Esc
Execution Isolation
Definition
Execution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 6 techniques in this category, Execution Isolation.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Execution Isolation | D3-EI | Execution Isolation techniques prevent application processes from accessing non-essential system resources, such as memory, devices, or files. | |
| - Kernel-based Process Isolation | D3-KBPI | Using kernel-level capabilities to isolate processes. | |
| - Executable Allowlisting | D3-EAL | Using a digital signature to authenticate a file before opening. | File Signature Authentication |
| - Executable Denylisting | D3-EDL | Blocking the execution of files on a host in accordance with defined application policy rules. | Executable Blacklisting |
| - Hardware-based Process Isolation | D3-HBPI | Preventing one process from writing to the memory space of another process through hardware based address manager implementations. | Virtualization |
| - Application-based Process Isolation | D3-ABPI | Application code which prevents its own subroutines from accessing intra-process / internal memory space. | Sandbox , Remote Browser Isolation , and Browser-based Process Isolation |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Use Alternate Authentication Material
Privilege Escalation
Abuse Elevation Control Mechanism
Access Token Manipulation
Event Triggered Execution
Process Injection
Scheduled Task/Job
Hijack Execution Flow
Boot or Logon Autostart Execution
Boot or Logon Initialization Scripts
Discovery
System Network Configuration Discovery
Application Window Discovery
System Service Discovery
System Information Discovery
Remote System Discovery
System Owner/User Discovery
System Time Discovery
Process Discovery
Persistence
Office Application Startup
Event Triggered Execution
Server Software Component
Scheduled Task/Job
Hijack Execution Flow
Boot or Logon Autostart Execution
Modify Authentication Process
Boot or Logon Initialization Scripts
Execution
User Execution
Command and Scripting Interpreter
Windows Management Instrumentation
Scheduled Task/Job
Credential Access
Exploitation for Credential Access
OS Credential Dumping
Multi-Factor Authentication Request Generation
Modify Authentication Process
Defense Evasion
Abuse Elevation Control Mechanism
System Binary Proxy Execution
Access Token Manipulation
Obfuscated Files or Information
Use Alternate Authentication Material
Deobfuscate/Decode Files or Information
Process Injection
Impair Defenses
Hijack Execution Flow
Masquerading
Modify Authentication Process
XSL Script Processing