Active Certificate Analysis
Actively collecting PKI certificates by connecting to the server and downloading its server certificates for analysis.
0 NIST0 mitigations6 inferred
Open technique →MITRE D3FEND™ Learning Center
Detect
The detect tactic is used to identify adversary access to or unauthorized activity on computer networks.
90Techniques
8Top-level families
Top-level technique families
Start with the major branches.
These techniques sit directly beneath the Defensive Technique root and organize the more specific techniques in this tactic.
D3-FA
File Analysis
File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.
4 direct child techniques →D3-IDIdentifier Analysis
Analyzing identifier artifacts such as IP address, domain names, or URL(I)s.
4 direct child techniques →D3-MAMessage Analysis
Analyzing email or instant message content to detect unauthorized activity.
2 direct child techniques →D3-NTANetwork Traffic Analysis
Analyzing intercepted or summarized computer network traffic to detect unauthorized activity.
17 direct child techniques →D3-PHAMPhysical Access Monitoring
Monitoring the physical access of a specified environment through detection, recording, reviewing, and logging of who/what enters and exists areas.
4 direct child techniques →D3-PMPlatform Monitoring
Monitoring platform components such as operating systems software, hardware devices, or firmware.
9 direct child techniques →D3-PAProcess Analysis
Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.
9 direct child techniques →D3-UBAUser Behavior Analysis
User behavior analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns-anomalies that indicate potential threats.' Instead of tracking devices or security events, UBA tracks a system's users. Big data platforms are increasing UBA functionality by allowing them to analyze petabytes worth of data to detect insider threats and advanced persistent threats.
11 direct child techniques →Complete tactic directory
Browse all 90 Detect techniques.
48 of 90 techniques shown
Administrative Network Activity Analysis
Detection of unauthorized use of administrative network protocols by analyzing network activity against a baseline.
0 NIST0 mitigations8 inferred
Open technique →Application Exception Monitoring
Monitoring the failures of system counters and timers.
0 NIST0 mitigations14 inferred
Open technique →Application Performance Monitoring
Monitoring the count and duration of the application or program cycle.
0 NIST0 mitigations14 inferred
Open technique →Application Protocol Command Analysis
Analyzing application protocol level remote commands to detect unauthorized activity.
0 NIST0 mitigations72 inferred
Open technique →Authentication Event Thresholding
Collecting authentication events, creating a baseline user profile, and determining whether authentication events are consistent with the baseline profile.
0 NIST2 mitigations0 inferred
Open technique →Authorization Event Thresholding
Collecting authorization events, creating a baseline user profile, and determining whether authorization events are consistent with the baseline profile.
0 NIST1 mitigations0 inferred
Open technique →Byte Sequence Emulation
Analyzing sequences of bytes and determining if they likely represent malicious shellcode.
0 NIST0 mitigations0 inferred
Open technique →Certificate Analysis
Analyzing Public Key Infrastructure certificates to detect if they have been misconfigured or spoofed using both network traffic, certificate fields and third-party logs.
0 NIST0 mitigations6 inferred
Open technique →Client-server Payload Profiling
Comparing client-server request and response payloads to a baseline profile to identify outliers.
0 NIST0 mitigations72 inferred
Open technique →Connection Attempt Analysis
Analyzing failed connections in a network to detect unauthorized activity.
0 NIST0 mitigations15 inferred
Open technique →Credential Compromise Scope Analysis
Determining which credentials may have been compromised by analyzing the user logon history of a particular system.
0 NIST0 mitigations20 inferred
Open technique →Database Query String Analysis
Analyzing database queries to detect [SQL Injection](https://capec.mitre.org/data/definitions/66.html).
0 NIST0 mitigations1 inferred
Open technique →DNS Traffic Analysis
Analysis of domain name metadata, including name and DNS records, to determine whether the domain is likely to resolve to an undesirable host.
0 NIST0 mitigations3 inferred
Open technique →Domain Account Monitoring
Monitoring the existence of or changes to Domain User Accounts.
2 NIST2 mitigations5 inferred
Open technique →Domain Name Reputation Analysis
Analyzing the reputation of a domain name.
0 NIST0 mitigations0 inferred
Open technique →Dynamic Analysis
Executing or opening a file in a synthetic "sandbox" environment to determine if the file is a malicious program or if the file exploits another program such as a document reader.
2 NIST1 mitigations38 inferred
Open technique →Electronic Lock Monitoring
Monitoring electronic lock and door hardware states and access events (e.g., locked/unlocked, access granted/denied, door forced/held, tamper) to detect and respond to unauthorized entry.
0 NIST0 mitigations0 inferred
Open technique →Emulated File Analysis
Emulating instructions in a file looking for specific patterns.
0 NIST0 mitigations38 inferred
Open technique →Endpoint Health Beacon
Monitoring the security status of an endpoint by sending periodic messages with health status, where absence of a response may indicate that the endpoint has been compromised.
0 NIST0 mitigations7 inferred
Open technique →File Access Pattern Analysis
Analyzing the files accessed by a process to identify unauthorized activity.
0 NIST0 mitigations0 inferred
Open technique →File Analysis
File Analysis is an analytic process to determine a file's status. For example: virus, trojan, benign, malicious, trusted, unauthorized, sensitive, etc.
3 NIST1 mitigations99 inferred
Open technique →File Carving
Identifying and extracting files from network application protocols through the use of network stream reassembly software.
0 NIST0 mitigations2 inferred
Open technique →File Content Analysis
Employing a pattern matching algorithm to statically analyze the content of files.
0 NIST0 mitigations99 inferred
Open technique →File Content Rules
Employing a pattern matching rule language to analyze the content of files.
1 NIST1 mitigations99 inferred
Open technique →File Creation Analysis
Analyzing the properties of file create system call invocations.
0 NIST0 mitigations2 inferred
Open technique →File Hash Reputation Analysis
Analyzing the reputation of a file hash.
0 NIST0 mitigations0 inferred
Open technique →File Hashing
Employing file hash comparisons to detect known malware.
0 NIST1 mitigations99 inferred
Open technique →File Integrity Monitoring
Detecting any suspicious changes to files in a computer system.
0 NIST0 mitigations99 inferred
Open technique →Firmware Behavior Analysis
Analyzing the behavior of embedded code in firmware and looking for anomalous behavior and suspicious activity.
0 NIST0 mitigations4 inferred
Open technique →Firmware Embedded Monitoring Code
Monitoring code is injected into firmware for integrity monitoring of firmware and firmware data.
0 NIST0 mitigations4 inferred
Open technique →Firmware Verification
Cryptographically verifying firmware integrity.
7 NIST0 mitigations4 inferred
Open technique →Homoglyph Detection
Comparing strings using a variety of techniques to determine if a deceptive or malicious string is being presented to a user.
0 NIST0 mitigations7 inferred
Open technique →Identifier Activity Analysis
Taking known malicious identifiers and determining if they are present in a system.
0 NIST0 mitigations4 inferred
Open technique →Identifier Analysis
Analyzing identifier artifacts such as IP address, domain names, or URL(I)s.
2 NIST0 mitigations7 inferred
Open technique →Identifier Reputation Analysis
Analyzing the reputation of an identifier.
0 NIST0 mitigations4 inferred
Open technique →Inbound Session Volume Analysis
Analyzing inbound network session or connection attempt volume.
0 NIST1 mitigations6 inferred
Open technique →Indirect Branch Call Analysis
Analyzing vendor specific branch call recording in order to detect ROP style attacks.
0 NIST0 mitigations0 inferred
Open technique →Input Device Analysis
Operating system level mechanisms to prevent abusive input device exploitation.
0 NIST0 mitigations3 inferred
Open technique →IP Reputation Analysis
Analyzing the reputation of an IP address.
0 NIST0 mitigations0 inferred
Open technique →IPC Traffic Analysis
Analyzing standard inter process communication (IPC) protocols to detect deviations from normal protocol activity.
0 NIST0 mitigations1 inferred
Open technique →Job Function Access Pattern Analysis
Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department.
1 NIST1 mitigations0 inferred
Open technique →Local Account Monitoring
Analyzing local user accounts to detect unauthorized activity.
16 NIST2 mitigations3 inferred
Open technique →Memory Boundary Tracking
Analyzing a call stack for return addresses which point to unexpected memory locations.
0 NIST0 mitigations7 inferred
Open technique →Message Analysis
Analyzing email or instant message content to detect unauthorized activity.
2 NIST0 mitigations4 inferred
Open technique →Motion Sensor Monitoring
Monitoring events from motion detectors (e.g., passive IR, microwave, dual-technology) to detect presence or movement within protected areas.
0 NIST0 mitigations0 inferred
Open technique →Network Traffic Analysis
Analyzing intercepted or summarized computer network traffic to detect unauthorized activity.
8 NIST3 mitigations74 inferred
Open technique →Network Traffic Community Deviation
Establishing baseline communities of network hosts and identifying statistically divergent inter-community communication.
0 NIST0 mitigations72 inferred
Open technique →Network Traffic Signature Analysis
Analyzing network traffic and compares it to known signatures
0 NIST0 mitigations72 inferred
Open technique →Operating Mode Monitoring
Detects operating modes such as Program, Run, Remote, or Stop.
0 NIST0 mitigations0 inferred
Open technique →Operating System Monitoring
The operating system software, for D3FEND's purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.
1 NIST0 mitigations44 inferred
Open technique →Operational Process Monitoring
Monitoring physical parameters and operator actions related to an operational environment.
0 NIST0 mitigations13 inferred
Open technique →Passive Certificate Analysis
Collecting host certificates from network traffic or other passive sources like a certificate transparency log and analyzing them for unauthorized activity.
0 NIST0 mitigations6 inferred
Open technique →Per Host Download-Upload Ratio Analysis
Detecting anomalies that indicate malicious activity by comparing the amount of data downloaded versus data uploaded by a host.
0 NIST0 mitigations72 inferred
Open technique →Peripheral Firmware Verification
Cryptographically verifying peripheral firmware integrity.
2 NIST0 mitigations0 inferred
Open technique →Physical Access Monitoring
Monitoring the physical access of a specified environment through detection, recording, reviewing, and logging of who/what enters and exists areas.
0 NIST0 mitigations1 inferred
Open technique →Platform Monitoring
Monitoring platform components such as operating systems software, hardware devices, or firmware.
3 NIST0 mitigations139 inferred
Open technique →Platform Uptime Monitoring
Monitor the amount of time since the last power cycle or restart.
0 NIST0 mitigations0 inferred
Open technique →Process Analysis
Process Analysis consists of observing a running application process and analyzing it to watch for certain behaviors or conditions which may indicate adversary activity. Analysis can occur inside of the process or through a third-party monitoring application. Examples include monitoring system and privileged calls, monitoring process initiation chains, and memory boundary allocations.
3 NIST1 mitigations59 inferred
Open technique →Process Code Segment Verification
Comparing the "text" or "code" memory segments to a source of truth.
0 NIST0 mitigations7 inferred
Open technique →Process Lineage Analysis
Identification of suspicious processes executing on an end-point device by examining the ancestry and siblings of a process, and the associated metadata of each node on the tree, such as process execution, duration, and order relative to siblings and ancestors.
0 NIST0 mitigations14 inferred
Open technique →Process Self-Modification Detection
Detects processes that modify, change, or replace their own code at runtime.
0 NIST0 mitigations14 inferred
Open technique →Process Spawn Analysis
Analyzing spawn arguments or attributes of a process to detect processes that are unauthorized.
0 NIST0 mitigations36 inferred
Open technique →Protocol Metadata Anomaly Detection
Collecting network communication protocol metadata and identifying statistical outliers.
0 NIST0 mitigations72 inferred
Open technique →Proximity Sensor Monitoring
Monitoring events from proximity sensors that indicate a credential or tagged asset is within the sensor’s read range or a defined zone. Common enabling technologies include RFID, Bluetooth Low Energy (BLE), and Ultra-Wideband (UWB).
0 NIST0 mitigations0 inferred
Open technique →Relay Pattern Analysis
The detection of an internal host relaying traffic between the internal network and the external network.
0 NIST0 mitigations30 inferred
Open technique →Remote Firmware Update Monitoring
Monitoring of remote firmware update commands to identify unauthorized software installations.
0 NIST0 mitigations0 inferred
Open technique →Remote Terminal Session Detection
Detection of an unauthorized remote live terminal console session by examining network traffic to a network host.
0 NIST0 mitigations72 inferred
Open technique →Resource Access Pattern Analysis
Analyzing the resources accessed by a user to identify unauthorized activity.
1 NIST1 mitigations0 inferred
Open technique →RPC Traffic Analysis
Monitoring the activity of remote procedure calls in communication traffic to establish standard protocol operations and potential attacker activities.
0 NIST0 mitigations1 inferred
Open technique →Scheduled Job Analysis
Analysis of source files, processes, destination files, or destination servers associated with a scheduled job to detect unauthorized use of job scheduling.
0 NIST0 mitigations2 inferred
Open technique →Script Execution Analysis
Analyzing the execution of a script to detect unauthorized user activity.
0 NIST0 mitigations0 inferred
Open technique →Sender MTA Reputation Analysis
Characterizing the reputation of mail transfer agents (MTA) to determine the security risk in emails.
0 NIST0 mitigations4 inferred
Open technique →Sender Reputation Analysis
Ascertaining sender reputation based on information associated with a message (e.g. email/instant messaging).
0 NIST0 mitigations4 inferred
Open technique →Service Binary Verification
Analyzing changes in service binary files by comparing to a source of truth.
0 NIST1 mitigations17 inferred
Open technique →Session Duration Analysis
Analyzing the duration of user sessions in order to detect unauthorized activity.
0 NIST1 mitigations0 inferred
Open technique →Shadow Stack Comparisons
Comparing a call stack in system memory with a shadow call stack maintained by the processor to determine unauthorized shellcode activity.
0 NIST1 mitigations5 inferred
Open technique →System Call Analysis
Analyzing system calls to determine whether a process is exhibiting unauthorized behavior.
0 NIST0 mitigations40 inferred
Open technique →System Daemon Monitoring
Tracking changes to the state or configuration of critical system level processes.
0 NIST0 mitigations3 inferred
Open technique →System File Analysis
Monitoring system files such as authentication databases, configuration files, system logs, and system executables for modification or tampering.
0 NIST2 mitigations17 inferred
Open technique →System Firmware Verification
Cryptographically verifying installed system firmware integrity.
2 NIST0 mitigations2 inferred
Open technique →System Init Config Analysis
Analysis of any system process startup configuration.
0 NIST0 mitigations5 inferred
Open technique →URL Analysis
Determining if a URL is benign or malicious by analyzing the URL or its components.
0 NIST1 mitigations4 inferred
Open technique →URL Reputation Analysis
Analyzing the reputation of a URL.
0 NIST0 mitigations4 inferred
Open technique →User Behavior Analysis
User behavior analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns-anomalies that indicate potential threats.' Instead of tracking devices or security events, UBA tracks a system's users. Big data platforms are increasing UBA functionality by allowing them to analyze petabytes worth of data to detect insider threats and advanced persistent threats.
4 NIST0 mitigations96 inferred
Open technique →User Data Transfer Analysis
Analyzing the amount of data transferred by a user.
1 NIST1 mitigations0 inferred
Open technique →User Geolocation Logon Pattern Analysis
Monitoring geolocation data of user logon attempts and comparing it to a baseline user behavior profile to identify anomalies in logon location.
0 NIST1 mitigations72 inferred
Open technique →User Session Init Config Analysis
Analyzing modifications to user session config files such as .bashrc or .bash_profile.
0 NIST0 mitigations2 inferred
Open technique →Video Surveillance
Monitoring of physical areas via camera video feeds to deter, detect, and investigate unauthorized access and related security events.
0 NIST0 mitigations1 inferred
Open technique →Web Session Activity Analysis
Monitoring changes in user web session behavior by comparing current web session activity to a baseline behavior profile or a catalog of predetermined malicious behavior.
0 NIST1 mitigations0 inferred
Open technique →No matching techniques
Try a shorter term or clear the filters.