Umbra Wiki defense defense/D3-SFA
Back to wiki

D3-SFA — System File Analysis

provenance: imported · ATT&CK: T1003 T1003.007 T1018 T1036 T1036.003 T1055 T1055.009 T1070 T1543 T1543.002 T1548 T1548.003 T1556 T1556.003 T1574 T1574.006

D3-SFA: System File Analysis

MITRE D3FEND countermeasure

What it does

Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.

Attacks this counters

The chain in this corpus runs CVE → CWE → CAPEC → ATT&CK technique, which ends at what an adversary does. This is the hop after: what stops it.

Source

Related

technique/T1003 technique/T1003.007 technique/T1018 technique/T1036 technique/T1036.003 technique/T1055 technique/T1055.009 technique/T1070 technique/T1543 technique/T1543.002 technique/T1548 technique/T1548.003 technique/T1556 technique/T1556.003 technique/T1574 technique/T1574.006