Process Suspension
Definition
Suspending a running process on a computer system.
How it works
A running process might be suspended to mitigate its immediate effects if it is exhibiting anomalous, unauthorized, or malicious behavior. Defenders may choose to suspend rather than terminate to analyze the process first and resume the process if deemed benign.
System-provided functions
Windows tools
In Windows, the PsSuspend command line utility from the SysInternals Suite provides functionality to suspend processes on a local or remote system.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Related ATT&CK Techniques:
These offensive techniques are determined related because of the way this defensive technique,, .
References
The following references were used to develop the Process Suspension knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)