Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, and individual lessons.

MITRE D3FEND™ Learning Center

D3-HBPI — Hardware-based Process Isolation

Preventing one process from writing to the memory space of another process through hardware based address manager implementations.

1NIST mapping
2Mitigation mappings
36Enterprise inferred
12ICS inferred

Isolate · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Preventing one process from writing to the memory space of another process through hardware based address manager implementations.

Official D3FEND knowledge-base content

How it works

Process isolation, in this context, is address space separation controlled by a security function that limits the communication between processes so that one process cannot directly modify the executing code of another process. For example with virtual address space:

Hardware process isolation is commonly implemented through Direct Memory Access (DMA) which collaborates with a Memory Management Unit (MMU), or Input-Output Memory Management Unit (IOMMU). These hardware controls are deployed directly on processors to aid hosts or enclaves in process isolation.

  • Process A address space is different from process B address space, which prevents process A from writing to process B
  • DMA - Direct memory access allows memory access to occur independently of the program currently run by the microprocessor. DMA allows for I/O devices to directly read from and write to memory, or it can be used to efficiently copy blocks of memory. During DMA transfers, the microprocessor can execute an unrelated program.
  • MMU - A memory management unit acts as an access control and is responsible for performing the translation of virtual memory addresses to physical memory addresses. The MMU allocates each process its own virtual memory space.
  • IOMMU - An input-output memory management unit is used to allocate each I/O device its own virtual address space to the underlying physical addresses. IOMMU allows devices that do not support long memory addresses to address the entire memory space.

Considerations

  • Private hosts may be vulnerable to DMA attack if they have a PCI or PCI Express port that connects attached devices directly to physical address space.

Implementations:

  • Intel Virtualization Technology for Directed I/O (Intel VT-d)
  • Firecracker
Bare Metal Cyber interpretation

Implementation perspective

Hardware-based Process Isolation should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Create Process, Process.

Use the technique to create a logical or physical boundary that limits access, execution, communication, or movement.

Questions to ask

  • What is being isolated, from whom or what, and under which conditions?
  • Which flows or operations remain explicitly allowed across the boundary?
  • What happens when the isolation mechanism fails or loses policy context?
  • How is the boundary tested for alternate paths, bypasses, and unintended dependencies?

Evidence and validation

  • Architecture and data-flow diagrams showing the isolation boundary
  • Policy, rule, or configuration exports from enforcing components
  • Tests of allowed, denied, and failure-state behavior
  • Monitoring evidence for boundary violations and policy changes

Common failure patterns

  • The intended boundary has undocumented alternate paths or inherited trust relationships.
  • Rules accumulate without ownership, review, or removal of obsolete exceptions.
  • Isolation is assumed from network location while application, identity, or management paths remain open.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Parent techniques

Direct child techniques

None listed at this level.

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

isolatesProcess
restrictsCreate Process
Show inferred artifact relationship paths (2)
Hardware-based Process IsolationisolatesProcess
Hardware-based Process IsolationrestrictsCreate Process
Curated semantic mapping

NIST SP 800-53 relationships

The relation label is preserved from the D3FEND ontology. It is not converted into a claim that the control automatically implements or validates this technique.

Curated D3FEND mapping

ATT&CK Enterprise mitigation relationships

These links come from the D3FEND ontology’s ATT&CK mitigation mapping. They help users navigate between the knowledge bases and do not guarantee mitigation effectiveness.

D3FEND note: "Sandboxing" is often used to describe a detection environment which includes some forms of analysis (see D3-DA.)" Many forms of isolation (e.g., quarantining) are more static in nature and simply limit software's access to system resources.

Inferred and experimental

Offensive-technique relationships

These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.

ATT&CK Enterprise (36)
T1003.001LSASS MemoryCredential AccessT1003.002Security Account ManagerCredential AccessT1003.004LSA SecretsCredential AccessT1007System Service DiscoveryDiscoveryT1010Application Window DiscoveryDiscoveryT1016System Network Configuration DiscoveryDiscoveryT1018Remote System DiscoveryDiscoveryT1033System Owner/User DiscoveryDiscoveryT1047Windows Management InstrumentationExecutionT1053Scheduled Task/JobExecution, Persistence, Privilege EscalationT1053.005Scheduled TaskExecution, Persistence, Privilege EscalationT1055.004Asynchronous Procedure CallPrivilege Escalation, StealthT1055.013Process DoppelgängingPrivilege Escalation, StealthT1057Process DiscoveryDiscoveryT1082System Information DiscoveryDiscoveryT1124System Time DiscoveryDiscoveryT1134.004Parent PID SpoofingPrivilege Escalation, StealthT1140Deobfuscate/Decode Files or InformationStealthT1212Exploitation for Credential AccessCredential AccessT1218.001Compiled HTML FileStealthT1218.002Control PanelStealthT1218.003CMSTPStealthT1218.005MshtaStealthT1218.011Rundll32StealthT1220XSL Script ProcessingStealthT1505.001SQL Stored ProceduresPersistenceT1505.002Transport AgentPersistenceT1505.003Web ShellPersistenceT1546.007Netsh Helper DLLPersistence, Privilege EscalationT1546.009AppCert DLLsPersistence, Privilege EscalationT1546.010AppInit DLLsPersistence, Privilege EscalationT1548.002Bypass User Account ControlPrivilege EscalationT1550Use Alternate Authentication MaterialLateral MovementT1556Modify Authentication ProcessCredential Access, Defense Impairment, PersistenceT1562.001Disable or Modify ToolsStealthT1621Multi-Factor Authentication Request GenerationCredential Access
ATT&CK for ICS (12)
T0806Brute Force I/OImpair Process Control
T0813Denial of ControlImpact
T0814Denial of ServiceInhibit Response Function
T0819Exploit Public-Facing ApplicationInitial Access
T0821Modify controller TaskingExecution
T0823Graphical User InterfaceExecution
T0846Remote System DiscoveryDiscovery
T0863User ExecutionExecution
T0878Alarm SuppressionInhibit Response Function
T0888Remote System Information DiscoveryDiscovery
T0894System Binary Proxy ExecutionEvasion
T0895Autorun ImageExecution
Source record

Authoritative sources