Esc
Process Eviction
Definition
Process eviction techniques terminate or remove running process.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 6 techniques in this category, Process Eviction.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Process Eviction | D3-PE | Process eviction techniques terminate or remove running process. | |
| - Process Termination | D3-PT | Terminating a running application process on a computer system. | |
| - Session Termination | D3-ST | Forcefully end all active sessions associated with compromised accounts or devices. | |
| - Process Suspension | D3-PS | Suspending a running process on a computer system. | |
| - Host Reboot | D3-HR | Initiating a host's reboot sequence to terminate all running processes. | |
| - Host Shutdown | D3-HS | Initiating a host's shutdown sequence to terminate all running processes. |
Related Offensive Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Credential Access
OS Credential Dumping
Exploitation for Credential Access
Modify Authentication Process
Multi-Factor Authentication Request Generation
Lateral Movement
Use Alternate Authentication Material
Remote Services
Remote Service Session Hijacking
Persistence
Modify Authentication Process
Server Software Component
Scheduled Task/Job
Event Triggered Execution
External Remote Services
Defense Impairment
Modify Authentication Process
Privilege Escalation
Scheduled Task/Job
Event Triggered Execution
Access Token Manipulation
Initial Access
Trusted Relationship
External Remote Services
Discovery
System Owner/User Discovery
References
All
Patent
The following references were used to develop the Process Eviction knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Malware detection using local computational models
Reference Type: Patent Organization: Crowdstrike Inc Author: Sven Krasser,David Elkind, Patrick Crenshaw, Kirby James Koster