agent

Move File
type: Class
type: NamedIndividual
executes: Subroutine
modifies: File System Metadata
comment: A system call to rename or move a file. Linux's rename() is an example of this kind of system call.
subclass of: Restriction
  on property: modifies
  some values from: File System Metadata
subclass of: System Call
alternative label: Rename File

Network File Resource
type: Class
type: NamedIndividual
contains: File
comment: A computer file resource made available from one host to other hosts on a computer network.
subclass of: Restriction
  on property: contains
  some values from: File
subclass of: Network File Share Resource

Network Init Script File Resource
type: Class
type: NamedIndividual
contains: File
may-contain: File
may-contain: URL
comment: A computer file resource made available from one host to other hosts on a computer network that is also an initialization script.
subclass of: Init Script
subclass of: Network File Resource

Network Sensor
type: Class
subclass of: Sensor

Office Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An office application is one that is part of an application suite (e.g., Microsoft Office, Open Office).
subclass of: User Application

Office Application File
type: Class
type: NamedIndividual
may-contain: Executable Script
may-contain: File
may-contain: URL
subclass of: Document File

Operating System Configuration
type: Class
comment: Information used to configure the services, parameters, and initial settings for an operating system.
subclass of: Configuration Information

Operating System Executable File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An operating system executable is a critical executable that is part of the operating system, and without which, the operating system may not operate correctly.
subclass of: Operating System File

Operating System Log File
type: Class
type: NamedIndividual
contains: Log
may-contain: File
may-contain: URL
comment: An operating system log file records events that occur in an operating system
see also: Log File
subclass of: Log File
subclass of: Operating System File

Operating System Shared Library File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An operating system shared library file is a shared library file that is part of the operating system and that incorporates common operating system code for use by any application or to provide operating system services.
subclass of: Operating System File
subclass of: Shared Library File

Orchestration Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: An orchestration server provides orchestration services that automate the configuration, coordination, and management of computer systems and software.
subclass of: Server

Outbound Internet Encrypted Remote Terminal Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet encrypted remote terminal traffic is encrypted network traffic for a standard remote terminal protocol on an outgoing connection initiated from a host within a network to a host outside the network.
subclass of: Outbound Internet Encrypted Traffic
alternative label: Outbound Internet Encrypted RDP Traffic
alternative label: Outbound Internet Encrypted SSH Traffic

Outbound Internet File Transfer Traffic
type: Class
type: NamedIndividual
contains: File
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet file transfer traffic is file transfer traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard file transfer protocol.
subclass of: Restriction
  on property: contains
  some values from: File
subclass of: File Transfer Network Traffic
subclass of: Outbound Internet Network Traffic

Outbound Internet Mail Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet DNS lookup traffic is network traffic using a standard email protocol on an outgoing connection initiated from a host within a network to a host outside the network.
subclass of: Outbound Internet Network Traffic
alternative label: Outbound Internet Email Traffic

Password File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: Simple form of password database held in a single file (e.g., /etc/password)
subclass of: File
subclass of: Password Database

Pointer Authentication
type: Application Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-PAN
definition: Comparing the cryptographic hash or derivative of a pointer's value to an expected value.
enables: Harden
kb-article: ## How It Works Pointer Authentication (frequently referred to as PAC, although the technique is properly Pointer Authentication) is a security feature to provide protection against attackers with memory read/write access. A Pointer Authentication Code (PAC) is a cryptographic hash or derivative computed on the value of a pointer and some additional context information which can then provide a cryptographically strong guarantee about the likelihood that a pointer has been tampered with by an attacker. Although pointers are 64 bits, most systems have a substantially smaller virtual address space, leaving unused bits in pointers that can store the value of the PAC, this can be done to reduce memory space requirements. One implementation is in ARMv8.3-A. A PAC is computed over the 64-bit pointer value and a 64-bit context value. Instructions are introduced to deal with pointers: one category to compute and insert the PAC into a pointer, another category to verify the pointer and invalidate the pointer if the PAC does not check, and a third category to remove the pointer and restore the original value without verifying. The ARM standard specifies a cryptographic algorithm called QARMA-64 (designed by Qualcomm) to compute the signature, although this algorithm is not required. The architecture provides for five secret 128-bit Pointer Authentication keys: two for instruction pointers, two for data pointers, and a general key for signing larger blocks of data. ## Considerations In the ARM implementation, the mechanisms above for manipulating PACS are provided, but it is up to the code developer to manage the keys for the cryptographic algorithm. A known potential limitation of PACs concerns signing gadgets. Under certain circumstances PACs can be bypassed by forcing the system to run a signing gadget which will allow the signing of arbitrary pointers to occur.
kb-reference: Reference - Pointer Authentication on ARMv8.3
kb-reference: Reference - Pointer Authentication Project Zero
verifies: Pointer
subclass of: Restriction
  on property: verifies
  some values from: Pointer
subclass of: Application Hardening

PowerShell Profile Script
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A PowerShell profile script is a script that runs when PowerShell starts and can be used as a logon script to customize user environments.
subclass of: User Init Script

Private Key
type: Class
type: NamedIndividual
comment: A private key can be used to decrypt messages encrypted using the corresponding public key, or used to sign a message that can be authenticated with the corresponding public key.
subclass of: Asymmetric Key

Process Environment Variable
type: Class
type: NamedIndividual
comment: An environment variable is a dynamic-named value that can affect the way running processes will behave on a computer. They are part of the environment in which a process runs.
subclass of: Application Configuration
alternative label: Environment Variable

Process Eviction
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-PE
definition: Process eviction techniques terminate or remove running process.
enables: Evict
subclass of: Restriction
  on property: enables
  some values from: Evict
subclass of: Defensive Technique

Process Segment Execution Prevention
type: Application Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-PSEP
definition: Preventing execution of any address in a memory region other than the code segment.
enables: Harden
kb-article: ## How it works During execution of a process, the instruction pointer register should only point to addresses in a code segment (also called the .text segment), as this is the sole segment which should contain program code. When this technique detects an attempt to execute something that has been designated as non-executable, other techniques such as those in **Process Eviction** might be invoked, such as **Process Termination** to end the current process, or **Executable Blacklisting** to blacklist the potentially vulnerable or malfunctioning executable. ### Software-based implementations The software-based implementation in Windows XP SP2 might not check that every time the instruction pointer is changed, and does not check on each jump or return. Before calling an exception handler, Windows XP SP2 software-enforced DEP checks whether the exception handler is located in a memory region marked as executable. If the program was also built with SafeSEH, this implementation also checks before changing control to the exception handler whether it is a registered exception handler in the program's file on disk. ### Hardware-based implementations The NX (No Execute) or XD (Execute Disable) bit on the processor specifies whether a certain part of memory is executable. Early implementations set this bit by the memory segment, while modern implementations which are built on the flat memory model often store this bit in each entry of the page table, to control execution by the page. ## Considerations Non-hardware process data segment execution prevention is more susceptible to being able to be turned off for a page of memory. Different implementations of this defense have been in place since the 1980s, but implementation stalled when larger 16-bit programs began stuffing code in the segments usually reserved for data. Many modern programs follow the best practice of separation of code and data, are able to run under this defense. ROP or ret2libc/return-to-function attacks co…
kb-reference: Reference - What is NX/XD feature ? [sic] - Red Hat
neutralizes: Process Segment
synonym: Execute Disable
synonym: No Execute
subclass of: Restriction
  on property: neutralizes
  some values from: Process Segment
subclass of: Application Hardening

Process Tree
type: Class
type: NamedIndividual
contains: Process
comment: A process tree is a tree structure representation of parent-child relationships established via process spawn operations.
see also: Process Spawn
subclass of: Restriction
  on property: contains
  some values from: Process
subclass of: Digital Artifact

Proxy Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: In computer networking, a proxy server is a server application or appliance that acts as an intermediary for requests from clients seeking resources from servers that provide those resources. A proxy server thus functions on behalf of the client when requesting service, potentially masking the true origin of the request to the resource server.
subclass of: Network Node
subclass of: Server

Reference – RFC 6376: DomainKeys Identified Mail (DKIM) Signatures – IETF
type: Specification Reference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc6376
kb-abstract: DomainKeys Identified Mail (DKIM) permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message. This can be an author's organization, an operational relay, or one of their agents. DKIM separates the question of the identity of the Signer of the message from the purported author of the message. Assertion of responsibility is validated through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key. Message transit from author to recipient is through relays that typically make no substantive change to the message content and thus preserve the DKIM signature.
kb-author: D. Crocker, T. Hansen, M. Kucherawy
kb-is-example-of: Transfer Agent Authentication
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-title: RFC 6376: DomainKeys Identified Mail (DKIM) Signatures

Reference - Network-level polymorphic shellcode detection using emulation
type: Academic Paper Reference
type: NamedIndividual
has-link: https://www.cs.unc.edu/~fabian/course_papers/polymorphic-detect.pdf
kb-author: Michalis Polychronakis
kb-is-example-of: Byte Sequence Emulation
kb-reference-title: Network-level polymorphic shellcode detection using emulation

Reference - Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1
type: Specification Reference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc3851
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-title: Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1 Message Specification

Reference - Securing Web Transactions
type: Guideline Reference
type: NamedIndividual
has-link: https://www.nccoe.nist.gov/sites/default/files/library/sp1800/tls-serv-cert-mgt-nist-sp1800-16b-final.pdf
kb-abstract: Organizations risk losing revenue, customers, and reputation, and exposing internal or customer data to attackers if they do not properly manage Transport Layer Security (TLS) server certificates. TLS is the most widely used security protocol to secure web transactions and other communications on the internet and internal networks. TLS server certificates are central to the security and operation of internet-facing and internal web services. Improper TLS server certificate management results in significant outages to web applications and services—such as government services, online banking, flight operations, and mission-critical services within an organization—and increased risk of security breaches.
kb-author: William Haag, Murugiah Souppaya, Paul Turner, William C. Barker, Brett Pleasant, Susan Symington
kb-is-example-of: Active Certificate Analysis
kb-organization: NIST
kb-reference-title: Securing Web Transactions

Reference - Automatically generating rules for connection security - Microsoft
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120054825
kb-abstract: A method and system for creating security policies for firewall and connection policies in an integrated manner is provided. The security system provides a user interface through which a user can define a security rule that specifies both a firewall policy and a connection policy. After the security rule is specified, the security system automatically generates a firewall rule and a connection rule to implement the security rule. The security system provides the firewall rule to a firewall engine that is responsible for enforcing the firewall rules and provides the connection rule to an IPsec engine that is responsible for enforcing the connection rules
kb-author: Charles D. Bassett; Eran Yariv; Ian M. Carbaugh; Lokesh Srinivas Koppolu; Maksim Noy; Sarah A. Wahlert; Pradeep Bahl
kb-is-example-of: Inbound Traffic Filtering
kb-is-example-of: Outbound Traffic Filtering
kb-organization: Microsoft
kb-reference-title: Automatically generating rules for connection security

Reference - CAR-2013-02-012: User Logged in to Multiple Hosts - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-02-012/
kb-abstract: Most users use only one or two machines during the normal course of business. User accounts that log in to multiple machines, especially over a short period of time, may be compromised. Remote logins among multiple machines may be an indicator of Lateral Movement. Certain users will likely appear as being logged into several machines and may need to be “whitelisted.” Such users would include network admins or user names that are common to many hosts.
kb-author: MITRE
kb-is-example-of: Authentication Event Thresholding
kb-is-example-of: Authorization Event Thresholding
kb-organization: MITRE
kb-reference-title: CAR-2013-02-012: User Logged in to Multiple Hosts

Reference - CAR-2013-05-005: SMB Copy and Execution -
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-005/
kb-abstract: An adversary needs to gain access to other hosts to move throughout an environment. In many cases, this is a twofold process. First, a file is remotely written to a host via an SMB share (detected by CAR-2013-05-003). Then, a variety of Execution techniques can be used to remotely establish execution of the file or script. To detect this behavior, look for files that are written to a host over SMB and then later run directly as a process or in the command line arguments. SMB File Writes and Remote Execution may happen normally in an environment, but the combination of the two behaviors is less frequent and more likely to indicate adversarial activity. This can possibly extend to more copy protocols in order to widen its reach, or it could be tuned more finely to focus on specific program run locations (e.g. %SYSTEMROOT%\system32) to gain a higher detection rate.
kb-is-example-of: IPC Traffic Analysis
kb-is-example-of: Process Spawn Analysis
kb-reference-title: CAR-2013-05-005: SMB Copy and Execution

Reference - CAR-2013-09-003: SMB Session Setups - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-09-003/
kb-abstract: Account usage within SMB can be used to identify compromised credentials, and the hosts accessed with them. This analytic monitors SMB activity that deals with user activity rather than file activity.
kb-author: MITRE
kb-is-example-of: Authorization Event Thresholding
kb-is-example-of: IPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2013-09-003: SMB Session Setups

Reference - CAR-2014-03-001: SMB Write Request - NamedPipes - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-03-001/
kb-abstract: An SMB write can be an indicator of lateral movement, especially when combined with other information such as execution of that written file. Named pipes are a subset of SMB write requests. Named pipes such as msftewds may not be alarming; however others, such as lsarpc, may. Monitoring SMB write requests still creates some noise, particularly with named pipes. As a result, SMB is now split between writing named pipes and writing other files.
kb-author: MITRE
kb-is-example-of: IPC Traffic Analysis
kb-is-example-of: RPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-03-001: SMB Write Request - NamedPipes

Reference - CAR-2014-12-001: Remotely Launched Executables via WMI - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-12-001/
kb-abstract: Adversaries can use Windows Management Instrumentation (WMI) to move laterally by launching executables remotely. For adversaries to achieve this, they must open a WMI connection to a remote host. This RPC activity is currently detected by CAR-2014-11-007. After the WMI connection has been initialized, a process can be remotely launched using the command: wmic /node:"<hostname>" process call create "<command line>", which is detected via CAR-2016-03-002. This leaves artifacts at both a network (RPC) and process (command line) level. When wmic.exe (or the schtasks API) is used to remotely create processes, Windows uses RPC (135/tcp) to communicate with the the remote machine. After RPC authenticates, the RPC endpoint mapper opens a high port connection, through which the schtasks Remote Procedure Call is actually implemented. With the right packet decoders, or by looking for certain byte streams in raw data, these functions can be identified. When the command line is executed, it has the parent process of C:\windows\system32\wbem\WmiPrvSE.exe. This analytic looks for these two events happening in sequence, so that the network connection and target process are output.
kb-author: MITRE
kb-is-example-of: Process Lineage Analysis
kb-is-example-of: RPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2014-12-001: Remotely Launched Executables via WMI

Reference - CAR-2016-03-002: Create Remote Process via WMIC - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-03-002/
kb-abstract: Adversaries may use Windows Management Instrumentation (WMI) to move laterally, by launching executables remotely.The analytic CAR-2014-12-001 describes how to detect these processes with network traffic monitoring and process monitoring on the target host. However, if the command line utility wmic.exe is used on the source host, then it can additionally be detected on an analytic. The command line on the source host is constructed into something like wmic.exe /node:"\<hostname\>" process call create "\<command line\>". It is possible to also connect via IP address, in which case the string "\<hostname\>" would instead look like IP Address. Although this analytic was created after CAR-2014-12-001, it is a much simpler (although more limited) approach. Processes can be created remotely via WMI in a few other ways, such as more direct API access or the built-in utility PowerShell.
kb-author: MITRE
kb-is-example-of: Process Spawn Analysis
kb-is-example-of: RPC Traffic Analysis
kb-organization: MITRE
kb-reference-title: CAR-2016-03-002: Create Remote Process via WMIC

Reference - CAR-2016-04-002: User Activity from Clearing Event Logs - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-002/
kb-abstract: It is unlikely that event log data would be cleared during normal operations, and it is likely that malicious attackers may try to cover their tracks by clearing an event log. When an event log gets cleared, it is suspicious. Alerting when a “Clear Event Log” is generated could point to this intruder technique. Centrally collecting events has the added benefit of making it much harder for attackers to cover their tracks. Event Forwarding permits sources to forward multiple copies of a collected event to multiple collectors, thus enabling redundant event collection. Using a redundant event collection model can minimize the single point of failure risk.
kb-author: MITRE
kb-is-example-of: System File Analysis
kb-organization: MITRE
kb-reference-title: CAR-2016-04-002: User Activity from Clearing Event Logs

Reference - CAR-2016-04-005: Remote Desktop Logon - MITRE
type: External Knowledge Base
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-005/
kb-abstract: A remote desktop logon, through RDP, may be typical of a system administrator or IT support, but only from select workstations. Monitoring remote desktop logons and comparing to known/approved originating systems can detect lateral movement of an adversary.
kb-author: MITRE
kb-is-example-of: Authentication Event Thresholding
kb-is-example-of: Remote Terminal Session Detection
kb-organization: MITRE
kb-reference-title: CAR-2016-04-005: Remote Desktop Logon

Reference - Decoy and deceptive data object technology - Cymmetria Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170134423A1
kb-abstract: A computer implemented method of detecting unauthorized access to a protected network by monitoring a dynamically updated deception environment, comprising launching, on one or more decoy endpoints, one or more decoy operating system (OS) managing one or more of a plurality of deception applications mapping a plurality of applications executed in a protected network, updating dynamically a usage indication for a plurality of deception data objects deployed in the protected network to emulate usage of the plurality of deception data objects for accessing the deception application(s) wherein the plurality of deception data objects are configured to trigger an interaction with the deception application(s) when used, detecting usage of data contained in the deception data object(s) by monitoring the interaction and identifying one or more potential unauthorized operations based on analysis of the detection.
kb-author: Dean Sysman; Gadi Evron; Imri Goldberg; Itamar Sher; Shmuel Ur
kb-is-example-of: Decoy Session Token
kb-is-example-of: Decoy User Credential
kb-organization: Cymmetria Inc
kb-reference-title: Decoy and deceptive data object technology

Reference - Detecting script-based malware - Crowdstrike Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190188384A1
kb-abstract: Described herein are systems, techniques, and computer program products for preventing execution, by a scripting engine, of harmful commands that may be introduced by computer malware or other mechanisms. The system identifies certain host processes that may attempt to utilize a hosted scripting engine. An unmanaged interface module is injected into an identified host process. The unmanaged interface module is configured to detect certain conditions indicating the likelihood that a scripting engine will be instantiated, and in response to inject a managed interface module into the host process. The managed interface module hooks into certain methods of the scripting engine to intercept commands before they are executed by the scripting engine. The managed and unmanaged interface components then communicate with a kernel-mode threat detection component to determine whether any commands should be blocked.
kb-author: Ion-Alexandru IONESCU; Satoshi Tanda
kb-is-example-of: File Content Rules
kb-is-example-of: Script Execution Analysis
kb-mitre-analysis: The patent describes techniques that can be implemented to detect and block malicious commands and command scripts from being executed by scripting engines. ### Script Execution Monitoring explanation This patent describes software installed on the host system that hooks into methods of a scripting engine to intercept commands before they are executed and block commands if they are determined to be harmful. For example regular expression checking may be used to identify commands having malicious patterns. Expression checking may be used for script files as well as interactively - typed commands. ### File Content Signatures explanation This patent includes File Content Signatures because in the case of a script file, a hash of the file is compared against hashes of known malicious script files to determine whether the script file is malicious.
kb-organization: Crowdstrike Inc
kb-reference-title: Detecting script-based malware

Reference - Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9882929B1/en
kb-abstract: Techniques for dynamic selection and generation of detonation location of suspicious content with a honey network are disclosed. In some embodiments, a system for dynamic selection and generation of detonation location of suspicious content with a honey network includes a virtual machine (VM) instance manager that manages a plurality of virtual clones executed in an instrumented VM environment, in which the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network that emulates a plurality of devices in an enterprise network; and an intelligent malware detonator that detonates a malware sample in at least one of the plurality of virtual clones executed in the instrumented VM environment.
kb-author: Taylor Ettema; Huagang Xie
kb-is-example-of: Decoy Network Resource
kb-is-example-of: Standalone Honeynet
kb-organization: Palo Alto Networks Inc
kb-reference-title: Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network

Reference - System and method for identifying the presence of malware using mini-traps set at network endpoints - Fidelis Cybersecurity Solutions Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9807114B2/en
kb-abstract: A system for identifying the presence of advanced persistent threats on a network including a plurality of resources, interconnected to form a network, at least one decoy resource, at least one mini-trap installed on at least one of the plurality of resources and functionally associated with at one of the at least one decoy resource, the at least one mini-trap comprising deceptive information directing malware accessing the at least one mini-trap to the decoy resource associated therewith, and a manager node forming part of the network, locally or remotely, and configured to manage placement of the at least one mini-trap on the at least one of the plurality of resources and association between the at least one mini-trap and the decoy resource associated therewith.
kb-author: Doron Kolton; Rami Mizrahi; Omer Zohar; Benny Ben-Rabi; Alex Barbalat; Shlomi Gabai
kb-is-example-of: Decoy Network Resource
kb-is-example-of: Decoy User Credential
kb-mitre-analysis: Questionable or all files (as determined by the enterprise) are forwarded to the decoy network. Using a manager node user interface, you can setup fake information (ex. IP address of a decoy FTP server) and deploy decoy physical or virtual endpoints.
kb-organization: Fidelis Cybersecurity Solutions Inc
kb-reference-title: System and method for identifying the presence of malware using mini-traps set at network endpoints

Reference - System for implementing threat detection using daily network traffic community outliers - VECTRA NETWORKS Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191560A1
kb-abstract: A method and system for identifying insider threats within an organization is provided. The approach constructs an internal connectivity graph to identify communities of hosts/users, and checks for abnormal behavior relative to past behaviors.
kb-author: David Lopes Pegna; Himanshu Mhatre; Oliver Brdiczka
kb-is-example-of: Network Traffic Community Deviation
kb-is-example-of: Protocol Metadata Anomaly Detection
kb-mitre-analysis: This patent describes techniques for detecting insider attacks. Network packet capture data is collected and stored for processing. Metadata is extracted for each communication session on the organization’s network and includes information on source and destination host destination port, number of connection attempts, size of data exchanged, duration and time of the communication. The metadata is used to build a connectivity graph of the network and identify groups of similar hosts that exhibit similar behavior. For each group of similar behavior identified, a baseline behavior pattern profile is developed. Network activity for a host within a group that deviates over a threshold from the baseline behavior patterns is identified as suspicious and an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-title: System for implementing threat detection using daily network traffic community outliers

Reference - Systems and methods for detecting and/or handling targeted attacks in the email channel - Graphus Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170324767A1
kb-abstract: Techniques for detecting and/or handling target attacks in an enterprise's email channel are provided. The techniques include receiving aspects of an incoming email message addressed to a first email account holder, selecting a recipient interaction profile and/or a sender profile from a plurality of predetermined profiles stored in a memory based upon the received properties, determining a message trust rating associated with the incoming email message based upon the incoming email message and the selected recipient interaction profile and/or the sender profile; and generating an alert identifying the incoming email message as including a security risk based upon the determined message trust rating. The recipient interaction profile includes information associating the first email account holder and a plurality of email senders from whom email messages have previously been received for the first email account holder, and the sender profile includes information associating a sender of the incoming email message with characteristics determined from a plurality of email messages previously received from the sender.
kb-author: Manoj Kumar Srivastava
kb-is-example-of: Sender MTA Reputation Analysis
kb-is-example-of: Sender Reputation Analysis
kb-mitre-analysis: The patent describes using sender trust rating and sender MTA trust rating as an indicator of level of email security risk. ### Sender Reputation explanation This patent includes Sender Reputation because it describes sender trust rating being used as an indicator of the level of security risk and/or trust level associated with an email sender. The sender trust rating may be determined based on one or more of: * length of time sender has known the enterprise * number of recipients in the enterprise the sender interacts with * sender vs. enterprise originated message ratio * sender messages open vs. not-open ratio * number of emails received from this sender * number of emails replied for this sender * number of emails from this sender not opened * number of emails from this sender not opened that contain an attachment * number of emails from this sender not opened that contain a URL * number of emails sent to this sender * number of email replies received from this sender Based on the trust rating an alert is generated identifying the incoming email message as a security risk. ### Sender MTA Reputation explanation This patent includes Sender MTA Reputation because it describes sender MTA trust rating as an indicator of the level of security risk and/or trust level associated with a sender MTA. The trust rating may be determined based on one or more of: * length of time MTA has interacted with the enterprise * number of sender domains sending emails from the MTA * number of recipients in the enterprise the MTA sends emails to * number of emails received from this MTA * number of email replies received from this MTA Based on the trust rating an alert is generated identifying the incoming email message as a security risk.
kb-organization: Graphus Inc
kb-reference-title: Systems and methods for detecting and/or handling targeted attacks in the email channel

Remote Command
type: Class
type: NamedIndividual
contains: Network Packet
may-contain: Domain Name
originates-from: Physical Location
comment: A remote command is a command sent from one computer to another to be executed on the remote computer. One example of this, is through a command-line interface (CLI) like using Invoke-Command from PowerShell or a command sent through an ssh session. This class generalizes to all means of sending a command through an established protocol to control capabilities on a remote computer.
subclass of: Command
subclass of: Network Session

Script Application Process
type: Class
type: NamedIndividual
contains: Process Image
interprets: Executable Script
process-image-path: Executable Binary
process-user: User Account
runs: Application
comment: A script application process is an application process interpreting an executable script.
subclass of: Restriction
  on property: interprets
  some values from: Executable Script
subclass of: Application Process
alternative label: Script Process

Security Token
type: Class
type: NamedIndividual
contains: Access Token
comment: Security tokens are peripheral devices used to prove one's identity electronically (as in the case of a customer trying to access their bank account). The token is used in addition to or in place of a password to prove that the customer is who they claim to be. The token acts like an electronic key to access something.
subclass of: Restriction
  on property: contains
  some values from: Access Token
subclass of: Hardware Device

Segment Address Offset Randomization
type: Application Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-SAOR
definition: Randomizing the base (start) address of one or more segments of memory during the initialization of a process.
enables: Harden
kb-article: ## How it works Many application exploits rely on an attacker specifying a location in memory, which points to data or code used by the attacker. If the addresses are changed each time the program is run, then it becomes more difficult for the attacker to determine the location that will contain the code they wish to run. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing." Just as not all code is built for participation in ASLR, not all modules can be rebased; instead, modules must indicate whether they implement support for rebasing. Such information to relocate the executable is typically stored in the ".reloc" segment -- each of the addresses pointed to in this segment has its address increased by the amount of the offset. (An alternative method for relocation would be to add an amount to a global variable each time -- leading to less overhead in the module load, but more for each access. Still another implementation could instead contain code to deference each changeable memory location on the fly, so that each of the references do not need to be updated. ## Considerations As the offset for each segment is constant, it is possible to guess at the value of the address given the address of another variable. Alternatively, memory pointers may be kept around, which contain the address of another variable. Another bypass technique is known as an "egg hunt," whereby the attacker searches for a rather unique piece of the data or code in memory to determine its likely address. The program needs to store these addresses for the functions somewhere. In Linux, the PLT contains a "trampoline" to these addresses. If an attacker desires to jump to the start of an existing function, they can jump directly to the trampoline anyway, and may have the opportunity to provide their own stack frame to the function with a write to the stack. If they overwrite a saved stack pointer which is loaded …
kb-reference: Reference - How ASLR protects Linux systems from buffer overflow attacks - Network World
obfuscates: Process Segment
synonym: ASLR
synonym: Address Space Layout Randomization
subclass of: Restriction
  on property: obfuscates
  some values from: Process Segment
subclass of: Application Hardening

Session Duration Analysis
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Authentication
analyzes: Authorization
d3fend-id: D3-SDA
definition: Analyzing the duration of user sessions in order to detect unauthorized activity.
enables: Detect
kb-article: ## How it works Detecting unauthorized user sessions by comparing the duration of a user logon session with a baseline behavior model. The behavior model comprises historical user session duration times. Abnormalities between session duration and the behavior model may indicate suspicious activity. ## Considerations * Potential for false positives from anomalies that are not associated with malicious activity. * Attackers may not differentiate their session duration enough to trigger an alert.
kb-reference: Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC
kb-reference: Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
subclass of: Restriction
  on property: analyzes
  some values from: Authentication
subclass of: User Behavior Analysis

Shim Database
type: Class
type: NamedIndividual
contains: Application Configuration Database Record
comment: A application configuration database that contains or points to software shims (e.g., for backward compatibility, patches, etc.)
subclass of: Application Configuration Database

Slow Symbolic Link
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: A slow symbolic link is any symbolic link on a Unix filesystem that is not a fast symbolic link; slow symlink is thus retroactively termed from fast symlink. Slow symbolic links stored the symbolic link information as data in regular files.
subclass of: Symbolic Link
subclass of: Unix Link
alternative label: Slow Symlink

Software Deployment Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Software that coordinates the deployment process of software to systems, typically remotely.
subclass of: Service Application

Software Packaging Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A tool that automates the process of packaging either or both binary code and source code for use on one or more target platforms.
subclass of: Build Tool

Stack Frame Canary
type: Class
type: NamedIndividual
comment: Stack canaries, named for their analogy to a canary in a coal mine, are used to detect a stack buffer overflow before execution of malicious code can occur. This method works by placing a small integer, the value of which is randomly chosen at program start, in memory just before the stack return pointer. Most buffer overflows overwrite memory from lower to higher memory addresses, so in order to overwrite the return pointer (and thus take control of the process) the canary value must also be overwritten. This value is checked to make sure it has not changed before a routine uses the return pointer on the stack. This technique can greatly increase the difficulty of exploiting a stack buffer overflow because it forces the attacker to gain control of the instruction pointer by some non-traditional means such as corrupting other important variables on the stack.
subclass of: Stack Component
alternative label: Stack Canary

Stored Procedure
type: Class
type: NamedIndividual
contains: Executable File
comment: A stored procedure (also termed proc, storp, sproc, StoPro, StoredProc, StoreProc, sp, or SP) is a subroutine available to applications that access a relational database management system (RDBMS). Such procedures are stored in the database data dictionary.
subclass of: Subroutine

Support Level
type: Class
comment: A support level indicates the nature of support offered for a product. Support levels are enumerated by individuals (e.g., 'Native Support' and 'Third Party Support'.)
subclass of: D3FEND Analysis Thing

System Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on a computer's main board which manages the initial boot process. It can also continue to run or function after the operating system boots.
subclass of: Firmware
alternative label: BIOS Firmware
alternative label: UEFI Firmware

System Init Script
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A script used to initialize and configure elements of the system's environment, applications, services, or its operating system.
subclass of: Executable Script
subclass of: System Configuration Init Resource
subclass of: System Init Configuration

System Startup Directory
type: Class
type: NamedIndividual
may-contain: File
comment: A system startup directory is a directory containing executable files or links to executable files which are run when the system starts.
subclass of: Directory
subclass of: System Configuration Init Resource
subclass of: System Init Configuration

System Time Application
type: Class
type: NamedIndividual
contains: Executable File
comment: A system time utility is utility software that can get the system time, such as the Unix date command or Windows' Net utility.
subclass of: Utility Software

Data Staged
type: Class
type: NamedIndividual
attack-id: T1074
enables: Collection
reads: Resource
subclass of: Restriction
  on property: reads
  some values from: Resource
subclass of: Collection Technique

Data Encoding
type: Class
type: NamedIndividual
attack-id: T1132
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

User Execution
type: Class
type: NamedIndividual
attack-id: T1204
enables: Execution
subclass of: Execution Technique

Data from Information Repositories
type: Class
type: NamedIndividual
accesses: Resource
attack-id: T1213
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Resource
subclass of: Collection Technique

File and Directory Permissions Modification
type: Class
type: NamedIndividual
attack-id: T1222
enables: Defense Evasion
modifies: Access Control Information
subclass of: Restriction
  on property: modifies
  some values from: Access Control Information
subclass of: Defense Evasion Technique

Defacement
type: Class
type: NamedIndividual
attack-id: T1491
enables: Impact
subclass of: Impact Technique

Inter-Process Communication Execution
type: Class
type: NamedIndividual
attack-id: T1559
enables: Execution
injects: Interprocess Communication
subclass of: Restriction
  on property: injects
  some values from: Interprocess Communication
subclass of: Execution Technique

Disk Wipe
type: Class
type: NamedIndividual
attack-id: T1561
enables: Impact
subclass of: Impact Technique

Remote Service Session Hijacking
type: Class
type: NamedIndividual
accesses: Remote Session
attack-id: T1563
enables: Lateral Movement
produces: Administrative Network Traffic
subclass of: Restriction
  on property: accesses
  some values from: Remote Session
subclass of: Restriction
  on property: produces
  some values from: Administrative Network Traffic
subclass of: Lateral Movement Technique

Exfiltration Over Web Service
type: Class
type: NamedIndividual
attack-id: T1567
enables: Exfiltration
produces: Outbound Internet Web Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
subclass of: Exfiltration Technique

System Services Execution
type: Class
type: NamedIndividual
attack-id: T1569
enables: Execution
comment: This technique has been deprecated.
subclass of: Execution Technique

Encrypted Channel
type: Class
type: NamedIndividual
attack-id: T1573
enables: Command And Control
produces: Outbound Internet Encrypted Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Encrypted Traffic
subclass of: Command and Control Technique
alternative label: Custom Command and Control Protocol
alternative label: Custom Cryptographic Protocol
alternative label: Multilayer Encryption

Test Execution Tool
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A test execution tool is a type of software used to test software, hardware or complete systems. Synonyms of test execution tool include test execution engine, test executive, test manager, test sequencer. Two common forms in which a test execution engine may appear are as a: (a) module of a test software suite (test bench) or an integrated development environment, or (b) stand-alone application software.
subclass of: Developer Application
alternative label: Test Execution Engine
alternative label: Test Executive
alternative label: Test Manager

URL Analysis
type: Identifier Analysis
type: Class
type: NamedIndividual
analyzes: URL
d3fend-id: D3-UA
definition: Determining if a URL is benign or malicious by analyzing the URL or its components.
enables: Detect
kb-article: ## How it works URLs may contain components, for example: * scheme * userinfo * host name * port * path * query * fragment These components are used as features in analysis algorithms. Contextual information about a URL such as where it is embedded (ex. emails, files, network protocols), header, path, location, and origin information, as well as information about the content returned from the URL request, may be incorporated into an analytic for URL analysis. For example, if a URL indicates a .pdf file but an executable is actually returned, the combination of these two pieces of information indicates suspicious activity. Additional techniques include: * Extracting features of a URL such as domain name length, ratio of consecutive consonants, percentage of digits in a domain, and number of vowels. Values for each feature are combined to develop a score for the URL. * Determining the probability of a character occurring in the URL given the preceding two characters. For example, for google.com, the probability of a 'g' occurring at the beginning of a word, the probability of an 'o' occurring after a “g, the probability of an “o’ occurring after a 'g' and “o, and so forth. A dictionary or a list of known good domains is used to determine probability. Probabilities are multiplied to develop a score for the URL. URL analysis may trigger follow-on analytics such as **File Analysis** ## Considerations * Volume of URLs being analyzed, combined with the speed at which they are analyzed * Fidelity of analysis technique at detecting brand new URLs versus analyzing URLs of established domains
kb-reference: Reference - Method and Apparatus for Detecting Malicious Websites - Endgame Inc
kb-reference: Reference - Method and system for detecting restricted content associated with retrieved content - Sophos Ltd
subclass of: Restriction
  on property: analyzes
  some values from: URL
subclass of: Identifier Analysis

User Data Transfer Analysis
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Resource Access
d3fend-id: D3-UDTA
definition: Analyzing the amount of data transferred by a user.
enables: Detect
kb-article: ## How it works Unusual data transfer activity may indicate unauthorized activity. Data transfers can be analyzed by collecting network traffic or application logs. ## Considerations * There is a potential for false positives from anomalies that are not associated with unauthorized activity. * Attackers that move low and slow may not differentiate their data transfer behavior enough for an alert to trigger.
kb-reference: Reference - System and method thereof for identifying and responding to security incidents based on preemptive forensics - Palo Alto Networks Inc
kb-reference: Reference - System for implementing threat detection using threat and risk assessment of asset-actor interactions - VECTRA NETWORKS Inc
subclass of: Restriction
  on property: analyzes
  some values from: Resource Access
subclass of: User Behavior Analysis

User Geolocation Logon Pattern Analysis
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Network Traffic
d3fend-id: D3-UGLPA
definition: Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location.
enables: Detect
kb-article: ## How it works Geolocation data for each user logon attempt is collected and used to create a baseline user behavior profile. Current geolocation logon data is then compared against the user behavior profile. Logon activity that deviates from normal patterns and can help in identifying situations that may be indicative of a remote attacker using stolen credentials. For example: * logons from locations that are different from where a user usually logs in * logons from a location in which an enterprise has no users located * logon that is not physically possible given the elapsed time since a logon from another location. ## Considerations * Potential for false positives from logon anomalies that are not associated with malicious activity. * Attackers may not differentiate their logon behavior enough to trigger an alert.
kb-reference: Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC
kb-reference: Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
subclass of: User Behavior Analysis

User Interface
type: Class
comment: The user interface (UI), in the industrial design field of human–machine interaction, is the space where interactions between humans and machines occur. The goal of this interaction is to allow effective operation and control of the machine from the human end, whilst the machine simultaneously feeds back information that aids the operators' decision-making process. Examples of this broad concept of user interfaces include the interactive aspects of computer operating systems, hand tools, heavy machinery operator controls, and process controls. The design considerations applicable when creating user interfaces are related to or involve such disciplines as ergonomics and psychology.
subclass of: Digital Artifact
alternative label: UI

Volume Boot Record
type: Class
type: NamedIndividual
subclass of: Digital Artifact

Web Resource Access
type: Class
type: NamedIndividual
accesses: Network Resource
accesses: Resource
comment: Ephemeral digital artifact comprising a request of a network resource and any response from that network resource using a standard web protocol.
subclass of: Network Resource Access

Web Script File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A file containing a script in a web-scripting programming language. Web scripts may be present and run on the client or on the server side.
subclass of: Executable Script
alternative label: Web Script

Web Server Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A web server application (or web app) is an application software that runs on a web server, unlike computer-based software programs that are stored locally on the Operating System (OS) of the device. Web applications are accessed by the user through a web browser with an active internet connection. These applications are programmed using a client–server modeled structure—the user ("client") is provided services through an off-site server that is hosted by a third-party. Examples of commonly-used, web applications, include: web-mail, online retail sales, online banking, and online auctions.
subclass of: Service Application
alternative label: Web App
alternative label: Web Application

Windows Registry
type: Class
type: NamedIndividual
contains: System Configuration Database Record
comment: The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and user interface can all use the registry. The registry also allows access to counters for profiling system performance.
subclass of: System Configuration Database

Windows Registry Key
type: Class
type: NamedIndividual
comment: Windows registry keys are container objects similar to folders. Registry values are non-container objects similar to files. Keys may contain values and subkeys. Keys are referenced with a syntax similar to Windows' path names, using backslashes to indicate levels of hierarchy. Keys must have a case insensitive name without backslashes.
subclass of: Restriction
  on property: windows-registry-value
  some values from: string
subclass of: Restriction
  on property: windows-registry-key
  some values from: string
subclass of: System Configuration Database Record

Windows Shortcut File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A Microsoft Windows shortcut file.
subclass of: Shortcut File
alternative label: Shell Link

d3fend-artifact-data-property
type: DatatypeProperty
comment: x d3fend-artifact-data-property y: The artifact x has the data property y.
domain: Digital Artifact
sub property of: topDataProperty

d3fend-display-property
type: DatatypeProperty
comment: x d3fend-display-property y: An object x should be displayed using the display property y, when it applies.
sub property of: topDataProperty

d3fend-kb-data-property
type: DatatypeProperty
comment: x d3fend-kb-data-property y: The d3fend knowledge base object x has a data property y; e.g., a string capturing a particular aspect or section of a knowledge base article.
sub property of: topDataProperty

d3fend-kb-object-property
type: ObjectProperty
comment: x d3fend-kb-object-property y: The object y is a d3fend knowledge base object property. These properties allow the linkage of knowledge and information supporting and illustrating the d3fend model.
sub property of: topObjectProperty

develops
type: ObjectProperty
comment: x develops y: The product developer x develops the product y.
domain: Product Developer
range: Product
sub property of: d3fend-analysis-object-property

drives
type: ObjectProperty
comment: x drives y: The device driver x causes a system component y to function by controlling it.
sub property of: associated-with

enabled-by
type: ObjectProperty
comment: x enabled-by y: A top level technique y enables a tactic x, that is, the property indicates that a technique y is used to put a particular tactic x into action. In other words, y renders x capable or able for some task. Inverse of enables.
sub property of: associated-with
inverse of: enables

encrypts
type: ObjectProperty
comment: x encrypts y: The entity x converts the ordinary representation of a digital artifact y into a secret code.
sub property of: associated-with

forges
type: ObjectProperty
comment: x forges y: An technique or agent x counterfeits a digital artifact y, such as a fake credential, with the intent to deceive.
sub property of: creates

has-citation
type: ObjectProperty
comment: x has-citation y: The technique assertion x has the supporting analysis citation y.
sub property of: d3fend-analysis-object-property

has-link
type: DatatypeProperty
comment: x has-link y: The d3fend analysis x has the link y.
range: anyURI
sub property of: d3fend-analysis-data-property

has-product
type: ObjectProperty
comment: x has-product y: The analysis or assertion x is about product y
domain: D3FEND Analysis
domain: Technique Assertion
range: Product
sub property of: d3fend-analysis-object-property

injects
type: ObjectProperty
comment: x injects y: The subject x takes the action of exploiting a security flaw by introducing (injecting) y, which is code or data that will change the course of execution or state of a computing process to an alternate course or state. Typically code injection is associated with adversaries intending the alternate course to facilitate a malevolent purpose; however, code injection can be unintentional or the intentions behind it may be good or benign.
sub property of: executes

may-interpret
type: ObjectProperty
comment: x may-interpret y: They entity x may interpret the thing y; that is, 'x interprets y' may be true.
sub property of: may-be-associated-with

may-invoke
type: ObjectProperty
comment: x may-invoke y: They entity x may invoke the thing y; that is, 'x invokes y' may be true.
sub property of: may-be-associated-with

may-run
type: ObjectProperty
comment: x may-run y: They entity x may run the thing y; that is, 'x runs y' may be true.
sub property of: may-be-associated-with

obfuscates
type: ObjectProperty
comment: x obfuscates y: The technique x makes the digital artifact y difficult . Typically obfuscation is a way to hide a digital artifact from discovery, use, or both.
sub property of: modifies

originates-from
type: ObjectProperty
comment: x originates-from y: The digital event or artifact x began its network transit from a physical location y.
sub property of: associated-with

strengthens
type: ObjectProperty
comment: x strengthens y: The technique x make digital artifact y resistant (to harm or misuse.)
sub property of: associated-with
alternative label: proofs

windows-registry-data-property
type: DatatypeProperty
comment: x windows-registry-data-property y: The windows registry entry x has the property y.
sub property of: d3fend-artifact-data-property

Administrative Network Activity Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Intranet Administrative Network Traffic
d3fend-id: D3-ANAA
definition: Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline.
enables: Detect
kb-article: ## How it works Network protocols such as RDP, IPMI, SSH, SNMP, VNC, MOSH, NX, TeamViewer, SPICE, PCoIP, and others are used by system administrators to remotely manage servers. Defenders monitor administrative network activity to determine if the use of remote protocols is malicious. Attackers can abuse administrative protocols and leverage them for initial access to various endpoints. For example, an attacker with valid credentials will remotely SSH or RDP into a server and attempt to blend in with existing traffic from system administrators. By monitoring the traffic activity, it is possible to detect when the protocols are behaving differently from a known baseline of system administration activity. ## Considerations * Administrative traffic can be encrypted, making network protocol analysis a challenge * False alarms can be mitigated by integration with inventory management systems
kb-reference: Reference - CAR-2014-11-005: Remote Registry - MITRE
kb-reference: Reference - CAR-2014-11-006: Windows Remote Management (WinRM) - MITRE
kb-reference: Reference - Method and system for detecting suspicious administrative activity - Vectra Networks Inc
subclass of: Restriction
  on property: analyzes
  some values from: Intranet Administrative Network Traffic
subclass of: Network Traffic Analysis

Analysis Citation
type: Class
comment: A reference to a source used to support a D3FEND analysis.
subclass of: Restriction
  on property: cited-by
  some values from: Technique Assertion
subclass of: Restriction
  on property: has-reference-type
  some values from: Reference Type
subclass of: Restriction
  on property: has-link
  some values from: anyURI
subclass of: D3FEND Analysis Thing

Analytic Latency
type: Class
subclass of: Latency

Application Configuration Database Record
type: Class
type: NamedIndividual
comment: A database record holding information used to configure the parameters and initial settings for an application.
subclass of: Application Configuration
subclass of: Record

Client Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A client computer is a host that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network.
subclass of: Host

Collaborative Software
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Collaborative software or groupware is application software designed to help people working on a common task to attain their goals. One of the earliest definitions of groupware is "intentional group processes plus software to support them". Collaborative software is a broad concept that overlaps considerably with computer-supported cooperative work (CSCW). According to Carstensen and Schmidt (1999) groupware is part of CSCW. The authors claim that CSCW, and thereby groupware, addresses "how collaborative activities and their coordination can be supported by means of computer systems."
subclass of: User Application

D3FEND Analyst
type: Class
comment: An D3FEND analyst is a cybersecurity analyst who authors one or more D3FEND analyses.
subclass of: D3FEND Analysis Thing

Decoy User Credential
type: Decoy Object
type: Class
type: NamedIndividual
d3fend-id: D3-DUC
definition: A Credential created for the purpose of deceiving an adversary.
enables: Deceive
kb-article: ## How it works A detection analytic is developed to determine when a user uses decoy credentials. Subsequent actions by that user may be monitored or controlled by the defender. A credential may be: * Domain username and password * Local system username and password ## Considerations * Decoy credentials should be integrated with a larger decoy environment to ensure that when decoy credentials are compromised, the credentials are used to interact with a decoy asset that is being monitored. * Continuous maintenance and updates are needed to ensure the legitimacy of the larger decoy environment and specifically the assets that utilize the decoy credentials.
kb-reference: Reference - Decoy Network-Based Service for Deceiving Attackers - Amazon Technologies
kb-reference: Reference - Decoy and deceptive data object technology - Cymmetria Inc
kb-reference: Reference - System and method for identifying the presence of malware using mini-traps set at network endpoints - Fidelis Cybersecurity Solutions Inc
spoofs: Credential
subclass of: Restriction
  on property: spoofs
  some values from: Credential
subclass of: Decoy Object

Firmware Verification
type: Restriction
  on property: enables
  some values from: Platform Monitoring
type: Restriction
  on property: analyzes
  some values from: Firmware
type: Restriction
  on property: enables
  some values from: Detect
type: Restriction
  on property: monitors
  some values from: Platform
type: Platform Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-FV
definition: Using embedded trust identification markers to identify legitimate firmware and hardware configurations.
enables: Detect
kb-article: ## How it works Valid firmware, and hardware configurations, are identified and marked with a trust identification value. The trust identification value is stored on one of the embedded devices of the trusted configuration. A centralized database of trusted values is maintained for the identified configurations on a trust server, and they are used in the validation process. The validation process uses a trust server to validate deployed trusted configurations by employing an attestation protocol. The user defined values and specific hardware values are cryptographically compared to the stored trust values on the devices . Comparisons that fail the attestation test are deemed untrusted. ## Considerations * Requires the deployment of a centralized trust server * Trust values will need to be generated for specific devices * Changes to trusted configurations will need to be managed across the enterprise
kb-reference: Reference - Firmware Verification Eclypsium
kb-reference: Reference - Firmware Verification Trapezoid
kb-reference: Reference - Platform Firmware Resiliency Guidelines - NIST
verifies: Firmware
subclass of: Restriction
  on property: verifies
  some values from: Firmware
subclass of: Platform Monitoring

Guideline Reference
type: Class
pref-label: Guideline
subclass of: Policy Reference

Hardware-based Process Isolation
type: Execution Isolation
type: Class
type: NamedIndividual
d3fend-id: D3-HBPI
definition: Preventing one process from writing to the memory space of another process through hardware based address manager implementations.
enables: Isolate
isolates: Process
kb-article: ## How it works Process isolation, in this context, is address space separation controlled by a security function that limits the communication between processes so that one process cannot directly modify the executing code of another process. For example with virtual address space: * Process A address space is different from process B address space, which prevents process A from writing to process B Hardware process isolation is commonly implemented through Direct Memory Access (DMA) which collaborates with a Memory Management Unit (MMU), or Input-Output Memory Management Unit (IOMMU). These hardware controls are deployed directly on processors to aid hosts or enclaves in process isolation. * DMA - Direct memory access allows memory access to occur independently of the program currently run by the microprocessor. DMA allows for I/O devices to directly read from and write to memory, or it can be used to efficiently copy blocks of memory. During DMA transfers, the microprocessor can execute an unrelated program. * MMU - A memory management unit acts as an access control and is responsible for performing the translation of virtual memory addresses to physical memory addresses. The MMU allocates each process its own virtual memory space. * IOMMU - An input-output memory management unit is used to allocate each I/O device its own virtual address space to the underlying physical addresses. IOMMU allows devices that do not support long memory addresses to address the entire memory space. ## Considerations * Private hosts may be vulnerable to DMA attack if they have a PCI or PCI Express port that connects attached devices directly to physical address space. ## Implementations: * Intel Virtualization Technology for Directed I/O (Intel VT-d) * Firecracker
kb-reference: Reference - Approaches for securing an internet endpoint using fine-grained operating system virtualization - Bromium, Inc.
kb-reference: Reference - Isolation of applications within a virtual machine - Bromium, Inc.
kb-reference: Reference - Virtualized process isolation - Advanced Micro Devices Inc
synonym: Virtualization
subclass of: Restriction
  on property: isolates
  some values from: Process
subclass of: Execution Isolation

Latency
type: Class
subclass of: D3FEND Thing

Modem
type: Class
type: NamedIndividual
runs: Operating System
comment: A modem – a portmanteau of "modulator-demodulator" – is a hardware device that converts data into a format suitable for a transmission medium so that it can be transmitted from one computer to another (historically along telephone wires). A modem modulates one or more carrier wave signals to encode digital information for transmission and demodulates signals to decode the transmitted information. The goal is to produce a signal that can be transmitted easily and decoded reliably to reproduce the original digital data. Modems can be used with almost any means of transmitting analog signals from light-emitting diodes to radio. A common type of modem is one that turns the digital data of a computer into modulated electrical signal for transmission over telephone lines and demodulated by another modem at the receiver side to recover the digital data.
subclass of: Network Node

NTFS Link
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: The NTFS filesystem defines various ways to link files, i.e. to make a file point to another file or its contents. The object being pointed to is called the target. There are three classes of NTFS links: (a) Hard links, which have files share the same MFT entry (inode), in the same filesystem; (b) Symbolic links, which record the path of another file that the links contents should show and can accept relative paths; and (c) Junction points, which are similar to symlinks but defined only for directories and only accepts local absolute paths
subclass of: File
subclass of: File System Link

Network Service
type: Class
comment: In computer networking, a network service is an application running at the network application layer and above, that provides data storage, manipulation, presentation, communication or other capability which is often implemented using a client-server or peer-to-peer architecture based on application layer network protocols. Clients and servers will often have a user interface, and sometimes other hardware associated with it.
subclass of: Network Resource

Passive Certificate Analysis
type: Certificate Analysis
type: Class
type: NamedIndividual
analyzes: Certificate File
d3fend-id: D3-PCA
definition: Collecting host certificates from network traffic or other passive sources like a certificate transparency log and analyzing them for unauthorized activity.
enables: Detect
kb-article: ## How it works Certificates are analyzed outside of a TLS server connection using third-party secure update logs, domain name analysis and analytics. ### Secure update certificate logs * Certificate Logs The key enabling feature is a secure service that maintains record logs of certificate activities. The logs allow users to only append certificates and never to delete or modify the log entries. The logs use Merkle Tree Hashes to ensure they have not been tampered with. The logging service also allows for public auditing by any user. The logging service, upon receipt of a certificate to log, will respond with a signed certificate timestamp (SCT). The SCT guarantees the certificate will be added to the log within the time specified. The SCT must be present with the certificate during a TLS handshake. * Certificate Monitoring Certificate monitoring, of the logs, is typically done by the CA and they watch for suspicious certificate logging and unusual certificates or extensions or permissions. Monitors are also responsible for verifying the logs are accurate and public. * Certificate Auditors Log integrity is verified by log auditors. Auditors make use of log proofs are used to validate the cryptographic hashes (Merkle Trees) that the log employs are consistent. In order to ensure consistency throughout multiple monitors and auditors, sharing a common logging service, gossip protocol is employed. ### Phishing domain name analysis * A curated corpus of known benign domains and phishing domain names is used as training text for machine learning. Through the use of feature set extraction, vectors labels are created with scoring to indicated if they are considered benign or phishing domains. * A stream of new or updated SSL certificates with fully qualified domain names (FQDN) is analyzed against the feature vectors and a predictive model determines a score for the domains. The scoring considers distance measures such as Levenshtein distance to help in determining the fin…
kb-reference: Reference - Certificate Transparency
kb-reference: Reference - StreamingPhish
comment: Passively collecting certificates and analyzing them.
subclass of: Certificate Analysis

Password Database
type: Class
comment: A password database is a database that holds passwords for user accounts and is usually encrypted (i.e.., the passwords are hashed). Password databases are found supporting system services (such as SAM) or part of user applications such as password managers.
subclass of: Database

Platform
type: Class
type: NamedIndividual
contains: Firmware
contains: Hardware Device
contains: Operating System
comment: Platform includes the hardware and OS. The term computing platform can refer to different abstraction levels, including a certain hardware architecture, an operating system (OS), and runtime libraries. In total it can be said to be the stage on which computer programs can run.
subclass of: Restriction
  on property: contains
  some values from: Hardware Device
subclass of: Restriction
  on property: contains
  some values from: Firmware
subclass of: Restriction
  on property: contains
  some values from: Operating System
subclass of: Digital Artifact
alternative label: Computer Platform

Process Termination
type: Process Eviction
type: Class
type: NamedIndividual
d3fend-id: D3-PT
definition: Terminating a running application process on a computer system.
enables: Evict
kb-article: ## How it works Processes are managed by the operating system kernel. Different operating system kernels manage the creation and termination of processes in a different manner, and expose this functionality via the kernel API. A running process might be terminated to mitigate its immediate effects if it is exhibiting anomalous, unauthorized, or malicious behavior; such as after detecting anomalous behavior via Administrative Network Activity Analysis, after a failed check from Stack Frame Canary Verification, or after System Call Analysis finds an attempt to execute an unauthorized system call. ### Proprietary technology Security software might use proprietary technology to terminate processes, instead of the system-provided functions. Further research may provide specific detail on such methods used. ### System-provided functions #### Windows tools In Windows, `ExitProcess()` is used to send a signal to a process to request it to exit, and `TerminateProcess()` is used to force a process to exit. The `taskkill` executable available in the cmd shell is used to kill a process, with the `/F` switch forcing termination as with `TerminateProcess()`. In PowerShell, `Stop-Process` is used, which is aliased by default to `spps` and `kill`. Processes started in the Windows Subsystem for Linux (WSL) environment may be terminated there with the `kill` command. #### Unix/Linux tools In Unix-like systems, all process termination requests are handled using signals. The `kill` function takes the Process ID and signal to send, and is accessible with the `kill` command. Some shells have a `kill` builtin function which is separate than the `kill` binary, which can also kill background jobs in the shell and additionally perform the function faster, and can run from an existing instance of the shell if the process table is full. The signal SIGTERM specifies that the process to terminate may invoke a handler that it has defined instead of terminating, and the signal SIGKILL forces immed…
kb-reference: Reference - Instant process termination tool to recover control of an information handling system - Dell Products LP
kb-reference: Reference - Malware detection using local computational models - Crowdstrike Inc
terminates: Process
subclass of: Restriction
  on property: terminates
  some values from: Process
subclass of: Process Eviction

Product Developer
type: Class
comment: A product developer is an organization or individual who develops product.
subclass of: Restriction
  on property: develops
  some values from: Product
subclass of: D3FEND Analysis Thing

Protocol Metadata Anomaly Detection
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Network Traffic
d3fend-id: D3-PMAD
definition: Collecting network communication protocol metadata and identifying statistical outliers.
enables: Detect
kb-article: ## How it works Network protocol metadata is first collected and processed in real-time or post-facto. Metadata may include packet header information or information about a session (ex. time between requests/responses). Metadata is then grouped based on shared characteristics and those groups are compared to each other. If particular metadata differs significantly from other data, an alert is generated, identifying the network event as anomalous. Anomalous activity may indicate unauthorized activity. ## Considerations Metadata collection on enterprises can yield large data sets. Storage, indexing, querying, and aging should be considered prior to implementation.
kb-reference: Reference - Method and system for detecting threats using metadata vectors - VECTRA NETWORKS Inc
kb-reference: Reference - Method and system for detecting threats using passive cluster mapping - Vectra Networks Inc
kb-reference: Reference - System for implementing threat detection using daily network traffic community outliers - VECTRA NETWORKS Inc
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
subclass of: Network Traffic Analysis

Reference - System and method thereof for identifying and responding to security incidents based on preemptive forensics - Palo Alto Networks Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160142424A1
kb-abstract: A system is connected to a plurality of user devices coupled to an enterprise's network. The system continuously collects, stores, and analyzes forensic data related to the enterprise's network. Based on the analysis, the system is able to determine normal behavior of the network and portions thereof and thereby identify abnormal behaviors within the network. Upon identification of an abnormal behavior, the system determines whether the abnormal behavior relates to a security incident. Upon determining a security incident in any portion of the enterprise's network, the system extracts forensic data respective of the security incident and enables further assessment of the security incident as well as identification of the source of the security incident. The system provides real-time damage assessment respective of the security incident as well as the security incident's attributions.
kb-author: Gil BARAK; Shai MORAG
kb-is-example-of: Resource Access Pattern Analysis
kb-is-example-of: User Data Transfer Analysis
kb-is-example-of: Web Session Activity Analysis
kb-mitre-analysis: This patent describes detecting abnormal behavior related to a security incident by collecting and analyzing forensic data in real time. Forensic data may include: * URLs visited * data downloaded or streamed * messages received and sent * amount of memory used for processing The data is then analyzed according to a set of dynamically created rules to determine normal behavior patterns associated with the network or user devices. Anomalies between current behavior and normal behavior patterns trigger an alert.
kb-organization: Palo Alto Networks Inc
kb-reference-title: System and method thereof for identifying and responding to security incidents based on preemptive forensics

Remote Terminal Session Detection
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Network Traffic
d3fend-id: D3-RTSD
definition: Detection of an unauthorized remote live terminal console session by examining network traffic to a network host.
enables: Detect
kb-article: ## How it works An external attacker takes remote control of a host inside a company or organization’s network and manually directs offensive techniques. Nonstandard terminal sessions and abnormal behaviors are analyzed in this technique. Abnormal behavior detection includes analysis of user input patterns in the real-time session, keyboard output and packet inspection. ### Network Traffic Inspection Network traffic from internal hosts is the main concern and focus for the traffic inspection. The network traffic is collected into inspection groups. The groups of traffic are assembled into distinct pair flows (outbound/inbound) and the pair flows are further divided into sessions. Only sessions originated inside of the network are considered for the inspection. Traffic inspection includes analysis to determine if a human is involved in the session exchanges. Time-based statistics are captured for each session being analyzed by the detection engine. ### Algorithm Analysis Description Analysis algorithms look for patterns in the network traffic captured from the session data. A detection engine groups the session traffic data, between the hosts, into rapid exchange instances. Analyze of rapid exchange traffic patterns can lead to the discovery of abnormal behavior which is indicative of a compromised internal host. The analysis algorithms look for patterns in the traffic the correlate to known activity (e.g., relay attacks, bot activity, bit coin mining). Some metrics used during inspection include the following. * Number of rapid-exchange instances * Time interval between packets * Fixed cadence of traffic * Rhythm and direction of the initiation of instances * Volume of data flowing from internal to external controlling host * Data transfer characteristics * Variability in length of silent periods ## Considerations * Full packet capture is required which can be process intensive to analyze * Attackers that move low and slow may blend in with existing traffic resultin…
kb-reference: Reference - CAR-2013-07-002: RDP Connection Detection - MITRE
kb-reference: Reference - CAR-2016-04-005: Remote Desktop Logon - MITRE
kb-reference: Reference - Method and system for detecting external control of compromised hosts - VECTRA NETWORKS Inc
subclass of: Restriction
  on property: analyzes
  some values from: Network Traffic
subclass of: Network Traffic Analysis

Scheduled Job Analysis
type: Operating System Monitoring
type: Class
type: NamedIndividual
analyzes: Task Schedule
d3fend-id: D3-SJA
definition: Analysis of source files, processes, destination files, or destination servers associated with a scheduled job to detect unauthorized use of job scheduling.
enables: Detect
kb-article: ## How it works Scheduled job execution can be utilized by adversaries for the purpose of persistence, conducting remote execution, or gaining privileges. Details of a scheduled job such as associated source files, processes, destination files, or destination servers are first identified and analyzed and then compared against an anti-malware signature database, whitelist, or reputation server. For example, a file associated with a scheduled job to be executed at a specified time or a remote server that is accessed as part of a scheduled task is compared against an anti-malware signature database, whitelist, or reputation server, and if a match is found, execution is denied and an alert is generated. In addition to traditional scheduled jobs, triggers can be set to execute a specific command after detecting a specific event in the system, such as with WMI Event Subscriptions in Windows. ## Considerations Jobs can be scheduled in many different and sometimes creative ways through operating system capabilities.
kb-reference: Reference - CAR-2013-05-004: Execution with AT -
kb-reference: Reference - CAR-2013-08-001: Execution with schtasks -
kb-reference: Reference - Preventing execution of task scheduled malware - McAfee LLC
synonym: Scheduled Job Execution
subclass of: Restriction
  on property: analyzes
  some values from: Task Schedule
subclass of: Operating System Monitoring

Sensor
type: Class
subclass of: D3FEND Thing

Shim
type: Class
type: NamedIndividual
contains: Executable File
comment: In computer programming, a shim is a small library that transparently intercepts API calls and changes the arguments passed, handles the operation itself, or redirects the operation elsewhere. Shims can be used to support an old API in a newer environment, or a new API in an older environment. Shims can also be used for running programs on different software platforms than those for which they were developed.
subclass of: Software

Stack Component
type: Class
comment: A stack component is any component of a call stack used for stack-based memory allocation in a running process. Examples include saved instruction pointers, stack frames, and stack frame canaries.
subclass of: Digital Artifact

System Configuration Init Resource
type: Class
comment: A system configuration initialization resource has information for initializing (booting) a system.
subclass of: Local Resource
alternative label: System Init Resource

System Daemon Monitoring
type: Operating System Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-SDM
definition: Tracking changes to the state or configuration of critical system level processes.
enables: Detect
kb-article: ## How it works Attackers may manipulate system settings or services to disable system logging or monitoring of security tools and events. Firewall and antivirus services are popular targets for attackers. Disabling system logs will also allow an attacker's actions to go unnoticed. Analysis of logs, registries, and process monitoring help defenders locate signs of tampering. Two possible approaches are to monitor hardened system services or to monitor registry updates for modifications to security settings.
kb-reference: Reference - CAR-2016-04-003: User Activity from Stopping Windows Defensive Services - MITRE
kb-reference: Reference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd
kb-reference: Reference - Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system - Symantec Corporation
monitors: Operating System Process
subclass of: Restriction
  on property: monitors
  some values from: Operating System Process
subclass of: Operating System Monitoring

System Init Configuration
type: Class
comment: System initialization configuration information is configuration information used to configure the services, parameters, and initial settings for an operating system at startup.
subclass of: Operating System Configuration Component
alternative label: System Configuration Init Resource

Data Obfuscation
type: Class
type: NamedIndividual
attack-id: T1001
enables: Command And Control
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Obfuscated Files or Information
type: Class
type: NamedIndividual
attack-id: T1027
enables: Defense Evasion
subclass of: Defense Evasion Technique

Exfiltration Over Alternative Protocol
type: Class
type: NamedIndividual
attack-id: T1048
enables: Exfiltration
produces: Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Internet Network Traffic
subclass of: Exfiltration Technique

Web Service
type: Class
type: NamedIndividual
attack-id: T1102
enables: Command And Control
produces: Outbound Internet Web Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Web Traffic
subclass of: Command and Control Technique

Email Collection
type: Class
type: NamedIndividual
accesses: Resource
attack-id: T1114
enables: Collection
subclass of: Restriction
  on property: accesses
  some values from: Resource
subclass of: Collection Technique

Create Account
type: Class
type: NamedIndividual
attack-id: T1136
creates: User Account
enables: Persistence
enables: Privilege Escalation
subclass of: Restriction
  on property: creates
  some values from: User Account
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Supply Chain Compromise
type: Class
type: NamedIndividual
attack-id: T1195
enables: Initial Access
modifies: Digital Artifact
subclass of: Restriction
  on property: modifies
  some values from: Digital Artifact
subclass of: Initial Access Technique

Network Denial of Service
type: Class
type: NamedIndividual
attack-id: T1498
enables: Impact
subclass of: Impact Technique

Server Software Component
type: Class
type: NamedIndividual
attack-id: T1505
enables: Persistence
subclass of: Persistence Technique

Pre-OS Boot
type: Class
type: NamedIndividual
attack-id: T1542
enables: Defense Evasion
enables: Persistence
subclass of: Defense Evasion Technique
subclass of: Persistence Technique

Credentials from Password Stores
type: Class
type: NamedIndividual
accesses: Password Store
attack-id: T1555
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Password Store
subclass of: Credential Access Technique

Steal or Forge Kerberos Tickets
type: Class
type: NamedIndividual
attack-id: T1558
enables: Credential Access
may-access: Kerberos TIcket
may-create: Kerberos TIcket
subclass of: Restriction
  on property: may-create
  some values from: Kerberos TIcket
subclass of: Restriction
  on property: may-access
  some values from: Kerberos TIcket
subclass of: Credential Access Technique

Archive Collected Data
type: Class
type: NamedIndividual
attack-id: T1560
creates: Archive File
enables: Collection
subclass of: Restriction
  on property: creates
  some values from: Archive File
subclass of: Collection Technique

Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565
enables: Impact
subclass of: Impact Technique

Phishing
type: Class
type: NamedIndividual
attack-id: T1566
enables: Initial Access
subclass of: Initial Access Technique

Dynamic Resolution
type: Class
type: NamedIndividual
attack-id: T1568
enables: Command And Control
produces: Outbound Internet DNS Lookup Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: Command and Control Technique

Transfer Agent Authentication
type: Message Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-TAAN
definition: Validating that server components of a messaging infrastructure are authorized to send a particular message.
enables: Harden
kb-article: ## How it works Transfer Agent Authentication can be accomplished in different ways for depending on the protocol. In Email, Sender Policy Framework (SPF), Domain Key Identified Email (DKIM) or Domain-based Message Authentication Reporting and Conformance (DMARC) to validate sender domain ownership. ### SPF SPF protocol allows for mail domain owners to specify the mail servers they use when sending email. SPF requires the use of SPF records published in the Domain Name System (DNS). The records record the authorized IPs for email senders. SPF uses the return-path address for domain IP identification. Email that is forwarded may cause the return-path validation problems. ### DKIM DKIM also uses a record entry in DNS for authentication but does not rely on the simple return-path for validation. A signature header is added to email and encryption is used for security. This adds an additional layer of complexity and requires that DKIM servers be configured identified cryptographic signatures. The additional complexity results in a validation process that can survive complex routing of emails. ### DMARC DMARC is an email policy and authentication protocol that seeks to ensure that the “From” field of emails is not spoofed. DMARC makes use of both SPF records and DKIM published key validation. DMARC also has a decision policy framework, contained in a DMARC record, for handling of rejected email. The DMARC framework also updates DMARC domains with authentication statues for allowed senders of that domain. ## Considerations - Additional work is required to ensure that all SPF, DKIM and DMARC records are current and up to date. - Maintenance of DKIM signing keys is needed. - Using SPF without DKIM and DMARC verifies the Return-Path domain however does not prevent spoofing of the displayed From: address. - Parts of an email that are not signed or verified by email authentication methods, such as the message body or the header To: and Subject: fields, can be altered or modifi…
kb-reference: Reference – RFC 6376: DomainKeys Identified Mail (DKIM) Signatures – IETF
kb-reference: Reference – RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) – IETF
kb-reference: Reference - RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email – IETF
subclass of: Message Hardening

User Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: A user process is a process running to perform functions in the name of on particular user and user account, such as run an application or application service serving any number users. This is in contrast to a system process, which executes software to fulfill operating system functions.
subclass of: Process

Video Input Device
type: Class
type: NamedIndividual
comment: Video input devices are used to digitize images or video from the outside world into the computer. The information can be stored in a multitude of formats depending on the user's requirement.
subclass of: Input Device

copies
type: ObjectProperty
comment: x copies y: An technique or agent x reproduces or makes and exact copy of some digital artifact y.
sub property of: creates

d3fend-kb-annotation-property
type: AnnotationProperty
comment: x d3fend-kb-annotation-property y: The entity x had the d3fend kb annotation y.
sub property of: d3fend-annotation

d3fend-kb-reference-annotation
type: AnnotationProperty
comment: x d3fend-kb-data-property y: The reference x has the data property y.
domain: Reference
range: string
sub property of: d3fend-kb-annotation-property

disables
type: ObjectProperty
comment: x disables y: The technique or agent x makes an entity y unable to perform its actions or capabilities.
sub property of: modifies

isolates
type: ObjectProperty
comment: x isolates y: The technique or agent x sets digital artifact y apart from other digital artifacts, sequestering y.
sub property of: associated-with

manages
type: ObjectProperty
comment: x manages y: The technique or agent x watches and directs the use of a digital artifact y.
sub property of: associated-with
alternative label: oversees
alternative label: supervises

process-property
type: ObjectProperty
comment: x process-property y: Process x has the a process-property y. This is generalization for specific process object properties.
sub property of: associated-with

records
type: ObjectProperty
comment: x records y: The digital artifact x makes a record of events y; set down in permanent form.
sub property of: associated-with

Authorization Event Thresholding
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Authorization
d3fend-id: D3-AZET
definition: Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile.
enables: Detect
kb-article: ## How it works Authorization event data is collected to create a baseline user profile. Authorization events that deviate from the baseline and exceed a static or dynamic threshold are identified for further action. Authorization events can include successful and failed authorization attempts as well as events related to permissions including viewing, editing, deleting, creating files, databases etc. ## Considerations Depending on the complexity of the data considered, outliers may not be obvious to a human analyst reviewing events in simplistic analytic views. If malicious activity is not statistically different from benign activity, an alert threshold will not be met.
kb-reference: Reference - CAR-2013-02-012: User Logged in to Multiple Hosts - MITRE
kb-reference: Reference - CAR-2013-09-003: SMB Session Setups - MITRE
kb-reference: Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC
kb-reference: Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
subclass of: User Behavior Analysis

Browser Extension
type: Class
type: NamedIndividual
contains: Executable File
extends: Browser
may-contain: Application Configuration
uses: Resource
comment: A browser extension is a plug-in that extends the functionality of a web browser in some way. Some extensions are authored using web technologies such as HTML, JavaScript, and CSS. Browser extensions can change the user interface of the web browser without directly affecting viewable content of a web page; for example, by adding a "toolbar."
subclass of: Restriction
  on property: extends
  some values from: Browser
subclass of: User Application

Cloud User Account
type: Class
type: NamedIndividual
comment: A user account on a given host is a local user account for a given cloud and specified resources within that cloud.
subclass of: User Account

Command
type: Class
type: NamedIndividual
comment: In computing, a command is a directive to a computer program acting as an interpreter of some kind, in order to perform a specific task. Most commonly a command is either a directive to some kind of command-line interface, such as a shell, or an event in a graphical user interface triggered by the user selecting an option in a menu.
subclass of: Digital Artifact
subclass of: Digital Event

Command History Log
type: Class
type: NamedIndividual
comment: A log of commands run in an operating system shell.
subclass of: Event Log

Compiler Configuration File
type: Class
type: NamedIndividual
contains: Application Configuration
may-contain: File
may-contain: URL
comment: A file containing Information used to configure the parameters and initial settings for a compiler.
subclass of: Application Configuration File

Configuration File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A file containing Information used to configure the parameters and initial settings for some computer programs. They are used for user applications, server processes and operating system settings.
subclass of: File
alternative label: Settings File

Credential Eviction
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-CE
definition: Credential Eviction techniques disable or remove compromised credentials from a computer network.
enables: Evict
subclass of: Restriction
  on property: enables
  some values from: Evict
subclass of: Defensive Technique

Decoy File
type: Decoy Object
type: Class
type: NamedIndividual
d3fend-id: D3-DF
definition: A file created for the purposes of deceiving an adversary.
enables: Deceive
kb-article: ## How it works The decoy file is made available as a local or network resource. Accesses to the file may be monitored. The files may be configurations, documents, executables, or other file types. ## Considerations Properties of the file such as cryptographic checksums, file creation date, file modified date, file size, file owner etc may be modified to improve the credibility of the file. ## Example * A CSV file with decoy user credentials is placed on a system. The system or network is then monitored to detect any accesses to the decoy files.
kb-reference: Reference - Open source intelligence deceptions - Illusive Networks Ltd
kb-reference: Reference - Supply chain cyber-deception - Cymmetria, Inc.
kb-reference: Reference - System and a method for identifying the presence of malware and ransomware using mini-traps set at network endpoints - Fidelis Cybersecurity Solutions Inc
kb-reference: Reference - System and methods thereof for preventing ransomware from encrypting data elements stored in a memory of a computer-based system - Palo Alto Networks Inc
spoofs: File
subclass of: Restriction
  on property: spoofs
  some values from: File
subclass of: Decoy Object

Decoy Network Resource
type: Decoy Object
type: Class
type: NamedIndividual
d3fend-id: D3-DNR
definition: Deploying a network resource for the purposes of deceiving an adversary.
enables: Deceive
kb-article: ## How it works Decoy network resources are deployed to web application servers, network file shares, or other network based sharing services. A "honeypot" may serve a variety of decoy network resources. ## Considerations * Developing a deployment and placement strategy for the decoy network resource. * Personnel responsible for creation of decoy networks should consider the potential for resource exhaustion through denial of service attacks. ## Examples * Honeypots are typically used to mimic a known system with fake vulnerabilities. This may attract attackers to the honeypot. * Decoy accounts are also used to scan for attempted logins. The decoy accounts can provide security analysts with the attacker's potential intents and strategies. * Tarpits are used to monitor unallocated IP space for unauthorized network activity.
kb-reference: Reference - Automatically generating network resource groups and assigning customized decoy policies thereto - Illusive Networks Ltd
kb-reference: Reference - Deception-Based Responses to Security Attacks - Crowdstrike Inc
kb-reference: Reference - Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network - Palo Alto Networks Inc
kb-reference: Reference - System and method for identifying the presence of malware using mini-traps set at network endpoints - Fidelis Cybersecurity Solutions Inc
spoofs: Network Resource
subclass of: Restriction
  on property: spoofs
  some values from: Network Resource
subclass of: Decoy Object

Developer Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An application used to develop computer software including applications used for software construction, analysis, testing, packaging, or management.
subclass of: User Application

File Content Rules
type: File Analysis
type: Class
type: NamedIndividual
analyzes: File
d3fend-id: D3-FCR
definition: Employing a pattern matching rule language to analyze files.
enables: Detect
kb-article: ## How it works Rules, often called signatures, are used for both generic and targeted malware detection. The rules are usually expressed in a domain specific language (DSL), then deployed to software that scans files for matches. The rules are developed and broadly distributed by commercial vendors, or they are developed and deployed by enterprise security teams to address highly targeted or custom malware. Conceptually, there are public and private rule sets. Both leverage the same technology, but they are intended to detect different types of cyber adversaries. ## Considerations * Patterns expressed in the DSLs range in their complexity. Some scanning engines support file parsing and normalization for high fidelity matching, others support only simple regular expression matching against raw file data. Engineers must make a trade-off in terms of: * The fidelity of the matching capabilities in order to balance high recall with avoiding false positives, * The computational load for scanning, and * The resilience of the engine to deal with adversarial content presented in different forms-- content which in some cases is designed to exploit or defeat the scanning engines. * Signature libraries can become large over time and impact scanning performance. * Some vendors who sell signatures have to delete old signatures over time. * Simple signatures against raw content cannot match against encoded, encrypted, or sufficiently obfuscated content. ## Implementations * YARA * ClamAV
kb-reference: Reference - Computational modeling and classification of data streams - Crowdstrike Inc
kb-reference: Reference - Detecting script-based malware - Crowdstrike Inc
kb-reference: Reference - Distributed meta-information query in a network - Bit 9 Inc
synonym: File Content Signatures
synonym: File Signatures
subclass of: Restriction
  on property: analyzes
  some values from: File
subclass of: File Analysis

Forward Resolution Domain Denylisting
type: DNS Denylisting
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
blocks: Outbound Internet DNS Lookup Traffic
d3fend-id: D3-FRDDL
definition: Blocking a lookup based on the query’s domain name value.
enables: Isolate
kb-article: ## How it works Policies are created that filter DNS queries using fully qualified domain name (FQDN) of record in the query. A DNS policy can be created for blocking DNS queries from FQDNs that have been identified as unauthorized. ## Considerations Continuous maintenance of unauthorized domain lists is needed to keep up to date as updates occur.
kb-reference: Reference - Use DNS Policy for Applying Filters on DNS Queries
synonym: Forward Resolution Domain Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: DNS Denylisting

Group Policy
type: Class
type: NamedIndividual
comment: Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. Group Policy provides the centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. A version of Group Policy called Local Group Policy ("LGPO" or "LocalGPO") also allows Group Policy Object management on standalone and non-domain computers.
subclass of: Access Control Information

Host
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A host is a computer or other device, typically connected to a computer network. A network host may offer information resources, services, and applications to users or other nodes on the network. A network host is a network node that is assigned a network layer host address. Network hosts that participate in applications that use the client-server model of computing, are classified as server or client systems. Network hosts may also function as nodes in peer-to-peer applications, in which all nodes share and consume resources in an equipotent manner.
subclass of: Restriction
  on property: contains
  some values from: Application
subclass of: Restriction
  on property: runs
  some values from: Operating System
subclass of: Restriction
  on property: contains
  some values from: Operating System
subclass of: Digital Artifact
subclass of: Network Node
alternative label: Network Host

Identifier Analysis
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-ID
definition: Analyzing identifier artifacts such as IP address, domain names, or URL(I)s.
enables: Detect
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

In-memory Password Store
type: Class
type: NamedIndividual
comment: A password store held in memory.
subclass of: Password Store

Inbound Internet DNS Response Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
produces: Network Traffic
comment: Inbound internet DNS response traffic is DNS response traffic from a host outside a given network initiated on an incoming connection to a host inside that network.
subclass of: Inbound Internet Network Traffic

Inbound Internet Mail Traffic
type: Class
type: NamedIndividual
contains: Email
may-contain: Domain Name
originates-from: Physical Location
produces: Network Traffic
comment: Inbound internet mail traffic is network traffic that is: (a) coming from a host outside a given network via an incoming connection to a host inside that same network, and (b) using a standard protocol for email.
subclass of: Inbound Internet Network Traffic
subclass of: Mail Network Traffic

Intranet IPC Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
may-contain: File
originates-from: Physical Location
comment: Intranet IPC network traffic is network traffic that does not cross a given network's boundaries and uses a standard inter-process communication (IPC) networking protocol.
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: IPC Network Traffic
subclass of: Intranet Network Traffic

Kernel
type: Class
type: NamedIndividual
contains: Executable File
contains: Kernel Process Table
loads: Application
manages: Operating System Process
manages: User Process
may-contain: Hardware Driver
may-contain: Kernel Module
comment: The kernel is a computer program that constitutes the central core of a computer's operating system. It has complete control over everything that occurs in the system. As such, it is the first program loaded on startup, and then manages the remainder of the startup, as well as input/output requests from software, translating them into data processing instructions for the central processing unit. It is also responsible for managing memory, and for managing and communicating with computing peripherals, like printers, speakers, etc. The kernel is a fundamental part of a modern computer's operating system.
subclass of: Restriction
  on property: manages
  some values from: User Process
subclass of: Restriction
  on property: loads
  some values from: Application
subclass of: Restriction
  on property: manages
  some values from: Operating System Process
subclass of: Restriction
  on property: contains
  some values from: Kernel Process Table
subclass of: Restriction
  on property: may-contain
  some values from: Kernel Module
subclass of: Restriction
  on property: may-contain
  some values from: Hardware Driver
subclass of: Digital Artifact
subclass of: System Software

Kernel Process Table
type: Class
type: NamedIndividual
comment: A data structure in the kernel which is a table containing all of the information that must be saved when the CPU switches from running one process to another in a multitasking system. It allows the operating system to track all the process's execution status, and contains the For every process managed by the kernel, there is a process control block (PCB) in the process table.
subclass of: Digital Artifact

Local Area Network
type: Class
type: NamedIndividual
may-contain: Host
comment: A local area network (LAN) is a computer network that interconnects computers within a limited area such as a residence, school, laboratory, university campus or office building and has its network equipment and interconnects locally managed. Ethernet and Wi-Fi are the two most common transmission technologies in use for local area networks. Historical technologies include ARCNET, Token ring, and AppleTalk.
subclass of: Restriction
  on property: may-contain
  some values from: Host
subclass of: Network
alternative label: LAN

Mail Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: Within the Internet email system, a message transfer agent or mail transfer agent (MTA) or mail relay is software that transfers electronic mail messages from one computer to another using SMTP. The terms mail server, mail exchanger, and MX host are also used in some contexts. Messages exchanged across networks are passed between mail servers, including any attached data files (such as images, multimedia or documents). These servers also often keep mailboxes for email. Access to this email by end users is typically either via webmail or an email client.
subclass of: Server
alternative label: Email Server Resource
alternative label: MTA
alternative label: MX Host
alternative label: Mail Exchanger
alternative label: Mail transfer agent
alternative label: Message transfer agent

Message Analysis
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-MA
definition: Analyzing email or instant message content to detect unauthorized activity.
enables: Detect
kb-article: ## Technique Overview Email and messaging are frequently used to deliver malicious content to targets. These enterprise capabilities are used to deliver software exploits or social engineering tricks. If the recipient of a message trusts the sender, attackers can avoid escalating suspicion. Emails and messages are also complex data structures. They contain files and links, and complex data encodings which vary region to region. Thus the defensive techniques used to analyze emails and messages are highly varied ranging from deep content analysis and execution to social network graph-style analytics to analyze trust or risk.
synonym: Electronic Message Analysis
synonym: Email Or Messaging Analysis
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

Network
type: Class
comment: A network is a group of computers that use a set of common communication protocols over digital interconnections for the purpose of sharing resources located on or provided by the network nodes. The interconnections between nodes are formed from a broad spectrum of telecommunication network technologies, based on physically wired, optical, and wireless radio-frequency methods that may be arranged in a variety of network topologies.
subclass of: Digital Artifact
alternative label: Computer Network

Object File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: Relocatable machine code
subclass of: File

Password
type: Class
type: NamedIndividual
authenticates: User Account
comment: A password, sometimes called a passcode, is a memorized secret, typically a string of characters, usually used to confirm the identity of a user. Using the terminology of the NIST Digital Identity Guidelines, the secret is memorized by a party called the claimant while the party verifying the identity of the claimant is called the verifier. When the claimant successfully demonstrates knowledge of the password to the verifier through an established authentication protocol, the verifier is able to infer the claimant's identity.
subclass of: Credential
alternative label: Passcode

Public Key
type: Class
type: NamedIndividual
comment: A public key can be disseminated widely as part of an asymmetric cryptography framework and be used to encrypt messages to send to the public key's owner or to authenticate signed messages from that sender.
subclass of: Asymmetric Key

RDP Session
type: Class
type: NamedIndividual
comment: A Remote Desktop Protocol (RDP) session is a session established using the RDP protocol to access Remove Desktop Services (RDS).
subclass of: Remote Session
alternative label: Remote Desktop Session
alternative label: Terminal Services

Record
type: Class
comment: In computer science, a record (also called struct or compound data) is a basic data structure. A record is a collection of fields, possibly of different data types, typically in fixed number and sequence . The fields of a record may also be called members, particularly in object-oriented programming. Fields may also be called elements, though these risk confusion with the elements of a collection. A tuple may or may not be considered a record, and vice versa, depending on conventions and the specific programming language.
subclass of: Digital Artifact

Reference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20110023115A1
kb-abstract: In embodiments of the present invention improved capabilities are described for threat detection using a behavioral-based host-intrusion prevention method and system for monitoring a user interaction with a computer, software application, operating system, graphic user interface, or some other component or client of a computer network, and performing an action to protect the computer network based at least in part on the user interaction and a computer code process executing during or in association with a computer usage session.
kb-author: Clifford C. Wright
kb-is-example-of: Resource Access Pattern Analysis
kb-is-example-of: System Daemon Monitoring
kb-is-example-of: Web Session Activity Analysis
kb-mitre-analysis: The patent describes a technique for performing behavior based threat detection. User and code behavior data is collected and stored to create baseline user and code behavior profiles. User behavior data collected over a user session or over multiple sessions can include a user: * clicking on a link * scrolling down a page * opening or closing a window * downloading a file * saving a file * running a file * typing a keyword Code behavior monitored includes code: * copying itself to a system folder * setting a run key to itself in the registry * setting a second runkey to itself in the registry in a different location * disabling OS tools in the registry * opening a hidden file The user interaction and the code process executed during the user session are monitored and compared with predetermined malicious behavior profiles that are typically present in a malicious user session. The predetermined collection of malicious behaviors are created based on analysis of families of malware in run time in a threat research facility. If a match is made an action is taken that can include isolating the computer on which the user interaction occurs and limiting network access to or from the computer.
kb-organization: Sophos Ltd
kb-reference-title: Host intrusion prevention system using software and user behavior analysis

Resource Access
type: Class
type: NamedIndividual
comment: Ephemeral digital artifact comprising a request of a resource and any response from that resource.
subclass of: Digital Artifact
subclass of: Digital Event
subclass of: User Action

SSH Session
type: Class
type: NamedIndividual
comment: A Secure Shell Protocol (SSH) session is a session over a secure channel established using SSH to connect a client to a server and establish the remote session.
subclass of: Remote Session

Session Cookie
type: Class
type: NamedIndividual
authenticates: User Account
comment: A session cookie, also known as an in-memory cookie, transient cookie or non-persistent cookie, exists only in temporary memory while the user navigates the website. Web browsers normally delete session cookies when the user closes the browser. Unlike other cookies, session cookies do not have an expiration date assigned to them, which is how the browser knows to treat them as session cookies.
subclass of: Credential
alternative label: In-memory Cookie
alternative label: Non-persistent Cookie
alternative label: Transient Cookie
alternative label: Web Session Cookie

Shared Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
subclass of: Client Computer

Stack Frame Canary Verification
type: Application Hardening
type: Class
type: NamedIndividual
d3fend-id: D3-SFCV
definition: Comparing a value stored in a stack frame with a known good value in order to prevent or detect a memory segment overwrite.
enables: Harden
kb-article: ## How it works This defense must be applied at compile-time, or via a patch to the program binary. Stack Frame Canary Verification inserts instructions at the prologue and epilogue of desired functions. In the prologue, a canary value, typically with the same size as the register size, is stored in the system of record and on the stack. Typically, the canary is loaded to where it has a memory address just below that of the saved instruction pointer and base pointer. In the epilogue, the canary value stored on the stack and, is compared to the canary value in the system of record. If the values are different, other techniques such as those in Process Eviction might be invoked, such as Process Termination to end the current process, or Executable Blacklisting to blacklist the potentially vulnerable or malfunctioning executable. Stack Frame Canary Verification is commonly used to detect potential tampering of a saved register value on the stack before it has been restored. Examples of registers with values commonly saved to the stack include the instruction pointer and the base pointer. The canary should be stored between where the start of a buffer overrun is likely, and the data to protect, in cases where the buffer size increases it will overwrite the data to be protected. On most processor architectures, including x86, x64, and ARM, a “push” operation to store data to the stack grows the stack towards a lower memory address. As in these architectures, saved register values are stored to the stack at a point in time just before space is made for the local function variables, the saved register values have a higher address than that of the local function variables. Values at increasing indexes of a buffer are written to increasing memory addresses; therefore, an overwrite in the local variable buffer could overwrite saved register values, and a stack canary between these two would be useful in detecting an overwrite. On some other processor architectures such as the…
kb-reference: Reference - /GS (Buffer Security Check) - Microsoft Docs
kb-reference: Reference - Security Technologies: Stack Smashing Protection (StackGuard) - Red Hat
verifies: Stack Frame
subclass of: Restriction
  on property: verifies
  some values from: Stack Frame
subclass of: Application Hardening

Storage
type: Class
type: NamedIndividual
may-contain: File System
comment: Computer data storage, often called storage or memory, is a technology consisting of computer components and recording media used to retain digital data. It is a core function and fundamental component of computers. In the Von Neumann architecture, the CPU consists of two main parts: The control unit and the arithmetic / logic unit (ALU). The former controls the flow of data between the CPU and memory, while the latter performs arithmetic and logical operations on data.
subclass of: Restriction
  on property: may-contain
  some values from: File System
subclass of: Digital Artifact
alternative label: Computer data storage

System Call Analysis
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: System Call
d3fend-id: D3-SCA
definition: Analyzing system calls to determine whether a process is exhibiting unauthorized behavior.
enables: Detect
kb-article: ## How it works System calls are APIs between a user application and the operating system [1]. By analyzing a process's use of these APIs, it is, in some cases, possible to ascertain whether a program is exhibiting unauthorized behavior, including trying to escalate its privileges. ### Gathering System Calls A common method to capture system calls is to use kernel APIs to hook [2] a process's system call invocations. The Linux system call `ptrace` tracks other system calls in a process and allows their alteration; this is made use of by GDB. `strace` utilizes `ptrace` and will print to stdout each system call invoked. Other applications record this data in local or remote databases. The log entry for each system call, which may reference additional information such as the date and time, and the process tree for the process which made the system call, is relayed, in real time or post-facto, to an analysis module which consults a catalog or model to determine whether the distribution matches a known-good or known-bad pattern. ### Analysis System calls are analyzed with a variety of methods. Some analytics look for specific sequences of instructions, others may apply statistical methods to identify abnormal behavior. Sequences of instructions can be abstracted into conceptually higher order user activities, for example: * An attacker executes many system calls in a short period of time, with several sequences which could be used to escalate privileges. * Getting the contents from a URL, writing to a new file, and then executing the same file. * A ransomware program which either uses a loop or creates many threads to: read a specified file, encrypt its contents, create an output file with a similar name to the original file, and delete the unencrypted original. ## Considerations * Duplicative or extraneous system calls may be added to malware to defeat analytics. * Malware could replace API hooking instructions to allow system calls to be made without being monitored. *…
kb-reference: Reference - CAR-2013-10-002: DLL Injection via Load Library - MITRE
kb-reference: Reference - Hardware-assisted system and method for detecting and analyzing system calls made to an operting system kernel - Endgame Inc
kb-reference: Reference - Malware detection in event loops - Crowdstrike Inc
subclass of: Restriction
  on property: analyzes
  some values from: System Call
subclass of: Process Analysis

System Configuration Init Database Record
type: Class
type: NamedIndividual
comment: A database record holding information used to configure the services, parameters, and initial settings for an operating system at startup.
subclass of: System Configuration Database Record
subclass of: System Configuration Init Resource
subclass of: System Init Configuration
alternative label: System Configuration Startup Database Record

System Firewall Configuration
type: Class
type: NamedIndividual
comment: The configuration for a individual host operating system's firewall.
subclass of: Operating System Configuration Component

System Password Database
type: Class
type: NamedIndividual
comment: A password database used by a system service or process to authenticate users (e.g., Security Account Manager)
subclass of: Password Database

Input Capture
type: Class
type: NamedIndividual
accesses: Digital Artifact
attack-id: T1056
enables: Collection
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Digital Artifact
subclass of: Collection Technique
subclass of: Credential Access Technique

Application Layer Protocol
type: Class
type: NamedIndividual
attack-id: T1071
enables: Command And Control
pref-label: Application Layer Protocol C2
produces: Outbound Internet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Outbound Internet Network Traffic
subclass of: Command and Control Technique

Valid Accounts
type: Class
type: NamedIndividual
attack-id: T1078
enables: Defense Evasion
enables: Initial Access
enables: Persistence
enables: Privilege Escalation
produces: Authentication
produces: Authorization
uses: User Account
subclass of: Restriction
  on property: produces
  some values from: Authorization
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: uses
  some values from: User Account
subclass of: Defense Evasion Technique
subclass of: Initial Access Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Proxy
type: Class
type: NamedIndividual
attack-id: T1090
enables: Command And Control
subclass of: Command and Control Technique

Account Manipulation
type: Class
type: NamedIndividual
attack-id: T1098
enables: Persistence
modifies: User Account
subclass of: Restriction
  on property: modifies
  some values from: User Account
subclass of: Persistence Technique

Brute Force
type: Class
type: NamedIndividual
attack-id: T1110
enables: Credential Access
subclass of: Credential Access Technique

Create or Modify System Process
type: Class
type: NamedIndividual
attack-id: T1543
enables: Persistence
enables: Privilege Escalation
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Abuse Elevation Control Mechanism
type: Class
type: NamedIndividual
attack-id: T1548
enables: Defense Evasion
enables: Privilege Escalation
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique

Use Alternate Authentication Material
type: Class
type: NamedIndividual
accesses: Authentication Service
attack-id: T1550
enables: Defense Evasion
enables: Lateral Movement
subclass of: Restriction
  on property: accesses
  some values from: Authentication Service
subclass of: Defense Evasion Technique
subclass of: Lateral Movement Technique

Subvert Trust Controls
type: Class
type: NamedIndividual
attack-id: T1553
enables: Defense Evasion
subclass of: Defense Evasion Technique

Modify Authentication Process
type: Class
type: NamedIndividual
attack-id: T1556
enables: Credential Access
enables: Defense Evasion
modifies: Authentication Service
subclass of: Restriction
  on property: modifies
  some values from: Authentication Service
subclass of: Credential Access Technique
subclass of: Defense Evasion Technique

Impair Defenses
type: Class
type: NamedIndividual
attack-id: T1562
enables: Defense Evasion
subclass of: Defense Evasion Technique

Unix Link
type: Class
comment: A Unix link is a file link in a Unix file system.
subclass of: File System Link

User Logon Init Resource
type: Class
comment: A user logon initialization resource contains information used to configure a user's environment when a user logs into a system.
subclass of: Local Resource

User to User Message
type: Class
type: NamedIndividual
has-recipient: User Account
has-sender: User Account
comment: Personal message, private message (PM), direct message (DM), or personal chat (PC) is a private form of messaging between different members on a given platform. It is only seen and accessible by the users participating in the message.
subclass of: Restriction
  on property: has-recipient
  some values from: User Account
subclass of: Restriction
  on property: has-sender
  some values from: User Account
subclass of: Digital Artifact
alternative label: Personal Message
alternative label: Private Message

Virtualization Software
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: Virtualization software allows a single host computer to create and run one or more virtual environments. Virtualization software is most often used to emulate a complete computer system in order to allow a guest operating system to be run, for example allowing Linux to run as a guest on top of a PC that is natively running a Microsoft Windows operating system (or the inverse, running Windows as a guest on Linux).
subclass of: Service Application

Web File Resource
type: Class
type: NamedIndividual
addressed-by: URL
contains: File
comment: A web resource is a resource identified by a Uniform Resource Identifier (URI) and made available from one host to another host via a web protocol and across a network or networks.
subclass of: Restriction
  on property: addressed-by
  some values from: URL
subclass of: Network File Resource
alternative label: Web Resource

Web Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A web server is server software, or hardware dedicated to running this software, that can satisfy client requests on the World Wide Web. A web server can, in general, contain one or more websites. A web server processes incoming network requests over HTTP and several other related protocols. While the major function is to serve content, a full implementation of HTTP also includes ways of receiving content from clients. This feature is used for submitting web forms, including uploading of files.
subclass of: Server

Web Session Activity Analysis
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Web Resource Access
d3fend-id: D3-WSAA
definition: Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior.
enables: Detect
kb-article: ## How it works User web session data is collected over a period of time to create a user behavior profile. Data collected includes clicks made on a website, average time between clicks, filling out web forms, order in which pages are viewed, and downloading files. Current user web session behavior is then compared against the use behavior profile to identify anomalies and a likelihood that the current user web session is malicious. Current user web session behavior can also be compared to predetermined known malicious behavior profiles that are developed through analysis of malware in run time at a threat research facility. ## Considerations * Potential for false positives from anomalies that are not associated with malicious activity. * Attackers may not differentiate their web session activity enough to trigger an alert.
kb-reference: Reference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd
kb-reference: Reference - System and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Velocity Analysis - Silver Tail Systems
kb-reference: Reference - System and Method for Network Security Including Detection of Attacks Through Partner Websites - EMC IP Holding Co LLC
kb-reference: Reference - System and method thereof for identifying and responding to security incidents based on preemptive forensics - Palo Alto Networks Inc
subclass of: Restriction
  on property: analyzes
  some values from: Web Resource Access
subclass of: User Behavior Analysis

addresses
type: ObjectProperty
comment: x addresses y: Relates a pointer x to a digital artifact y located in the address space to which x points. The address space is part of some digital store, whether it be in memory, an image, or a persistent storage device.
domain: Identifier
range: Resource
sub property of: associated-with
alternative label: points-to

display-order
type: DatatypeProperty
comment: x display-order y: An object x should be displayed in ordinal position y when placed or listed in a d3fend display with other objects of its kind.
sub property of: d3fend-display-property

filters
type: ObjectProperty
comment: x filters y: An technique or agent x removes some specified set of of entities from the content of a digital artifact y, by passing an artifact's content through a filter. A filter is a device that removes something from whatever passes through it.
sub property of: associated-with

process-data-property
type: DatatypeProperty
comment: x process-data-property y: The process x has the data property y.
sub property of: d3fend-artifact-data-property

reads
type: ObjectProperty
comment: x reads y: The subject x takes the action of reading from a digital source y to acquire data and placing it into volatile memory for processing.
sub property of: accesses

Application Configuration Database
type: Class
type: NamedIndividual
contains: Application Configuration Database Record
comment: A database used to hold application configuration data.
subclass of: Restriction
  on property: contains
  some values from: Application Configuration Database Record
subclass of: Database

Application Configuration File
type: Class
type: NamedIndividual
contains: Application Configuration
may-contain: File
may-contain: URL
comment: A file containing Information used to configure the parameters and initial settings for an application.. A plist file is an example of this type of file for macOS. Usually text-based.
subclass of: Restriction
  on property: contains
  some values from: Application Configuration
subclass of: Configuration File

Certificate
type: Class
type: NamedIndividual
contains: Identifier
contains: Public Key
comment: In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about the identity of its owner (called the subject), and the digital signature of an entity that has verified the certificate's contents (called the issuer). If the signature is valid, and the software examining the certificate trusts the issuer, then it can use that key to communicate securely with the certificate's subject. In email encryption, code signing, and e-signature systems, a certificate's subject is typically a person or organization. However, in Transport Layer Security (TLS) a certificate's subject is typically a computer or other device, t
subclass of: Restriction
  on property: contains
  some values from: Public Key
subclass of: Restriction
  on property: contains
  some values from: Identifier
subclass of: Digital Artifact
alternative label: Public Key Certificate

Certificate Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Certificate File
d3fend-id: D3-CA
definition: Analyzing Public Key Infrastructure certificates to detect if they have been misconfigured or spoofed using both network traffic, certificate fields and third-party logs.
enables: Detect
kb-article: ## How it works Certificate Analysis ensures that the data elements of the certificate are current and anchored in a known trust model. Certificate authorities, revocation lists, and third-party secure logs are used in the analysis. Analysis includes detection of server impersonation, phishing domains, and forged certificates. TLS certificates are designed to expire to ensure that the cryptographic keys are forced to be changed on a regular basis. The certificates in the trust path also expire and can cause a break in the trust chain. This means that even if a server certificate is updated correctly, intermediate certificates can expire and the trust chain is not maintained. This can cause services to become unavailable.
kb-reference: Reference - Securing Web Transactions
subclass of: Restriction
  on property: analyzes
  some values from: Certificate File
subclass of: Network Traffic Analysis

Certificate File
type: Class
type: NamedIndividual
contains: Certificate
may-contain: File
may-contain: URL
comment: A file containing a digital certificate. In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document used to prove the ownership of a public key. The certificate includes information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
subclass of: Restriction
  on property: contains
  some values from: Certificate
subclass of: File

Cloud Configuration Information
type: Class
type: NamedIndividual
comment: Information used to configure the services, parameters, and initial settings for a virtual server instance running in a cloud service..
subclass of: Configuration Information

Configuration Information
type: Class
type: NamedIndividual
comment: Information used to configure a system including software and hardware.
subclass of: Resource

Database
type: Class
type: NamedIndividual
comment: A database is an organized collection of data, generally stored and accessed electronically from a computer system. Where databases are more complex they are often developed using formal design and modeling techniques.
subclass of: Digital Artifact

Database Query
type: Class
type: NamedIndividual
comment: A specific query expressed in SQL, SPARQL, or similar language against a database.
subclass of: Command

Decoy Object
type: Class
type: NamedIndividual
may-contain: Digital Artifact
comment: A decoy is an imitation digital artifact in any sense of a digital artifact, object, or phenomenon that is intended to deceive a cyber attacker's surveillance devices or mislead their evaluation. Examples include fake files, accounts, hosts (honeypots), and network segments (honeynets).
subclass of: Restriction
  on property: may-contain
  some values from: Digital Artifact
subclass of: Digital Artifact
alternative label: Decoy
alternative label: Decoy Artifact
alternative label: Lure
alternative label: Trap

Digital Event
type: Class
subclass of: D3FEND Thing

Endpoint Sensor
type: Class
subclass of: Sensor

File Transfer Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: File transfer network traffic is network traffic related to file transfers between network nodes..This includes only network traffic conforming to standard file transfer protocols, not custom transfer protocols.
subclass of: Network Traffic

Hardware Driver
type: Class
type: NamedIndividual
drives: Hardware Device
comment: In computing, a device driver (commonly referred to simply as a driver) is a computer program that operates or controls a particular type of device that is attached to a computer. A driver provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details of the hardware being used. A driver communicates with the device through the computer bus or communications subsystem to which the hardware connects. When a calling program invokes a routine in the driver, the driver issues commands to the device. Once the device sends data back to the driver, the driver may invoke routines in the original calling program. Drivers are hardware dependent and operating-system-specific. They usually provide the interrupt handling required for any necessary asynchronous time-dependent hardware interface.
subclass of: Restriction
  on property: drives
  some values from: Hardware Device
subclass of: Digital Artifact
alternative label: Device Driver

Inbound Session Volume Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Inbound Internet Network Traffic
d3fend-id: D3-ISVA
definition: Analyzing inbound network session or connection attempt volume.
enables: Detect
kb-article: ## How it works Network appliances are configured to alert on certain packets that typically are involved in DoS attacks. Typical packets include ICMP packets and SYN requests that are commonly used to flood networks. A sampling period is used to define a time window in which collected counts of the identified packets can be measured. If the collected number of packets exceeds a predefined limit then an alert is generated. ## Considerations Scalability as volume of attacks increase; single servers may not have the memory and storage resources to handle high volumes of network traffic.
kb-reference: Reference - Identifying a denial-of-service attack in a cloud-based proxy service - Cloudfare Inc.
kb-reference: Reference - Method and system for UDP flood attack detection - Riorey LLC
kb-reference: Reference - Protecting against distributed denial of service attacks - Cisco Technology Inc.
kb-reference: Reference - Protecting against distributed network flood attacks - Juniper Networks Inc.
kb-reference: Reference - DETECTING DDoS ATTACK USING Snort -
subclass of: Restriction
  on property: analyzes
  some values from: Inbound Internet Network Traffic
subclass of: Network Traffic Analysis

Interprocess Communication
type: Class
type: NamedIndividual
comment: In computer science, inter-process communication or inter-process communication (IPC) refers specifically to the mechanisms an operating system provides to allow processes it manages to share data. Typically, applications can use IPC categorized as clients and servers, where the client requests data and the server responds to client requests. Many applications are both clients and servers, as commonly seen in distributed computing. Methods for achieving IPC are divided into categories which vary based on software requirements, such as performance and modularity requirements, and system circumstances, such as network bandwidth and latency.
subclass of: Digital Artifact

Login Session
type: Class
type: NamedIndividual
comment: In computing, a login session is the period of activity between a user logging in and logging out of a (multi-user) system. On Unix and Unix-like operating systems, a login session takes one of two main forms: (a) When a textual user interface is used, a login session is represented as a kernel session — a collection of process groups with the logout action managed by a session leader, and (b) Where an X display manager is employed, a login session is considered to be the lifetime of a designated user process that the display manager invokes.
subclass of: Session

Peripheral Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: Firmware that is installed on computer peripheral devices.
subclass of: Firmware

Personal Computer
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: A personal computer (PC) is a multi-purpose computer whose size, capabilities, and price make it feasible for individual use. Personal computers are intended to be operated directly by an end user, rather than by a computer expert or technician. Unlike large, costly minicomputers and mainframes, time-sharing by many people at the same time is not used with personal computers. PCs have in practice become powerful enough that they may be shared by multiple users at any given time, though this is not common practice nor the primary purpose of a PC.
subclass of: Client Computer

Reference - Use DNS Policy for Applying Filters on DNS Queries
type: User Manual Reference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/apply-filters-on-dns-queries
kb-organization: Microsoft
kb-reference-title: Use DNS Policy for Applying Filters on DNS Queries

Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190081968A1/en
kb-abstract: A system and method for assessing the identity fraud risk of an entity's (a user's, computer process's, or device's) behavior within a computer network and then to take appropriate action. The system uses real-time machine learning for its assessment. It records the entity's log-in behavior (conditions at log-in) and behavior once logged in to create an entity profile that helps identify behavior patterns. The system compares new entity behavior with the entity profile to determine a risk score and a confidence level for the behavior. If the risk score and confidence level indicate a credible identity fraud risk at log-in, the system can require more factors of authentication before log-in succeeds. If the system detects risky behavior after log-in, it can take remedial action such as ending the entity's session, curtailing the entity's privileges, or notifying a human administrator.
kb-author: Yanlin Wang; Weizhi Li
kb-is-example-of: Authentication Event Thresholding
kb-is-example-of: Authorization Event Thresholding
kb-is-example-of: Resource Access Pattern Analysis
kb-is-example-of: Session Duration Analysis
kb-is-example-of: User Geolocation Logon Pattern Analysis
kb-mitre-analysis: This patent describes determining a confidence score to detect anomalies in user activity based on comparing a user’s behavior profile with current user activity events. The following types of events are used to develop a user entity profile: * logon and logoff times and locations * starting or ending applications * reading or writing files * changing an entity 's authorization * monitoring network traffic User events that deviate from the entity profile over a certain threshold trigger a remedial action.
kb-organization: Idaptive LLC
kb-reference-title: Method and Apparatus for Network Fraud Detection and Remediation Through Analytics

Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc
type: Patent Reference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190034641A1
kb-abstract: The present disclosure is directed to a system, method, and computer program for detecting and assessing security risks in an enterprise's computer network. A behavior model is built for a user in the network based on the user's interactions with the network, wherein a behavior model for a user indicates client device(s), server(s), and resources used by the user. The user's behavior during a period of time is compared to the user's behavior model. A risk assessment is calculated for the period of time based at least in part on the comparison between the user's behavior and the user's behavior model, wherein any one of certain anomalies between the user's behavior and the user's behavior model increase the risk assessment.
kb-author: Sylvain Gil; Domingo Mihovilovic; Nir Polak; Magnus Stensmo; Sing Yip
kb-is-example-of: Authentication Event Thresholding
kb-is-example-of: Authorization Event Thresholding
kb-is-example-of: Resource Access Pattern Analysis
kb-is-example-of: Session Duration Analysis
kb-is-example-of: User Geolocation Logon Pattern Analysis
kb-mitre-analysis: This patent describes calculating a risk score to detect anomalies in user activity based on comparing a user’s current session with a user behavior model. The user behavior model is comprised of a number of histograms including: * client devices from which the user logs in * servers accessed * data accessed * applications accessed * session duration * logon time of day * logon day of week * geo - location of logon origination The system has an initial training period with x number of days (e. g., 90 days) in which session data is recorded in behavior models before behavior analysis begins.The histograms are then used to determine anomalies between current session activity and a user's behavior model. Values for a histogram category are along one axis and the number of times the value is received for the category is along another axis. If a data point value associated with the current user session is over an anomaly threshold, an alert is generated.
kb-organization: Exabeam Inc
kb-reference-title: System, method, and computer program product for detecting and assessing security risks in a network

Resource Access Pattern Analysis
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Authentication
analyzes: Authorization
d3fend-id: D3-RAPA
definition: Analyzing the resources accessed by a user to identify unauthorized activity.
enables: Detect
kb-article: ## How it works This technique analyzes a user's resource accesses by comparing the user’s recent activity against a baseline activity model. Major differences between the current activity and the baseline model might indicate unauthorized activity if they are severe enough. ## Considerations * Potential for false positives from anomalies that are not associated with malicious activity. * Attackers that move low and slow may not differentiate their resource access activity behavior enough to trigger an alert.
kb-reference: Reference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd
kb-reference: Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC
kb-reference: Reference - Modeling user access to computer resources - Daedalus Group LLC (formerly IBM)
kb-reference: Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc
kb-reference: Reference - System and method thereof for identifying and responding to security incidents based on preemptive forensics - Palo Alto Networks Inc
subclass of: Restriction
  on property: analyzes
  some values from: Authorization
subclass of: Restriction
  on property: analyzes
  some values from: Authentication
subclass of: User Behavior Analysis

Symbolic Link
type: Class
type: NamedIndividual
addresses: File
may-contain: File
may-contain: URL
comment: A symbolic link (also symlink or soft link) is a term for any file that contains a reference to another file or directory in the form of an absolute or relative path and that affects pathname resolution.
subclass of: Restriction
  on property: addresses
  some values from: File
subclass of: File
subclass of: File System Link
alternative label: Soft Link
alternative label: Softlink
alternative label: Symlink

System File Analysis
type: Operating System Monitoring
type: Class
type: NamedIndividual
analyzes: Operating System File
d3fend-id: D3-SFA
definition: Monitoring system files such as authentication databases, registry keys, system logs, and system executables, for modification or tampering.
enables: Detect
kb-article: ## How it works This technique ensures the integrity of system owned file resources. System files can impact the behavior below the user level. ## Considerations * Need to manage the size of log file analysis. * False positives are a concern with this technique and filtering will need to be given additional thought. * A baseline or snapshot of file checksums should be established for future comparison.
kb-reference: Reference - CAR-2013-01-002: Autorun Differences -
kb-reference: Reference - CAR-2016-04-002: User Activity from Clearing Event Logs - MITRE
kb-reference: Reference - CAR-2019-07-001: Access Permission Modification - MITRE
subclass of: Restriction
  on property: analyzes
  some values from: Operating System File
subclass of: Operating System Monitoring

Boot or Logon Initialization Scripts
type: Class
type: NamedIndividual
attack-id: T1037
enables: Persistence
enables: Privilege Escalation
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Scheduled Task/Job Execution
type: Class
type: NamedIndividual
attack-id: T1053
creates: Process
enables: Execution
enables: Persistence
enables: Privilege Escalation
invokes: Create Process
modifies: Task Schedule
comment: The sub-techniques of this are specific software implementations of scheduling capabilities
subclass of: Restriction
  on property: invokes
  some values from: Create Process
subclass of: Restriction
  on property: creates
  some values from: Process
subclass of: Restriction
  on property: modifies
  some values from: Task Schedule
subclass of: Execution Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Access Token Manipulation
type: Class
type: NamedIndividual
attack-id: T1134
enables: Defense Evasion
enables: Privilege Escalation
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique

User
type: Class
type: NamedIndividual
has-account: User Account
comment: A user is a person [or agent] who uses a computer or network service. Users generally use a system or a software product without the technical expertise required to fully understand it. Power users use advanced features of programs, though they are not necessarily capable of computer programming and system administration. A user often has a user account and is identified to the system by a username (or user name). Other terms for username include login name, screenname (or screen name), nickname (or nick) and handle, which is derived from the identical Citizen's Band radio term. Some software products provide services to other systems and have no direct end users.
subclass of: Restriction
  on property: has-account
  some values from: User Account
subclass of: Digital Artifact

User Action
type: Class
type: NamedIndividual
comment: An action performed by a user. Executing commands, granting permissions, and accessing resources are examples of user actions.
subclass of: Digital Artifact
subclass of: Digital Event

User Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A user application is executed for that an individual user on a user's personal computer or remotely by means of virtualization. This is in contrast to service applications or enterprise software.
subclass of: Application

User Manual Reference
type: Class
pref-label: User Manual
subclass of: Technique Reference

d3fend-analysis-data-property
type: DatatypeProperty
comment: x d3fend-analysis-data-property y: The d3fend analysis x has the data property y.
domain: D3FEND Analysis Thing
sub property of: topDataProperty

loads
type: ObjectProperty
comment: x loads y: The technique or process x transfers a software from a storage y to a computer's memory for subsequent execution.
sub property of: associated-with

runs
type: ObjectProperty
comment: x runs y: To carry out a process or program y, as on a computer or a machine x; where y may be a large software assembly or a specific module or instruction. Examples: "run a new program on the Mac"; "the computer executed the instruction"
sub property of: associated-with
sub property of: may-run

Authentication Event Thresholding
type: User Behavior Analysis
type: Class
type: NamedIndividual
analyzes: Authentication
d3fend-id: D3-ANET
definition: Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile.
enables: Detect
kb-article: ## How it works Authentication event data is collected (logon information such as device id, time of day, day of week, geo-location, etc.) to create an activity baseline. Then, a threshold is determined either through a manually specified configuration, or a statistical analysis of deviations in historical data. New authentication events are evaluated to determine if a threshold is exceeded. Thresholds can be static or dynamic. ### Actions As a result of the analysis, actions taken could include: * **Credential Locking** * Raising an alert ### Example data sources * Directory server logs * VPN Server logs * IDAM Capability logs * NAC logs * Authentication client logs * Kerberos network traffic * LDAP network traffic ## Considerations This technique covers statistical outliers. Though depending on the complexity or dimensionality of the data considered, outliers may not be obvious to a human analyst reviewing events in simplistic analytic views. If the malicious activity is not statistically different from benign activity, an alert threshold will not be met.
kb-reference: Reference - CAR-2013-02-008: Simultaneous Logins on a Host - MITRE
kb-reference: Reference - CAR-2013-02-012: User Logged in to Multiple Hosts - MITRE
kb-reference: Reference - CAR-2013-10-001: User Login Activity Monitoring - MITRE
kb-reference: Reference - CAR-2016-04-005: Remote Desktop Logon - MITRE
kb-reference: Reference - Method and Apparatus for Network Fraud Detection and Remediation Through Analytics - Idaptive LLC
kb-reference: Reference - System, method, and computer program product for detecting and assessing security risks in a network - Exabeam Inc
subclass of: Restriction
  on property: analyzes
  some values from: Authentication
subclass of: User Behavior Analysis

Boot Loader
type: Class
type: NamedIndividual
subclass of: Digital Artifact
alternative label: Bootloader

D3FEND Analysis
type: Class
comment: A D3FEND analysis asserts which defensive techniques were determined to be implemented a product.
subclass of: Restriction
  on property: has-reviewer
  some values from: D3FEND Analyst
subclass of: Restriction
  on property: pref-label
  some values from: string
subclass of: Restriction
  on property: has-analyst
  some values from: D3FEND Analyst
subclass of: Restriction
  on property: is-complete
  some values from: boolean
subclass of: Restriction
  on property: has-date
  some values from: dateTime
subclass of: Restriction
  on property: has-technique-assertion
  some values from: Technique Assertion
subclass of: Restriction
  on property: has-product
  some values from: Product
subclass of: D3FEND Analysis Thing

Decoy Environment
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-DE
definition: A Decoy Environment comprises hosts and networks for the purposes of deceiving an attacker.
enables: Deceive
kb-article: ## Technique Overview Systems in a decoy environment are typically configured so that some detectable means of communication does not have any legitimate business purpose. Any communication via these means should be logged and analyzed to find potential indicators of compromise for a possible past or future attack against other systems.
manages: Decoy Object
subclass of: Restriction
  on property: manages
  some values from: Decoy Object
subclass of: Restriction
  on property: enables
  some values from: Deceive
subclass of: Defensive Technique

File System Link
type: Class
type: NamedIndividual
comment: A file system link associates a name with a file on a file system. Most generally, this may be a direct reference (a hard link) or an indirect one (a soft link).
subclass of: Digital Artifact

IPC Traffic Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Intranet IPC Network Traffic
d3fend-id: D3-IPCTA
definition: Analyzing standard inter process communication (IPC) protocols to detect deviations from normal protocol activity.
enables: Detect
kb-article: ## How it works Inter process communication enables applications or threads to share data. This can involve one or more computers. Monitoring IPC in your environment can reveal abnormal or malicious activity. IPC can occur within a single computer or between multiple computers remotely through network protocols. Thus there are multiple ways to collect and monitor these exchanges between processes. A network protocol analyzer may monitor and parse SMB network traffic to record system activity. A host based monitoring agent may monitor IPC activity contained within a single host to look for deviations from standard usages. ### Examples * SMB * Zeromq * Java RMI API ## Considerations * IPC can generate substantial amounts of data, and it may not be feasible to collect all of it. * IPC may occur over loopback interfaces or direct memory access granted by the operating system.
kb-reference: Reference - CAR-2013-01-003: SMB Events Monitoring -
kb-reference: Reference - CAR-2013-05-003: SMB Write Request -
kb-reference: Reference - CAR-2013-05-005: SMB Copy and Execution -
kb-reference: Reference - CAR-2013-09-003: SMB Session Setups - MITRE
kb-reference: Reference - CAR-2014-03-001: SMB Write Request - NamedPipes - MITRE
kb-reference: Reference - Security System with Methodology for Interprocess Communication Control - Check Point Software Tech Inc
synonym: IPC Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Intranet IPC Network Traffic
subclass of: Network Traffic Analysis

Image Code Segment
type: Class
type: NamedIndividual
contains: Subroutine
comment: An image code segment, also known as a text segment or simply as text, is a portion of an object file that contains executable instructions. The term "segment" comes from the memory segment, which is a historical approach to memory management that has been succeeded by paging. When a program is stored in an object file, the code segment is a part of this file; when the loader places a program into memory so that it may be executed, various memory regions are allocated (in particular, as pages), corresponding to both the segments in the object files and to segments only needed at run time. For example, the code segment of an object file is loaded into a corresponding code segment in memory.
see also: Process Code Segment
subclass of: Restriction
  on property: contains
  some values from: Subroutine
subclass of: Image Segment

Input Device
type: Class
type: NamedIndividual
comment: In computing, an input device is a piece of equipment used to provide data and control signals to an information processing system such as a computer or information appliance. Examples of input devices include keyboards, mouse, scanners, digital cameras, joysticks, and microphones. Input devices can be categorized based on:
subclass of: Hardware Device
subclass of: Local Resource

Intranet Network
type: Class
type: NamedIndividual
comment: An intranet is a private network accessible only to an organization's staff or delegates. Generally a wide range of information and services from the organization's internal IT systems are available that would not be available to the public from the Internet. A company-wide intranet can constitute an important focal point of internal communication and collaboration, and provide a single starting point to access internal and external resources. In its simplest form an intranet is established with the technologies for local area networks (LANs) and wide area networks (WANs).
subclass of: Network

Kernel Module
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A loadable kernel module (LKM) is an object file that contains code to extend the running kernel, or so-called base kernel, of an operating system. LKMs are typically used to add support for new hardware (as device drivers) and/or filesystems, or for adding system calls. When the functionality provided by a LKM is no longer required, it can be unloaded in order to free memory and other resources. Most current Unix-like systems and Microsoft Windows support loadable kernel modules, although they might use a different name for them, such as kernel loadable module (kld) in FreeBSD, kernel extension (kext) in macOS,[1] kernel extension module in AIX, kernel-mode driver in Windows NT[2] and downloadable kernel module (DKM) in VxWorks. They are also known as kernel loadable modules (or KLM), and simply as kernel modules (KMOD).
subclass of: Object File
alternative label: LKM
alternative label: Loadable Kernel Module

Local User Account
type: Class
type: NamedIndividual
comment: A user account on a given host is a local user account for that specific host.
subclass of: User Account

Message Hardening
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-MH
definition: Email or Messaging Hardening includes measures taken to ensure the confidentiality and integrity of user to user computer messages.
enables: Harden
synonym: Email Or Messaging Hardening
subclass of: Restriction
  on property: enables
  some values from: Harden
subclass of: Defensive Technique

Network File Share Resource
type: Class
type: NamedIndividual
comment: A shared file resource, or network file share, is a computer file made available from one host to other hosts on a computer network. Network sharing is made possible by inter-process communication over the network. It includes both files and directories.
subclass of: Network Resource

Network Packet
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: A network packet is a formatted unit of data carried by a packet-switched network. Computer communications links that do not support packets, such as traditional point-to-point telecommunications links, simply transmit data as a bit stream. When data is formatted into packets, packet switching is possible and the bandwidth of the communication medium can be better shared among users than with circuit switching.
subclass of: Network Traffic

Network Resource Access
type: Class
type: NamedIndividual
accesses: Network Resource
accesses: Resource
comment: Ephemeral digital artifact comprising a request of a network resource and any response from that network resource.
subclass of: Restriction
  on property: accesses
  some values from: Resource
subclass of: Restriction
  on property: accesses
  some values from: Network Resource
subclass of: Resource Access

Network Session
type: Class
type: NamedIndividual
contains: Network Packet
may-contain: Domain Name
originates-from: Physical Location
comment: A network session is a temporary and interactive information interchange between two or more devices communicating over a network. A session is established at a certain point in time, and then ‘torn down’ - brought to an end - at some later point. An established communication session may involve more than one message in each direction. A session is typically stateful, meaning that at least one of the communicating parties needs to hold current state information and save information about the session history in order to be able to communicate, as opposed to stateless communication, where the communication consists of independent requests with responses. Network sessions may be established and implemented as part of protocols and services at the application, session, or transport layers of the OSI model.
subclass of: Restriction
  on property: contains
  some values from: Network Packet
subclass of: Network Traffic

Outbound Internet Encrypted Web Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
may-contain: URL
originates-from: Physical Location
comment: Outbound internet encrypted web traffic is network traffic using a standard web protocol on an outgoing connection initiated from a host within a network to a host outside the network.
subclass of: Outbound Internet Encrypted Traffic
subclass of: Outbound Internet Web Traffic

Partition
type: Class
type: NamedIndividual
comment: A partition is a region on secondary storage device created so that the region can be managed by itself; separate from any other regions (partitions) on that secondary storage device. Creating partitions is typically the first step of preparing a newly installed storage device, before any file system is created. The device stores the information about the partitions' locations and sizes in an area known as the partition table that the operating system reads before any other part of the disk. Each partition then appears to the operating system as a distinct "logical" storage device that uses part of the actual device. System administrators use a program called a partition editor to create, resize, delete, and manipulate the partitions. Partitioning allows the use of different filesystems to be installed for different kinds of files. Separating user data from system data can prevent the system partition from becoming full and rendering the system unusable. Partitioning can also make backing up easier. [Definition adapted as generalization from definition of disk partitioning and distinct from in-memory partitions.]
subclass of: Digital Artifact
alternative label: Disk Partition
alternative label: Disk Slice

Partition Table
type: Class
type: NamedIndividual
addresses: Partition
comment: A partition is a fixed-size subset of a storage device which is treated as a unit by the operating system. A partition table is a table maintained on the storage device by the operating system describing the partitions on that device. The terms partition table and partition map are most commonly associated with the MBR partition table of a Master Boot Record (MBR) in IBM PC compatibles, but it may be used generically to refer to other "formats" that divide a disk drive into partitions, such as: GUID Partition Table (GPT), Apple partition map (APM), or BSD disklabel.
subclass of: Restriction
  on property: addresses
  some values from: Partition
subclass of: Digital Artifact

Process Code Segment Verification
type: Process Analysis
type: Class
type: NamedIndividual
d3fend-id: D3-PCSV
definition: Comparing the "text" or "code" memory segments to a source of truth.
enables: Detect
kb-article: ## How it works A process code segment is an executable portion of computer memory allocated to a particular process. Process Code Segment Verification implements verification to compare a process code segment to some expected value. ### Verification logic Verification can occur during application startup, or continuously during execution. The logic which verifies the process code may be separate in a third-party process, embedded in the application itself at compile time, or dynamically linked at runtime. ### System of record Examples of systems of record: * On-disk application binary files or checksums * Remotely stored binary data or checksums * Embedded binary data or checksums ### Post Verification Actions If the verification function determines a process code segment may have been altered, a capability may invoke Eviction techniques as **Process Termination** to end the current process, or **Executable Blacklisting** to prevent the executable from launching in the future. ## Considerations ### False positives False positives commonly occur in the case that the layout of code in the process segment is legitimately modified: * Operating system features or third-party security software may modify the layout of process code, for example in the defensive technique **Segment Address Offset Randomization**, or in the case that a module is rebased. In both of these cases, the alteration occurs before the code is fully loaded into memory, and it would be possible to avoid the false positive by securely feeding this constant offset and any relocation data into the verification logic. * Process code segments may be written to modify themselves or other process code segments; however, this goes against widely-accepted current practices in software development. ### False Negatives False negatives can occur via alteration of the verification logic or source of truth, or insufficient verification logic. * Verification techniques which are executed only locally may be defeate…
kb-reference: Reference - Anti-tamper system with self-adjusting guards - ARXAN TECHNOLOGIES Inc
kb-reference: Reference - Guards for application in software tamperproofing - Purdue Research Foundation
kb-reference: Reference - System and method for detecting malware injected into memory of a computing device - Endgame Inc
kb-reference: Reference - System and method for validating in-memory integrity of executable files to identify malicious activity - Endgame Inc
kb-reference: Reference - Tamper proof mutating software - ARXAN TECHNOLOGIES Inc
kb-reference: Reference - Threat detection through the accumulated detection of threat characteristics - Sophos Ltd
verifies: Process Code Segment
subclass of: Restriction
  on property: verifies
  some values from: Process Code Segment
subclass of: Process Analysis

RPC Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: RPC network traffic is network traffic related to remote procedure calls between network nodes..This includes only network traffic conforming to a standard RPC protocol; not custom protocols.
subclass of: Network Traffic

Reference
type: Class
subclass of: D3FEND Thing

Remote Session
type: Class
type: NamedIndividual
comment: A remote login session is a login session where a client has logged in from their local host machine to a server via a network.
subclass of: Login Session

Remote Services
type: Class
type: NamedIndividual
attack-id: T1021
enables: Lateral Movement
produces: Intranet Network Traffic
subclass of: Restriction
  on property: produces
  some values from: Intranet Network Traffic
subclass of: Lateral Movement Technique

Masquerading
type: Class
type: NamedIndividual
attack-id: T1036
enables: Defense Evasion
subclass of: Defense Evasion Technique

Indicator Removal on Host
type: Class
type: NamedIndividual
attack-id: T1070
enables: Defense Evasion
subclass of: Defense Evasion Technique

Office Application Startup
type: Class
type: NamedIndividual
attack-id: T1137
enables: Persistence
subclass of: Persistence Technique

Unsecured Credentials
type: Class
type: NamedIndividual
accesses: Credential
attack-id: T1552
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Credential
subclass of: Credential Access Technique

Hide Artifacts
type: Class
type: NamedIndividual
attack-id: T1564
enables: Defense Evasion
subclass of: Defense Evasion Technique

Technique
type: Class
comment: Made parallel to Digital Object as technique is neither offensive or defensive, but any technique can produce a DAO.
subclass of: Restriction
  on property: associated-with
  some values from: Digital Artifact
subclass of: D3FEND Thing

User Init Configuration File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A user initialization configuration file is a file containing the information necessary to configure that part of a user's environment which is common to all applications and actions. User configurations may be overridden by more specific configuration information (such as that found in a application configuration file.)
subclass of: Configuration File
subclass of: User Logon Init Resource
alternative label: User Configuration File

User Startup Script File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A user startup script file is a shortcut file that is executed when a user logs in and starts a session on the host. These indicate applications the user wants started at login. For Windows, these are typically found in the user's startup directory.
subclass of: Executable Script
subclass of: User Logon Init Resource

Volume
type: Class
type: NamedIndividual
comment: In the context of computer operating systems, a volume or logical drive is a single accessible storage area with a single file system, typically (though not necessarily) resident on a single partition of a hard disk. Although a volume might be different from a physical disk drive, it can still be accessed with an operating system's logical interface. However, a volume differs from a partition.
subclass of: Digital Artifact
alternative label: Drive Volume
alternative label: Logical Drive

Web Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Web network traffic is network traffic that uses a standard web protocol.
subclass of: Network Traffic

may-add
type: ObjectProperty
comment: x may-add y: They entity x may add the thing y; that is, 'x adds y' may be true.
sub property of: may-be-associated-with

verifies
type: ObjectProperty
comment: x verifies y: A technique x confirms the truth of a digital artifact y.
sub property of: associated-with

Domain User Account
type: Class
type: NamedIndividual
comment: A domain user account in Microsoft Windows (2000) defines that user's access to a logical group of network objects (computers, users, devices) that share the same Active Directory databases; that is, a user's access to a domain.
subclass of: User Account

Evict
type: Defensive Tactic
type: Class
type: NamedIndividual
definition: The eviction tactic is used to remove an adversary from a computer network.
display-order: 5
subclass of: Defensive Tactic

Execution Isolation
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-EI
definition: Execution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files.
enables: Isolate
subclass of: Restriction
  on property: enables
  some values from: Isolate
subclass of: Defensive Technique

Operating System Configuration Component
type: Class
type: NamedIndividual
comment: An component of the overall information necessary for the configuration of an operating system.
subclass of: Operating System Configuration
alternative label: Operating System Configuration Information
alternative label: System Configuration

Password Store
type: Class
type: NamedIndividual
comment: A user repository of account passwords, often accessed via a password manager.
subclass of: Password Database

Pointer
type: Class
type: NamedIndividual
comment: In computer science, a pointer is a programming language object, whose value refers to (or "points to") another value stored elsewhere in the computer memory using its memory address. A pointer references a location in memory, and obtaining the value stored at that location is known as dereferencing the pointer. As an analogy, a page number in a book's index could be considered a pointer to the corresponding page; dereferencing such a pointer would be done by flipping to the page with the given page number.
subclass of: Digital Artifact

RPC Traffic Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: RPC Network Traffic
d3fend-id: D3-RTA
definition: Monitoring the activity of remote procedure calls in communication traffic to establish standard protocol operations and potential attacker activities.
enables: Detect
kb-article: ## How it works A remote procedure call (RPC) enables one computer to execute a specific function on another computer, as if it were a local application process. There are numerous RPC specifications and implementations. RPC capabilities can be abused by attackers in order to achieve a variety of tactical objectives including execution, persistence, initial access, and more. RPC proxies may be used to collect and store RPC traffic. RPCs can occur over network sockets or named pipes. Analytics look for unauthorized behavior such as: * Processes being launched or scheduled remotely * System configurations being changed remotely * Unauthorized file read activity Example RPC Protocols: * DCE/RPC * CORBA * Open Network Computing Remote Procedure Call * D-Bus * XML-RPC * JSON-RPC * SOAP * Apache Thrift ## Considerations * RPC is widely used in enterprise environments, and significant data filtering may be required in large environments to enable analytic processing. * RPC traffic may occur over a pipe, or within a host over loopback interface, thus making network collection difficult.
kb-reference: Reference - CAR-2014-03-001: SMB Write Request - NamedPipes - MITRE
kb-reference: Reference - CAR-2014-03-005: Remotely Launched Executables via Services - MITRE
kb-reference: Reference - CAR-2014-12-001: Remotely Launched Executables via WMI - MITRE
kb-reference: Reference - CAR-2015-04-002: Remotely Scheduled Tasks via Schtasks - MITRE
kb-reference: Reference - CAR-2016-03-002: Create Remote Process via WMIC - MITRE
kb-reference: Reference - RPC call interception - Crowdstrike Inc
synonym: RPC Protocol Analysis
subclass of: Restriction
  on property: analyzes
  some values from: RPC Network Traffic
subclass of: Network Traffic Analysis

System Service Software
type: Class
type: NamedIndividual
contains: Executable File
contains: Operating System File
comment: Software services provided as part of the operating system, typically accessed through system calls.
subclass of: Restriction
  on property: contains
  some values from: Operating System File
subclass of: Software

User Init Script
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A script used to initialize and configure elements of the user's applications and user environment.
subclass of: Executable Script
subclass of: Init Script
subclass of: User Logon Init Resource

blocks
type: ObjectProperty
comment: x blocks y: The entity x blocks off the use of digital artifact y by reference to a block or allow list (or both.)
sub property of: filters

d3fend-annotation
type: AnnotationProperty
comment: x d3fend-annotation y: The d3fend object x has the annotation y.

Archive File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An archive file is a file that is composed of one or more computer files along with metadata. Archive files are used to collect multiple data files together into a single file for easier portability and storage, or simply to compress files to use less storage space. Archive files often store directory structures, error detection and correction information, arbitrary comments, and sometimes use built-in encryption.
subclass of: File

Authentication Log
type: Class
type: NamedIndividual
records: Authentication
comment: A log of authentication events.
subclass of: Restriction
  on property: records
  some values from: Authentication
subclass of: Log

Credential Hardening
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-CH
definition: Credential Hardening techniques modify system or network properties in order to protect system or network/domain credentials.
enables: Harden
subclass of: Restriction
  on property: enables
  some values from: Harden
subclass of: Defensive Technique

DNS Denylisting
type: Network Isolation
type: Class
type: NamedIndividual
blocks: DNS Network Traffic
d3fend-id: D3-DNSDL
definition: Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type.
enables: Isolate
kb-article: ## How it works Rules are implemented that filter DNS queries using criteria such as: - Client subnet - Type of network protocol used in query - Fully qualified domain name (FQDN) of record in the query - DNS Server IP address that received the DNS request - Type of DNS record being queried - Time of day the query is received - Size of the response For example, a DNS policy can be created for blocking DNS queries for FQDNs that have been identified as unauthorized. ## Considerations - Implementation considerations for DNS filtering policies to avoid over-blocking or under-blocking domains. - Continuous maintenance of unauthorized domain lists is needed to keep up to date with possible site content changes. - File sharing or content delivery networks may require other filtering techniques that are more fine-grained (URL blocking). - Access to malicious websites or other network resources directly by IP instead of by DNS record, or after alteration of local DNS hosts file, may not result in DNS network traffic.
kb-reference: Reference - Use DNS Policy for Applying Filters on DNS Queries
synonym: DNS Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: DNS Network Traffic
subclass of: Network Isolation

DNS Traffic Analysis
type: Network Traffic Analysis
type: Class
type: NamedIndividual
analyzes: Outbound Internet DNS Lookup Traffic
d3fend-id: D3-DNSTA
definition: Analysis of domain name metadata, including name and DNS records, to determine whether the domain is likely to resolve to an undesirable host.
enables: Detect
kb-article: ## How it works This technique can be accomplished in a number of ways. * One example analytic determines whether or not a domain name was generated with an algorithm. Domain generation algorithms (DGAs) are sometimes used to create a domain name automatically that will resolve to C2 infrastructure, without directly coding the domains in question into the malicious code. * Another method analyzes information about domains that have been visited, including whether a domain name is longer than a common length, if a dynamic DNS domain was visited, if a fast-flux domain was visited, and if a recently created domain was visited. These factors are used to develop a score and if that score is over a certain threshold, an alert is generated. * Collected malware samples can be executed in a virtual environment to identify network domains that are connected to during execution. The network domains are then generated into signatures to identity bad domains for other hosts. This technique does not check for content hosted at the domain. ## Considerations * DNS produces a large amount of traffic which can be resource-intensive to analyze in real time. * If a server is compromised, for example, as part of a watering hole attack, but the DNS information pointing to that server is not altered, this technique would not catch such an incident.
kb-reference: Reference - Heuristic botnet detection - Palo Alto Networks Inc
kb-reference: Reference - Method and system for detecting algorithm-generated domains - VECTRA NETWORKS Inc
kb-reference: Reference - Predicting Domain Generation Algorithms with Long Short-Term Memory Networks -
kb-reference: Reference - Sinkholing bad network domains by registering the bad network domains on the internet - Palo Alto Networks Inc
may-contain: DNS Lookup
synonym: Domain Name Analysis
subclass of: Restriction
  on property: may-contain
  some values from: DNS Lookup
subclass of: Restriction
  on property: analyzes
  some values from: Outbound Internet DNS Lookup Traffic
subclass of: Network Traffic Analysis

Directory
type: Class
type: NamedIndividual
may-contain: File
comment: In computing, a directory is a file system cataloging structure which contains references to other computer files, and possibly other directories. On many computers, directories are known as folders, or drawers to provide some relevancy to a workbench or the traditional office file cabinet.
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: Digital Artifact

Encrypted Credential
type: Class
type: NamedIndividual
authenticates: User Account
comment: A credential that is encrypted.
subclass of: Credential

Exfiltration Technique
type: Class
type: NamedIndividual
enables: Exfiltration
subclass of: Restriction
  on property: enables
  some values from: Exfiltration
subclass of: Offensive Technique

File Analysis
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-FA
definition: File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.
enables: Detect
kb-article: ## Technique Overview Some techniques use file signatures or file metadata to compare against historical collections of malware. Files may also be compared against a source of ground truth such as cryptographic signatures. Examining files for potential malware using pattern matching against file contents/file behavior. Binary code may be dissembled and analyzed for predictive malware behavior, such as API call signatures. Analysis might occur within a protected environment such as a sandbox or live system.
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

Identifier
type: Class
type: NamedIndividual
comment: An identifier is a name that identifies (that is, labels the identity of) either a unique object or a unique class of objects, where the "object" or class may be an idea, physical [countable] object (or class thereof), or physical [noncountable] substance (or class thereof). The abbreviation ID often refers to identity, identification (the process of identifying), or an identifier (that is, an instance of identification). An identifier may be a word, number, letter, symbol, or any combination of those.
subclass of: Digital Artifact
alternative label: ID

Internet Article Reference
type: Class
pref-label: Internet Article
subclass of: Technique Reference
alternative label: Internet Blog Reference

Network Node
type: Class
type: NamedIndividual
runs: Operating System
comment: In telecommunications networks, a node (Latin nodus, ‘knot’) is either a redistribution point or a communication endpoint. The definition of a node depends on the network and protocol layer referred to. A physical network node is an electronic device that is attached to a network, and is capable of creating, receiving, or transmitting information over a communications channel. A passive distribution point such as a distribution frame or patch panel is consequently not a node.
subclass of: Restriction
  on property: runs
  some values from: Operating System
subclass of: Digital Artifact

Operating System Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: An operating system process, or system process, is a process running to perform operating system functions.
subclass of: Process
alternative label: System Process

Reference Type
type: Class
subclass of: D3FEND Thing

Removable Media Device
type: Class
type: NamedIndividual
comment: A removable media device is a hardware device used for computer storage and that is designed to be inserted and removed from the system. It is distinct from other removable media in that all the hardware required to read the data are built into the device. So USB flash drives and external hard drives are removable media devices, whereas tapes and disks are not, as they require additional hardware to perform read/write operations.
subclass of: Hardware Device

OS Credential Dumping
type: Class
type: NamedIndividual
accesses: Credential
attack-id: T1003
enables: Credential Access
subclass of: Restriction
  on property: accesses
  some values from: Credential
subclass of: Credential Access Technique

Command and Scripting Interpreter Execution
type: Class
type: NamedIndividual
attack-id: T1059
enables: Execution
executes: Executable Script
subclass of: Restriction
  on property: executes
  some values from: Executable Script
subclass of: Execution Technique

Technique Assertion
type: Class
comment: A claim that a particular product implements a technique.
subclass of: Restriction
  on property: has-technique
  some values from: Defensive Technique
subclass of: Restriction
  on property: has-expected-latency
  some values from: Latency
subclass of: Restriction
  on property: has-support-level
  some values from: Support Level
subclass of: Restriction
  on property: has-product
  some values from: Product
subclass of: Restriction
  on property: has-citation
  some values from: Analysis Citation
subclass of: D3FEND Analysis Thing

authenticates
type: ObjectProperty
comment: x authenticates y: The subject x establishes the authenticity of some y. This relation indicates an authentication event has occurred.
sub property of: associated-with

spoofs
type: ObjectProperty
comment: x spoofs y: The technique x creates a fake instance of a digital artifact y; that is, y is a decoy, fake, or counterfeit.
sub property of: associated-with

Administrative Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Administrative network traffic is network traffic related to the remote administration or control of hosts or devices through a standard remote administrative protocol. Remote shells, terminals, RDP, and VNC are examples of these protocols, which are typically only used by administrators.
subclass of: Network Traffic

DNS Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: RPC network traffic is network traffic related to remote procedure calls between network nodes..This includes only network traffic conforming to a standard RPC protocol; not custom protocols.
subclass of: Network Traffic

Inbound Traffic Filtering
type: Network Isolation
type: Class
type: NamedIndividual
d3fend-id: D3-ITF
definition: Restricting network traffic originating from untrusted networks destined towards a private host or enclave.
enables: Isolate
filters: Network Traffic
kb-article: ## How it works Inbound Traffic, in this context, is network traffic originating from an untrusted network towards a private host or enclave. For example: * An untrusted network host connecting to a internal commercial portal, shopping.example.com * An external mail server connecting to an internal mail server, mail.example.com Filtering policies are developed by administrators to meet business requirements and limit connectivity. These policies are implemented on edge devices such as firewalls, routers, and intrusion prevention systems. Examples of filters: * Blocking incoming traffic from spoofed internally facing IP addresses * Blocking specific ports and services from establishing connections * Limiting specific IP ranges from connecting to the network * Dynamic inbound filtering (Hole punching, STUN, NAT-T) ## Considerations * Business requirements typically drive the development of filtering rulesets * Protocols using non-standard ports may circumvent filtering technology, which does not detect application protocol based on traffic content ## Implementations * OpenWRT (Embedded) * Netfilter (Linux) * Windows Firewall * pf(BSD)
kb-reference: Reference - Active firewall system and methodology - McAfee LLC
kb-reference: Reference - Automatically generating rules for connection security - Microsoft
kb-reference: Reference - FWTK - Firewall Toolkit -
kb-reference: Reference - Firewall for interent access - Secure Computing LLC
kb-reference: Reference - Firewall for processing a connectionless network packet - National Security Agency
kb-reference: Reference - Firewall for processing connection-oriented and connectionless datagrams over a connection-oriented network - National Security Agency
kb-reference: Reference - Firewalls that filter based upon protocol commands - Intel Corp
kb-reference: Reference - Method for controlling computer network security - Checkpoint Software Technologies Ltd
kb-reference: Reference - Network firewall with proxy - Secure Computing LLC
subclass of: Restriction
  on property: filters
  some values from: Network Traffic
subclass of: Network Isolation

Initial Access Technique
type: Class
type: NamedIndividual
enables: Initial Access
subclass of: Restriction
  on property: enables
  some values from: Initial Access
subclass of: Offensive Technique

Lateral Movement Technique
type: Class
type: NamedIndividual
enables: Lateral Movement
subclass of: Restriction
  on property: enables
  some values from: Lateral Movement
subclass of: Offensive Technique

adds
type: ObjectProperty
comment: x adds y: The subject x adds a data object y, such as a file, to some other digital artifact, such as a directory. Examples include an agent or technique adding a record to a database. or a domain entry to a DNS server.
sub property of: associated-with
sub property of: may-add

may-produce
type: ObjectProperty
comment: x may-produce y: They entity x may produce the thing y; that is, 'x produces y' may be true.
sub property of: may-be-associated-with

uses
type: ObjectProperty
comment: x uses y: An entity x puts into service a resource or implement y; makes y work or employ for a particular purpose or for its inherent or natural purpose.
sub property of: associated-with

Access Control Information
type: Class
type: NamedIndividual
comment: Information about what access permissions are granted to particular users for particular objects
subclass of: Digital Artifact
alternative label: Authorization Information

Boot Sector
type: Class
type: NamedIndividual
comment: A boot record [boot sector] is the sector of a persistent data storage device (e.g., hard disk, floppy disk, optical disc, etc.) which contains machine code to be loaded into random-access memory (RAM) and then executed by a computer system's built-in firmware (e.g., the BIOS, Das U-Boot, etc.).
subclass of: Boot Record

Create Process
type: Class
type: NamedIndividual
executes: Subroutine
comment: A process spawn refers to a function that loads and executes a new child process.The current process may wait for the child to terminate or may continue to execute asynchronously. Creating a new subprocess requires enough memory in which both the child process and the current program can execute. There is a family of spawn functions in DOS, inherited by Microsoft Windows. There is also a different family of spawn functions in an optional extension of the POSIX standards. Fork-exec is another technique combining two Unix system calls, which can effect a process spawn.
subclass of: System Call
alternative label: Process Spawn

Local Resource
type: Class
type: NamedIndividual
comment: In computing, a system resource, or simply resource, is any physical or virtual component of limited availability within a computer system. Every device connected to a computer system is a resource. Every internal system component is a resource. Virtual system resources include files (concretely file handles), network connections (concretely network sockets), and memory areas. Managing resources is referred to as resource management, and includes both preventing resource leaks (releasing a resource when a process has finished using it) and dealing with resource contention (when multiple processes wish to access a limited resource).
subclass of: Resource
alternative label: System Resource

Log
type: Class
type: NamedIndividual
comment: A record of events in the order of their occurrence.
subclass of: Digital Artifact
alternative label: Chronology

Operating System Configuration File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An operating system configuration file is a file used to configure the operating system.
comment: System configuration files configure system-wide software and services, as well as the operating system which supports scheduling and executing this software, as well as the configuration of peripherals.
see also: Configuration File
see also: Operating System
subclass of: Configuration File
subclass of: Operating System File
alternative label: System Configuration File

Signed Binary Proxy Execution
type: Class
type: NamedIndividual
attack-id: T1218
enables: Defense Evasion
enables: Execution
subclass of: Defense Evasion Technique
subclass of: Execution Technique

executes
type: ObjectProperty
comment: x executes y: The subject x takes the action of carrying out (executing) y, which is a single software module, function, or instruction.
sub property of: accesses
sub property of: runs

may-be-associated-with
type: ObjectProperty
comment: x may-be-associated-with y: The subject x and object y may be associated in some way.
sub property of: topObjectProperty

DNS Lookup
type: Class
type: NamedIndividual
comment: A Domain Name System (DNS) lookup is a record returned from a DNS resolver after querying a DNS name server. Typically considered an A or AAAA record, where a domain name is resolved to an IPv4 or IPv6 address, respectively.
subclass of: Digital Artifact
subclass of: Digital Event

Defensive Tactic
type: Class
comment: a plan for attaining a particular goal
subclass of: Restriction
  on property: enabled-by
  some values from: Defensive Technique
subclass of: Restriction
  on property: display-order
  some values from: integer
subclass of: D3FEND Thing

Platform Monitoring
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-PM
definition: Monitoring platform components such as operating systems software, hardware devices, or firmware.
enables: Detect
kb-article: Platform monitoring consists of the analysis and monitoring of system level devices and low-level components, including hardware devices, to detect unauthorized modifications or suspicious activity. Monitored platform components includes system files and embedded devices such as: * Kernel software modules * Boot process code and load logic * Operating system components and device files * System libraries and dynamically loaded files * Hardware device drivers * Embedded firmware devices
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

Product
type: Class
comment: A specific and deployable technology.
subclass of: Restriction
  on property: has-analysis
  some values from: D3FEND Analysis
subclass of: Restriction
  on property: has-form-factor
  some values from: Form Factor
subclass of: Restriction
  on property: developed-by
  some values from: Product Developer
subclass of: Restriction
  on property: has-version
  some values from: string
subclass of: Restriction
  on property: has-name
  some values from: string
subclass of: Restriction
  on property: has-ancestor
  some values from: Product
subclass of: Restriction
  on property: has-license
  some values from: License
subclass of: D3FEND Analysis Thing

Subroutine
type: Class
type: NamedIndividual
contains: Executable File
comment: In different programming languages, a subroutine may be called a procedure, a function, a routine, a method, or a subprogram. The generic term callable unit is sometimes used.
subclass of: Software

Process Injection
type: Class
type: NamedIndividual
attack-id: T1055
enables: Defense Evasion
enables: Privilege Escalation
subclass of: Defense Evasion Technique
subclass of: Privilege Escalation Technique

Boot or Logon Autostart Execution
type: Class
type: NamedIndividual
attack-id: T1547
enables: Persistence
enables: Privilege Escalation
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Hijack Execution Flow
type: Class
type: NamedIndividual
attack-id: T1574
enables: Defense Evasion
enables: Persistence
enables: Privilege Escalation
subclass of: Defense Evasion Technique
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Task Schedule
type: Class
type: NamedIndividual
comment: A task schedule is a specification of tasks to be executed at particular times or time intervals. The schedule is a plan that enacted by a task scheduling process.
subclass of: Digital Artifact

Academic Paper Reference
type: Class
pref-label: Academic Paper
subclass of: Technique Reference

Application Hardening
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-AH
definition: Application Hardening makes an executable application more resilient to a class of exploits which either introduce new code or execute unwanted existing code. These techniques may be applied at compile-time or on an application binary.
enables: Harden
kb-article: ## Technique Overview Exploits may, for example, rely on knowledge of addresses in a process's memory, they may alter memory contents, and they may cause a program to use instructions in a way that they were not intended. By, for example, including code that dynamically changes the memory address of data or code on each run, introducing logic to validating the memory contents before certain potentially dangerous flows are executed, or monitoring a program for unusual sequence of instructions, this makes it harder for an attacker to craft a working exploit.
synonym: Process Hardening
subclass of: Restriction
  on property: enables
  some values from: Harden
subclass of: Defensive Technique

D3FEND Analysis Thing
type: Class
comment: D3FEND analysis things are supplementary concepts that allow for specifying and documenting product instantiations of the capabilities defined D3FEND Framework.

Decoy Object
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-DO
definition: A Decoy Object is created and deployed for the purposes of deceiving attackers.
enables: Deceive
kb-article: ## Technique Overview Decoy objects are typically configured with detectable means of communication but do not have any legitimate business purpose. Any communication via or to these objects should be logged and analyzed to find potential indicators of compromise for a possible past or future attack against other systems.
subclass of: Restriction
  on property: enables
  some values from: Deceive
subclass of: Defensive Technique

Execution Technique
type: Class
type: NamedIndividual
enables: Execution
subclass of: Restriction
  on property: enables
  some values from: Execution
subclass of: Offensive Technique

Inbound Internet Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
produces: Network Traffic
comment: Inbound internet traffic is network traffic from a host outside a given network initiated on an incoming connection to a host inside that network.
subclass of: Restriction
  on property: produces
  some values from: Network Traffic
subclass of: Internet Network Traffic

Kerberos TIcket
type: Class
type: NamedIndividual
authenticates: User Account
comment: An access ticket/token issued by a Kerberos system.
subclass of: Access Token

Network Isolation
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-NI
definition: Network Isolation techniques prevent network hosts from accessing non-essential system network resources.
enables: Isolate
subclass of: Restriction
  on property: enables
  some values from: Isolate
subclass of: Defensive Technique

Process Image
type: Class
type: NamedIndividual
contains: Process Segment
comment: A process image is a copy of a given process's state at a given point in time. It is often used to create persistence within an otherwise volatile system.
subclass of: Restriction
  on property: contains
  some values from: Process Segment
subclass of: Digital Artifact

Property List File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: In the OS X, iOS, NeXTSTEP, and GNUstep programming frameworks, property list files are files that store serialized objects. Property list files use the filename extension .plist, and thus are often referred to as p-list files. Property list files are often used to store a user's settings. They are also used to store information about bundles and applications, a task served by the resource fork in the old Mac OS.
subclass of: Configuration File
alternative label: Plist File

Server
type: Class
type: NamedIndividual
contains: Application
contains: Operating System
runs: Operating System
comment: In computing, a server is a piece of computer hardware or software (computer program) that provides functionality for other programs or devices, called "clients". This architecture is called the client–server model. Servers can provide various functionalities, often called "services", such as sharing data or resources among multiple clients, or performing computation for a client. A single server can serve multiple clients, and a single client can use multiple servers. A client process may run on the same device or may connect over a network to a server on a different device. Typical servers are database servers, file servers, mail servers, print servers, web servers, game servers, and application servers.
subclass of: Host
subclass of: Network Resource

invokes
type: ObjectProperty
comment: x invokes y: The subject x invokes a system service y by use of an instruction object y that interrupts the program being executed and passes control to the operating system to perform that operation.
sub property of: executes
sub property of: may-invoke
alternative label: calls

D3FEND Thing
type: Class
release-date: 2021-07-09T00:00:00
comment: D3FEND things are concepts defined in the core D3FEND Framework.
version info: 0.9.3-BETA-1

Deceive
type: Defensive Tactic
type: Class
type: NamedIndividual
definition: The deceive tactic is used to advertise, entice, and allow potential attackers access to an observed or controlled environment.
display-order: 4
subclass of: Defensive Tactic

Hardware Device
type: Class
type: NamedIndividual
comment: Hardware devices are the physical artifacts that constitute a network or computer system. Hardware devices are the physical parts or components of a computer, such as the monitor, keyboard, computer data storage, hard disk drive (HDD), graphic cards, sound cards, memory (RAM), motherboard, and so on, all of which are tangible physical objects. By contrast, software is instructions that can be stored and run by hardware. Hardware is directed by the software to execute any command or instruction. A combination of hardware and software forms a usable computing system.
subclass of: Digital Artifact
subclass of: Physical Artifact

Impact Technique
type: Class
type: NamedIndividual
enables: Impact
subclass of: Restriction
  on property: enables
  some values from: Impact
subclass of: Offensive Technique

Platform Hardening
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-PH
definition: Hardening components of a d3f:Platform with the intention of making them more difficult to exploit. Platforms includes components such as: * BIOS UEFI Subsystems * Hardware security devices such as Trusted Platform Modules * Boot process logic or code * Kernel software components
enables: Harden
subclass of: Restriction
  on property: enables
  some values from: Harden
subclass of: Defensive Technique

Privilege Escalation Technique
type: Class
type: NamedIndividual
enables: Privilege Escalation
subclass of: Restriction
  on property: enables
  some values from: Privilege Escalation
subclass of: Offensive Technique

Process Lineage Analysis
type: Process Spawn Analysis
type: Class
type: NamedIndividual
analyzes: Process
analyzes: Process Tree
d3fend-id: D3-PLA
definition: Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution, duration, and order relative to siblings and ancestors.
enables: Detect
kb-article: ## How it works Process tree analysis techniques gather information on how a process was initiated to determine if a process is malicious. For example, if a process was not initiated from boot or not initiated by another process, that process is identified as suspicious. Also, if a new process was started before a process initiated by the device (ex. during boot) and that new process was not initiated by a user (which can be determined by examining process parameters such as type of process, its creator, source, etc.) the process is identified as suspicious. For example, Microsoft Word may block execution of any subprocess that is not in an approved path. ## Considerations * Attackers may spoof the parent PID (https://attack.mitre.org/techniques/T1502/), rendering such after-the-fact analysis on process lineage ineffective. * Processes may hide from various means of detection; an example on Linux is where a rootkit might remove key files for the process from its directory in /proc. * Zombie processes.
kb-reference: Reference - CAR-2013-04-002: Quick execution of a series of suspicious commands - MITRE
kb-reference: Reference - CAR-2013-05-002: Suspicious Run Locations -
kb-reference: Reference - CAR-2013-09-005: Service Outlier Executables -
kb-reference: Reference - CAR-2014-05-002: Services launching Cmd -
kb-reference: Reference - CAR-2014-11-002: Outlier Parents of Cmd - MITRE
kb-reference: Reference - CAR-2014-11-003: Debuggers for Accessibility Applications - MITRE
kb-reference: Reference - CAR-2014-11-008: Command Launched from WinLogon - MITRE
kb-reference: Reference - CAR-2014-12-001: Remotely Launched Executables via WMI - MITRE
kb-reference: Reference - CAR-2019-04-001: UAC Bypass - MITRE
kb-reference: Reference - CAR-2019-04-002: Generic Regsvr32 - MITRE
kb-reference: Reference - CAR-2019-08-001: Credential Dumping via Windows Task Manager - MITRE
kb-reference: Reference - System and methods thereof for causality identification and attributions determination of processes in a network - Palo Alto Networks IncCyber Secdo Ltd
kb-reference: Reference - System and methods thereof for identification of suspicious system processes - Palo Alto Networks Inc
synonym: Process Tree Analysis
subclass of: Restriction
  on property: analyzes
  some values from: Process
subclass of: Restriction
  on property: analyzes
  some values from: Process Tree
subclass of: Process Spawn Analysis

Specification Reference
type: Class
pref-label: Specification
subclass of: Technique Reference

Credential Access Technique
type: Class
type: NamedIndividual
enables: Credential Access
subclass of: Restriction
  on property: enables
  some values from: Credential Access
subclass of: Offensive Technique

Outbound Internet Encrypted Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet encrypted traffic is encrypted network traffic on an outgoing connection initiated from a host within a network to a host outside the network.
subclass of: Outbound Internet Network Traffic

Service Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An application that provides a set of software functionalities so that multiple clients who can reuse the functionality, provided they are authorized for use of the service.
subclass of: Application

monitors
type: ObjectProperty
comment: x monitors y: The technique or agent x keep tabs on; keeps an eye on; or keep the digital artifact y under surveillance.
sub property of: associated-with

Offensive Technique
type: Class
subclass of: Restriction
  on property: enables
  some values from: Offensive Tactic
subclass of: Restriction
  on property: display-order
  some values from: integer
subclass of: ATTACK Thing
subclass of: Technique

Event Triggered Execution
type: Class
type: NamedIndividual
attack-id: T1546
enables: Persistence
enables: Privilege Escalation
subclass of: Persistence Technique
subclass of: Privilege Escalation Technique

Technique Reference
type: Class
pref-label: Technique Reference
subclass of: Restriction
  on property: has-link
  some values from: anyURI
subclass of: Restriction
  on property: kb-reference-title
  some values from: string
subclass of: D3FEND Thing

may-access
type: ObjectProperty
comment: x may-access y: They entity x may access the thing y; that is, 'x accesses y' may be true.
sub property of: may-be-associated-with

Access Token
type: Class
type: NamedIndividual
authenticates: User Account
comment: In computer systems, an access token contains the security credentials for a login session and identifies the user, the user's groups, the user's privileges, and, in some cases, a particular application. Typically one may be asked to enter the access token (e.g. 40 random characters) rather than the usual password (it therefore should be kept secret just like a password).
subclass of: Credential
alternative label: Ticket
alternative label: Token

Collection Technique
type: Class
type: NamedIndividual
enables: Collection
subclass of: Restriction
  on property: enables
  some values from: Collection
subclass of: Offensive Technique

Command and Control Technique
type: Class
type: NamedIndividual
enables: Command And Control
subclass of: Restriction
  on property: enables
  some values from: Command And Control
subclass of: Offensive Technique

Document File
type: Class
type: NamedIndividual
may-contain: Executable Script
may-contain: File
may-contain: URL
comment: A document is a written, drawn, presented or recorded representation of thoughts. An electronic document file is usually used to describe a primarily textual file, along with its structure and design, such as fonts, colors and additional images.
subclass of: Restriction
  on property: may-contain
  some values from: Executable Script
subclass of: File

Exfiltration
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 11
subclass of: Offensive Tactic

File System Metadata
type: Class
type: NamedIndividual
comment: Metadata about the files and directories in a file system. For example file name, file length, time modified, group and user ids, and other file attributes.
subclass of: Metadata

Intranet Administrative Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Intranet administrative network traffic is administrative network traffic that does not cross a given network's boundaries and uses a standard administrative protocol.
subclass of: Administrative Network Traffic
subclass of: Intranet Network Traffic

Network Resource
type: Class
type: NamedIndividual
comment: In computing, a shared resource, or network share, is a computer resource made available from one host to other hosts on a computer network. It is a device or piece of information on a computer that can be remotely accessed from another computer, typically via a local area network or an enterprise intranet, transparently as if it were a resource in the local machine.Network sharing is made possible by inter-process communication over the network.
subclass of: Remote Resource
alternative label: Shared Resource

Operating System Monitoring
type: Platform Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-OSM
definition: The operating system software, for D3FEND’s purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.
enables: Detect
kb-article: ## Technique Overview "An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs." [1] Operating System Monitoring Techniques have varied implementations including built-in kernel modules, third-party privileged system daemons, or even standard systems administration tools included with an operating system. 1. http://dbpedia.org/page/Operating_system
kb-reference: Reference - CAR-2016-04-002: User Activity from Clearing Event Logs - MITRE
kb-reference: Reference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd
subclass of: Platform Monitoring

Outbound Internet Web Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
may-contain: URL
originates-from: Physical Location
comment: Outbound internet web traffic is network traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard web protocol.
subclass of: Restriction
  on property: may-contain
  some values from: URL
subclass of: Outbound Internet Network Traffic
subclass of: Web Network Traffic

Process Segment
type: Class
type: NamedIndividual
comment: Process segments are distinct partitions of the memory space of a running process. Heap, data, code, and stack segments are examples of process segments.
subclass of: Binary Segment

User Behavior Analysis
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-UBA
definition: Analysis of user behavior and patterns for the purpose of detecting unauthorized user activity.
enables: Detect
kb-article: ## Technique Overview Some techniques monitor patterns of human behavior and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns—anomalies that indicate potential threats, such as repeated login attempts from a single IP address or large file downloads. Other techniques may have explicit or rigid definitions of "bad behavior" which are then matched against instances in a computer network environment.
synonym: Credential Monitoring
synonym: UBA
comment: User behavior analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns—anomalies that indicate potential threats.' Instead of tracking devices or security events, UBA tracks a system's users. Big data platforms are increasing UBA functionality by allowing them to analyze petabytes worth of data to detect insider threats and advanced persistent threats.
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

d3fend-analysis-object-property
type: ObjectProperty
comment: x d3fend-analysis-object-property y: The object y is a d3fend analysis object property of object x. These properties are structured to provide a means for tools to capture the information discovered in a d3fend product or capability analysis and relate it to the d3fend model.
sub property of: topObjectProperty

Authorization
type: Class
type: NamedIndividual
authorizes: Network Resource Access
comment: Authorization is the function of specifying access rights to resources related to information security and computer security in general and to access control in particular. More formally, "to authorize" is to define an access policy. For example, human resources staff is normally authorized to access employee records and this policy is usually formalized as access control rules in a computer system. During operation, the system uses the access control rules to decide whether access requests from (authenticated) consumers shall be approved (granted) or disapproved (rejected). Resources include individual files or an item's data, computer programs, computer devices and functionality provided by computer applications. Examples of consumers are computer users, computer program
subclass of: Restriction
  on property: authorizes
  some values from: Network Resource Access
subclass of: Digital Artifact
subclass of: User Action

Firmware
type: Class
type: NamedIndividual
contains: Executable File
comment: In electronic systems and computing, firmware is a type of software that provides control, monitoring and data manipulation of engineered products and systems. Typical examples of devices containing firmware are embedded systems (such as traffic lights, consumer appliances, remote controls and digital watches), computers, computer peripherals, mobile phones, and digital cameras. The firmware contained in these devices provides the low-level control program for the device.
subclass of: Software

Process Spawn Analysis
type: Process Analysis
type: Class
type: NamedIndividual
analyzes: Process
d3fend-id: D3-PSA
definition: Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.
enables: Detect
kb-article: ## How it works Process attributes are established when an operating system spawns a new process. These attributes are analyzed to look for the presence or absence of specific values or patterns. Some attributes of interest are: - user - process name - image path - security content ## Considerations - Attackers can spoof the parent process identifier (PPID), which could bypass this defense to allow execution of a malicious process from an arbitrary parent process. - Attackers could have legitimately compromised any of the process properties, such as the user, to make the execution appear legitimate. - Location: If the full image path is not checked, there could be a conflict with an executable that appears earlier due to resolution involving the system environment path/classpath variable. - Parsing issues: If the raw command from a shell is analyzed, rather than the actual function call, it is important to identify the actual command being run from its arguments. In Windows, services with unquoted file paths containing spaces will try to use the first token as the executable and the rest as arguments -- and shift tokens to the executable until a valid one is found. - Some [operating systems](dao/artifact/d3f:OperatingSystem) can spawn processes without forking.
kb-reference: Reference - CAR-2013-02-003: Processes Spawning cmd.exe -
kb-reference: Reference - CAR-2013-03-001: Reg.exe called from Command Shell - MITRE
kb-reference: Reference - CAR-2013-05-005: SMB Copy and Execution -
kb-reference: Reference - CAR-2013-07-001: Suspicious Arguments -
kb-reference: Reference - CAR-2013-07-005: Command Line Usage of Archiving Software -
kb-reference: Reference - CAR-2014-03-006: RunDLL32.exe monitoring - MITRE
kb-reference: Reference - CAR-2014-04-003: Powershell Execution - MITRE
kb-reference: Reference - CAR-2014-07-001: Service Search Path Interception - MITRE
kb-reference: Reference - CAR-2014-11-003: Debuggers for Accessibility Applications -
kb-reference: Reference - CAR-2016-03-001: Host Discovery Commands - MITRE
kb-reference: Reference - CAR-2016-03-002: Create Remote Process via WMIC - MITRE
kb-reference: Reference - CAR-2019-04-003: Squiblydoo - MITRE
kb-reference: Reference - CAR-2019-04-004: Credential Dumping via Mimikatz - MITRE
kb-reference: Reference - CAR-2019-07-002: Lsass Process Dump via Procdump - MITRE
kb-reference: Reference - CAR-2019-08-002: Active Directory Dumping via NTDSUtil - MITRE
subclass of: Restriction
  on property: analyzes
  some values from: Process
subclass of: Process Analysis

may-create
type: ObjectProperty
comment: x may-create y: They entity x may create the entity y; that is, 'x creates y' may be true.
sub property of: may-be-associated-with

Internet Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Internet network traffic is network traffic that crosses a boundary between networks. [This is the general sense of inter-networking; It may or may not cross to or from the Internet]
subclass of: Network Traffic

Operating System File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An operating system file is a file that is part of, or used to store information about, the operating system itself.
subclass of: File

Persistence Technique
type: Class
type: NamedIndividual
enables: Persistence
subclass of: Restriction
  on property: enables
  some values from: Persistence
subclass of: Offensive Technique

Process Analysis
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-PA
definition: Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.
enables: Detect
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

Software
type: Class
type: NamedIndividual
contains: Executable File
comment: Computer software, or simply software, is that part of a computer system that consists of encoded information or computer instructions, in contrast to the physical hardware from which the system is built.
subclass of: Restriction
  on property: contains
  some values from: Executable File
subclass of: Digital Artifact

Stack Frame
type: Class
type: NamedIndividual
may-contain: Pointer
may-contain: Stack Frame Canary
comment: A machine-dependent and application-binary-dependent (ABI-dependent) data structure containing subroutine state information including the arguments passed into the routine, the return address back to the routine's caller, and space for local variables of the routine.
subclass of: Restriction
  on property: may-contain
  some values from: Pointer
subclass of: Restriction
  on property: may-contain
  some values from: Stack Frame Canary
subclass of: Stack Component
alternative label: Activation Frame
alternative label: Activation Record

Event Log
type: Class
type: NamedIndividual
comment: Event logs record events taking place in the execution of a system in order to provide an audit trail that can be used to understand the activity of the system and to diagnose problems. They are essential to understand the activities of complex systems, particularly in the case of applications with little user interaction (such as server applications).
subclass of: Log

System Configuration Database
type: Class
type: NamedIndividual
contains: System Configuration Database Record
comment: A database used to hold system configuration data.
subclass of: Restriction
  on property: contains
  some values from: System Configuration Database Record
subclass of: Database

Authentication Service
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: An authentication service is a mechanism, analogous to the use of passwords on time-sharing systems, for the secure authentication of the identity of network clients by servers and vice versa, without presuming the operating system integrity of either (e.g., Kerberos).
subclass of: Service Application

Email
type: Class
type: NamedIndividual
may-contain: Executable Script
may-contain: File
may-contain: URL
comment: An email, or email message, is a document that is sent between computer users across computer networks.
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: Restriction
  on property: may-contain
  some values from: URL
subclass of: Document File

Isolate
type: Defensive Tactic
type: Class
type: NamedIndividual
definition: The isolate tactic creates logical or physical barriers in a system which reduces opportunities for adversaries to create further accesses.
display-order: 2
subclass of: Defensive Tactic

Outbound Internet DNS Lookup Traffic
type: Class
type: NamedIndividual
may-contain: DNS Lookup
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet DNS lookup traffic is network traffic using the DNS protocol on an outgoing connection initiated from a host within a network to a host outside the network.
subclass of: Restriction
  on property: may-contain
  some values from: DNS Lookup
subclass of: DNS Network Traffic
subclass of: Outbound Internet Network Traffic

Initial Access
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 1
subclass of: Offensive Tactic

Process Code Segment
type: Class
type: NamedIndividual
contains: Subroutine
comment: A process code segment, also known as a text segment or simply as text, is a portion of the program's virtual address space that contains executable instructions and corresponds to the loaded image code segment. Includes additional sections such as an import table.
subclass of: Restriction
  on property: contains
  some values from: Subroutine
subclass of: Process Segment
alternative label: Process Text Segment

Discovery Technique
type: Class
type: NamedIndividual
enables: Discovery
subclass of: Restriction
  on property: enables
  some values from: Discovery
subclass of: Offensive Technique

Lateral Movement
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 8
subclass of: Offensive Tactic

System Call
type: Class
type: NamedIndividual
executes: Subroutine
synonym: API Monitoring
comment: A system call is the programmatic way in which a computer program requests a service from the kernel of the operating system it is executed on. This may include hardware-related services (for example, accessing a hard disk drive), creation and execution of new processes, and communication with integral kernel services such as process scheduling. System calls provide an essential interface between a process and the operating system.
subclass of: Restriction
  on property: executes
  some values from: Subroutine
subclass of: Digital Artifact
subclass of: Digital Event

Impact
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 12
subclass of: Offensive Tactic

Offensive Tactic
type: Class
comment: Per ATT&CK, these are defined as Tactical Goals, not Tactics per se. Many children also fit definition of tactics. Some are neither tactics or tactical goals really (e.g., Execution, which is a useful grouping, but an action, not really a tactic or technique.
subclass of: Restriction
  on property: display-order
  some values from: integer
subclass of: Restriction
  on property: enabled-by
  some values from: Offensive Technique
subclass of: ATTACK Thing

Discovery
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 7
subclass of: Offensive Tactic

Intranet Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Intranet network traffic is network traffic traversing that does not traverse a given network's boundaries.
subclass of: Network Traffic

may-contain
type: ObjectProperty
type: TransitiveProperty
comment: to potentially have as contents or constituent parts; comprise; include.
sub property of: may-be-associated-with

Harden
type: Defensive Tactic
type: Class
type: NamedIndividual
definition: The harden tactic is used to increase the opportunity cost of computer network exploitation. Hardening differs from Detection in that it generally is conducted before a system is online and operational.
display-order: 0
subclass of: Defensive Tactic

Credential
type: Class
type: NamedIndividual
authenticates: User Account
comment: A credential is a physical/tangible object, a piece of knowledge, or a facet of a person's physical being that enables an individual access to a given physical facility or computer-based information system. Typically, credentials can be something a person knows (such as a number or PIN), something they have (such as an access badge), something they are (such as a biometric feature), something they do (measurable behavioral patterns) or some combination of these items. This is known as multi-factor authentication. The typical credential is an access card or key-fob, and newer software can also turn users' smartphones into access devices.
subclass of: Restriction
  on property: authenticates
  some values from: User Account
subclass of: Digital Artifact

Executable Binary
type: Class
type: NamedIndividual
contains: Image Code Segment
contains: Image Data Segment
may-contain: File
may-contain: URL
may-interpret: Executable Script
comment: An executable binary contains machine code instructions for a physical CPU. D3FEND also considers byte code for a virtual machine to be binary code. This is in contrast to executable scripts written in a scripting language.
subclass of: Restriction
  on property: contains
  some values from: Image Code Segment
subclass of: Restriction
  on property: may-interpret
  some values from: Executable Script
subclass of: Restriction
  on property: contains
  some values from: Image Data Segment
subclass of: Executable File

Authentication
type: Class
type: NamedIndividual
authenticates: User
may-create: Intranet Network Traffic
originates-from: Physical Location
comment: A request-response comprising a user credential presentation to a system and a verification response.
subclass of: Restriction
  on property: originates-from
  some values from: Physical Location
subclass of: Restriction
  on property: may-create
  some values from: Intranet Network Traffic
subclass of: Restriction
  on property: authenticates
  some values from: User
subclass of: Digital Artifact
subclass of: User Action

Shared Library File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: A shared library file is a file that is intended to be shared by executable files and further shared library (object) files. Modules used by a program are loaded from individual shared objects into memory at load time or runtime, rather than being copied by a linker when it creates a single monolithic executable file for the program
subclass of: Object File
alternative label: Shared Library
alternative label: Shared Object

Network Traffic Analysis
type: Defensive Technique
type: Class
type: NamedIndividual
d3fend-id: D3-NTA
definition: Analyzing intercepted or summarized computer network traffic to detect unauthorized activity.
enables: Detect
subclass of: Restriction
  on property: enables
  some values from: Detect
subclass of: Defensive Technique

Collection
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 9
subclass of: Offensive Tactic

Defense Evasion Technique
type: Class
type: NamedIndividual
enables: Defense Evasion
subclass of: Restriction
  on property: enables
  some values from: Defense Evasion
subclass of: Offensive Technique

Defensive Technique
type: Class
subclass of: Restriction
  on property: d3fend-id
  some values from: string
subclass of: Restriction
  on property: display-order
  some values from: integer
subclass of: Restriction
  on property: kb-reference
  some values from: Technique Reference
subclass of: Restriction
  on property: enables
  some values from: Defensive Tactic
subclass of: D3FEND Thing
subclass of: Technique

Executable Script
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: An executable script is written in a scripting language and interpreted at run time. This is in contrast with an executable binary, which contains machine code instructions for a physical CPU or byte code for a virtual machine.
subclass of: Executable File

Command And Control
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 10
subclass of: Offensive Tactic

Physical Location
type: Class
type: NamedIndividual
comment: The terms location [here, a physical location] and place in geography are used to identify a point or an area on the Earth's surface or elsewhere. The term location generally implies a higher degree of certainty than place, which often indicates an entity with an ambiguous boundary, relying more on human or social attributes of place identity and sense of place than on geometry. The distinction between space and place is considered a central concern of geography, and has been addressed by scholars such as Yi-Fu Tuan and John Agnew.
subclass of: Digital Artifact

System Configuration Database Record
type: Class
type: NamedIndividual
comment: A database record holding information used to configure the services, parameters, and initial settings for an operating system.
subclass of: Operating System Configuration Component
subclass of: Record

creates
type: ObjectProperty
comment: x creates y: The subject x bring into existence an object y. Some technique or agent x creates a persistent digital artifact y (as opposed to production of a consumable or transient object.); i.e., bring forth or generate
sub property of: associated-with
sub property of: may-create

enables
type: ObjectProperty
comment: x enables y: A top level technique x enables a tactic y, that is, the property indicates that a technique x is used to put a particular tactic y into action. In other words, x renders y capable or able for some task.
sub property of: associated-with

Domain Name
type: Class
type: NamedIndividual
comment: A domain name is an identification string that defines a realm of administrative autonomy, authority or control within the Internet. Domain names are formed by the rules and procedures of the Domain Name System (DNS). Any name registered in the DNS is a domain name.Domain names are used in various networking contexts and application-specific naming and addressing purposes. In general, a domain name represents an Internet Protocol (IP) resource, such as a personal computer used to access the Internet, a server computer hosting a web site, or the web site itself or any other service communicated via the Internet. In 2015, 294 million domain names had been registered.
subclass of: Digital Artifact
subclass of: Identifier

Execution
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 2
subclass of: Offensive Tactic

associated-with
type: ObjectProperty
comment: x associated-with y: The subject x and object y are associated in some way. This is the most general definite relationship in d3fend (i.e., most general relationship that is not prefixed by 'may-'.)
sub property of: may-be-associated-with

Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Network traffic or data traffic is the data, or alternatively the amount of data, moving across a network at a given point of time. Network data in computer networks is mostly encapsulated in network packets, which provide the load in the network.
subclass of: Restriction
  on property: originates-from
  some values from: Physical Location
subclass of: Restriction
  on property: may-contain
  some values from: Domain Name
subclass of: Digital Artifact
alternative label: Data Traffic

Outbound Internet Network Traffic
type: Class
type: NamedIndividual
may-contain: Domain Name
originates-from: Physical Location
comment: Outbound internet network traffic is network traffic on an outgoing connection initiated from a host within a network to a host outside the network.
subclass of: Internet Network Traffic

contains
type: ObjectProperty
type: TransitiveProperty
comment: x contains y: A core relation that holds between a whole x and its part y. Equivalent to relational concept 'has part' and thus transitive.
sub property of: associated-with
sub property of: may-contain

Application
type: Class
type: NamedIndividual
contains: Executable File
may-contain: Application Configuration
uses: Resource
comment: A program that gives a computer instructions that provide the user with tools to accomplish a task; "he has tried several different word processing applications". Distinct from system software that is intrinsically part of the operating system. An application can be made up of executable files, configuration files, shared libraries, etc.
subclass of: Restriction
  on property: uses
  some values from: Resource
subclass of: Restriction
  on property: may-contain
  some values from: Application Configuration
subclass of: Software

Credential Access
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 6
subclass of: Offensive Tactic

Application Configuration
type: Class
type: NamedIndividual
comment: Information used to configure the parameters and initial settings for an application.
subclass of: Configuration Information

External Knowledge Base
type: Class
pref-label: External Knowledge Base
subclass of: Technique Reference

accesses
type: ObjectProperty
comment: x accesses y: An subject x takes the action of reading from, writing into, or executing the stored information in the object y. Reads, writes, and executes are specific cases of accesses.
range: Network Resource
sub property of: associated-with
sub property of: may-access

analyzes
type: ObjectProperty
comment: x analyzes y: The subject x break down object y into components or essential features, assessing y by quantitative methods, qualitative methods, or both. Usually the analysis is done in terms of some model or framework.
sub property of: associated-with

Process
type: Class
type: NamedIndividual
contains: Process Image
process-image-path: Executable Binary
process-user: User Account
comment: A process is an instance of a computer program that is being executed. It contains the program code and its current activity. Depending on the operating system (OS), a process may be made up of multiple threads of execution that execute instructions concurrently. A computer program is a passive collection of instructions, while a process is the actual execution of those instructions. Several processes may be associated with the same program; for example, opening up several instances of the same program often means more than one process is being executed.
subclass of: Restriction
  on property: process-image-path
  some values from: Executable Binary
subclass of: Restriction
  on property: process-environmental-variables
  some values from: string
subclass of: Restriction
  on property: contains
  some values from: Process Image
subclass of: Restriction
  on property: process-user
  some values from: User Account
subclass of: Restriction
  on property: process-identifier
  some values from: integer
subclass of: Restriction
  on property: process-security-context
  some values from: string
subclass of: Restriction
  on property: process-command-line-arguments
  some values from: string
subclass of: Digital Artifact

User Account
type: Class
type: NamedIndividual
comment: A user account allows a user to authenticate to a system and potentially to receive authorization to access resources provided by or connected to that system; however, authentication does not imply authorization. To log into an account, a user is typically required to authenticate oneself with a password or other credentials for the purposes of accounting, security, logging, and resource management.
subclass of: Digital Artifact

may-modify
type: ObjectProperty
comment: x may-modify y: They entity x may modify the thing y; that is, 'x modifies y' may be true.
sub property of: may-be-associated-with

Resource
type: Class
type: NamedIndividual
comment: In computing, a system resource, or simply resource, is any physical or virtual component of limited availability within a computer system. Every device connected to a computer system is a resource. Every internal system component is a resource. Virtual system resources include files (concretely file handles), network connections (concretely network sockets), and memory areas. Managing resources is referred to as resource management, and includes both preventing resource leaks (releasing a resource when a process has finished using it) and dealing with resource contention (when multiple processes wish to access a limited resource).
subclass of: Digital Artifact

URL
type: Class
type: NamedIndividual
addresses: Resource
comment: A Uniform Resource Locator (URL), commonly informally termed a web address (a term which is not defined identically) is a reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it.A URL is a specific type of Uniform Resource Identifier (URI), although many people use the two terms interchangeably. A URL implies the means to access an indicated resource, which is not true of every URI. URLs occur most commonly to reference web pages (http), but are also used for file transfer (ftp), email (mailto), database access (JDBC), and many other applications.
subclass of: Restriction
  on property: addresses
  some values from: Resource
subclass of: Digital Artifact
subclass of: Identifier
alternative label: Uniform Resource Locator

Detect
type: Defensive Tactic
type: Class
type: NamedIndividual
definition: The detect tactic is used to identify adversary access to or unauthorized activity on computer networks.
display-order: 1
subclass of: Defensive Tactic

produces
type: ObjectProperty
comment: x produces y: The subject entity x or process produces a data object y, which may be discrete digital object or a stream (e.g., a stream such as network traffic.)
domain: Technique
range: Digital Artifact
sub property of: associated-with
sub property of: may-produce
alternative label: outputs

Digital Artifact
type: Class
type: NamedIndividual
comment: An information-bearing artifact that is, or is encoded to be used with, a digital computer system.
subclass of: Artifact
subclass of: Digital Object

Executable File
type: Class
type: NamedIndividual
may-contain: File
may-contain: URL
comment: In computing, executable code or an executable file or executable program, sometimes simply an executable, causes a computer "to perform indicated tasks according to encoded instructions," as opposed to a data file that must be parsed by a program to be meaningful. These instructions are traditionally machine code instructions for a physical CPU. However, in a more general sense, a file containing instructions (such as bytecode) for a software interpreter may also be considered executable; even a scripting language source file may therefore be considered executable in this sense. The exact interpretation depends upon the use; while the term often refers only to machine code files, in the context of protection against computer viruses all files which cause potentially hazardous instruction
subclass of: File
alternative label: Executable

Operating System
type: Class
type: NamedIndividual
contains: Kernel
contains: System Service Software
may-contain: Operating System Configuration Component
comment: An operating system (OS) is system software that manages computer hardware and software resources and provides common services for computer programs. All computer programs, excluding firmware, require an operating system to function. Time-sharing operating systems schedule tasks for efficient use of the system and may also include accounting software for cost allocation of processor time, mass storage, printing, and other resources.
subclass of: Restriction
  on property: contains
  some values from: Kernel
subclass of: Restriction
  on property: may-contain
  some values from: Operating System Configuration Component
subclass of: Restriction
  on property: contains
  some values from: System Service Software
subclass of: Digital Artifact

Privilege Escalation
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 4
subclass of: Offensive Tactic

Persistence
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 3
subclass of: Offensive Tactic

modifies
type: ObjectProperty
comment: x modifies y: A technique or agent x causes a digital object y to change; become different; or undertake a transformation. Afterwards, the data or state held by a digital object is changed.
sub property of: associated-with
sub property of: may-modify
alternative label: alters

Patent Reference
type: Class
pref-label: Patent
subclass of: Technique Reference

File
type: Class
type: NamedIndividual
may-contain: URL
comment: A file maintained in computer-readable form.
subclass of: Restriction
  on property: may-contain
  some values from: File
subclass of: Restriction
  on property: may-contain
  some values from: URL
subclass of: Digital Artifact
subclass of: Resource

Defense Evasion
type: Offensive Tactic
type: Class
type: NamedIndividual
display-order: 5
subclass of: Offensive Tactic