Esc
Restore Object
Definition
Restoring an object for an entity to access. This is the broadest class for object restoral.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 7 techniques in this category, Restore Object.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Restore Object | D3-RO | Restoring an object for an entity to access. This is the broadest class for object restoral. | |
| - Restore Software | D3-RS | Restoring software to a host. | |
| - Restore Configuration | D3-RC | Restoring an software configuration. | |
| - Restore Database | D3-RD | Restoring the data in a database. | |
| - Restore Email | D3-RE | Restoring an email for an entity to access. | |
| - Restore Disk Image | D3-RDI | Restoring a previously captured disk image a hard drive. | |
| - Restore File | D3-RF | Restoring a file for an entity to access. |
Related Offensive Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Persistence
Event Triggered Execution
Office Application Startup
Boot or Logon Autostart Execution
Modify Authentication Process
Boot or Logon Initialization Scripts
Modify Registry
Create or Modify System Process
Scheduled Task/Job
Server Software Component
Compromise Host Software Binary
Pre-OS Boot
Software Extensions
Privilege Escalation
Event Triggered Execution
Boot or Logon Autostart Execution
Process Injection
Abuse Elevation Control Mechanism
Boot or Logon Initialization Scripts
Create or Modify System Process
Scheduled Task/Job
Access Token Manipulation
Domain or Tenant Policy Modification
Collection
Data from Local System
Email Collection
Archive Collected Data
Automated Collection
Data Staged
Data from Information Repositories
Input Capture
Command and Control
Encrypted Channel
Application Layer Protocol
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Credential Access
Steal or Forge Authentication Certificates
Modify Authentication Process
Unsecured Credentials
OS Credential Dumping
Credentials from Password Stores
Forced Authentication
Input Capture
Exploitation for Credential Access
Stealth
Hide Artifacts
Trusted Developer Utilities Proxy Execution
Process Injection
Masquerading
Impair Defenses
System Binary Proxy Execution
Hijack Execution Flow
Obfuscated Files or Information
Deobfuscate/Decode Files or Information
XSL Script Processing
Indicator Removal
Rootkit
Pre-OS Boot
Virtualization/Sandbox Evasion
Access Token Manipulation
Execution
Trusted Developer Utilities Proxy Execution
Hijack Execution Flow
Command and Scripting Interpreter
User Execution
Software Deployment Tools
Scheduled Task/Job
Initial Access
Phishing
Supply Chain Compromise
Lateral Movement
Internal Spearphishing
Software Deployment Tools
Impact
Inhibit System Recovery
Data Manipulation
Data Encrypted for Impact
Service Stop
Discovery
Software Discovery
System Location Discovery
System Network Configuration Discovery
File and Directory Discovery
System Owner/User Discovery
Query Registry
Remote System Discovery
Virtualization/Sandbox Evasion
Cloud Service Dashboard
Cloud Service Discovery
Group Policy Discovery
Defense Impairment
Modify Authentication Process
Subvert Trust Controls
Modify Registry
Rogue Domain Controller
File and Directory Permissions Modification
Modify Cloud Compute Infrastructure
Modify Cloud Resource Hierarchy
Domain or Tenant Policy Modification